mirror of
https://github.com/elastic/protections-artifacts
synced 2026-06-08 14:02:19 +00:00
protectionsmachine
97 lines
5.3 KiB
TOML
97 lines
5.3 KiB
TOML
[rule]
|
|
description = """
|
|
This rule monitors for suspicious Python command executions by detecting the start of a Python process with a command
|
|
line argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments
|
|
include operations to execute code, create subprocesses, and encode or decode data.
|
|
"""
|
|
id = "028d01ae-bfbf-438e-a0d0-23aee55ea5c9"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious Python Command Execution"
|
|
os_list = ["linux"]
|
|
version = "1.0.13"
|
|
|
|
query = '''
|
|
process where event.type == "start" and event.action == "exec" and
|
|
process.executable like~ ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
|
|
process.args == "-c" and process.command_line like~ (
|
|
"*exec(*base64*", "*exec(*decode(*", "*exec(*marshal*", "*exec(*pickle*", "*eval(*exec(*",
|
|
"*eval(*", "*subprocess.popen(*", "*subprocess.run(*", "*pickle.loads(*", "*marshal.loads(*",
|
|
"*binascii*", "*os.system(*", "*os.popen(*", "*pty.*", "*dup2*", "*fileno()*", "*connect(*",
|
|
"*bind(*", "*execve(*", "*base64*", "*base32*", "*base16*", "*base85*", "*decode(*",
|
|
"*zlib.*", "*[::-1]*", "*socket.socket(*", "*socket.connect(*", "*socket.bind(*"
|
|
) and process.working_directory like (
|
|
"/var/www/*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*", "/root/*"
|
|
) and not (
|
|
process.parent.args in ("pip", "install", "--pgo", "/tmp/portage/bin/pid-ns-init") or
|
|
process.parent.args like "/home/*/bin/join-zoom.sh" or
|
|
process.parent.name in ("pip", "pytest", "pip3", "sudo", "sshd", "teleport") or
|
|
process.executable like~ ("/var/lib/docker/*", "/tmp/plz_sandbox/*") or
|
|
process.command_line like (
|
|
"/usr/local/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
|
|
"/usr/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
|
|
"python -c import socket s = socket.socket(socket.AF_INET) s.bind(('127.0.0.1', 0)) _, listen_port = s.getsockname() s.close() print(listen_port)",
|
|
"*sqlite*", "*postgres*", "python -c import sys;import base64;sys.stdout.write('@Main\n');exec(base64.b64decode(sys.stdin.readline().rstrip()))#ZeroNetworks",
|
|
"""/usr/bin/python3 -c from tkinter import Tcl; print(Tcl().eval("info*"))""",
|
|
"python3*os.system*echo test*", "python3 -c import pymysql*",
|
|
"python3 -c import socket; s=socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()",
|
|
"python3 -c import socket; s=socket.socket(); s.bind(('0', 0)); print(s.getsockname()[1]); s.close()",
|
|
"python3 -c import socket; s=socket.socket(); s.bind(('0.0.0.0', 0)); print(s.getsockname()[1]); s.close()",
|
|
"python3 -c import socket; s=socket.socket(); s.bind(('localhost', 0)); print(s.getsockname()[1]); s.close()",
|
|
"import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
|
|
"*Thomas Nagy*"
|
|
) or
|
|
process.parent.executable like~ (
|
|
"/var/lib/amazon/ssm/*", "/var/anaconda3/envs/*", "/tmp/plz_sandbox/test", "/usr/bin/cockpit-bridge",
|
|
"/pro/bin/sys/dbutils/dbaValidateOsUserCredentials.sh", "/usr/sbin/lxc", "/sbin/lxc", "/data/flash/Linux_for_Tegra/flash.sh",
|
|
"/usr/bin/ansible-playbook", "/usr/local/bin/teleport", "/usr/local/bin/odoo-helper", "/home/*/bin/join-zoom.sh",
|
|
"/usr/lib/openssh/sshd-session", "/usr/sbin/lxd", "/usr/sbin/tailscaled"
|
|
) or
|
|
process.args like~ """import zlib,base64; exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTb*""" or
|
|
process.working_directory like~ (
|
|
"/data/jenkins/.local/share/containers/storage/overlay/*", "/var/run/cloudera-scm-agent/*", "/tmp/pip-req-build*",
|
|
"/tmp/pip-resolve-*", "/build/source", "/tmp/pip-install-*", "/opt/airflow", "/tmp/pip-wheel-*", "/tmp/pip-download-*",
|
|
"/tmp/plz_sandbox", "/builds/*", "/scratch/*", "/tmp/cmdickens/easybuild/*", "/tmp/thangha/easybuild*",
|
|
"/tmp/baum/easybuild/*", "/tmp/zenix-flashing/*", "/opt/ansible*", "/pro/bin/sys/monitor", "/home/jenkins/workspace/*",
|
|
"/var/tmp/portage/*", "/tmp/build/*/ansible", "/root/thg-intelligence", "/home/*/*/*/*", "/root/airflow"
|
|
) or
|
|
process.parent.command_line like~ "/nix/store/*pytest*" or
|
|
process.parent.command_line in ("/bin/bash /docker-entrypoint.sh worker", "/bin/bash /docker-entrypoint.sh") or
|
|
(process.parent.args == "/usr/sbin/lxc" and process.parent.args in ("list", "info", "version")) or
|
|
(process.working_directory like "/tmp/tmp.*" and process.command_line == "python3 -c import socket; s = socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()") or
|
|
(
|
|
process.executable in ("/bin/python2", "/usr/bin/python2") and
|
|
process.command_line like (
|
|
"*causixenqueuer/firefoot/config.json*", "*s3loguploader.yml*", "*MUM1_AWS_ACCESS_KEY_ID*", "*/etc/init/ahn.conf*", "*AWS_SECRET_ACCESS_KEY_SGP1*"
|
|
)
|
|
)
|
|
)
|
|
'''
|
|
|
|
min_endpoint_version = "7.15.0"
|
|
optional_actions = []
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.entity_id"
|
|
state = 0
|
|
|
|
[[threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
[[threat.technique.subtechnique]]
|
|
id = "T1059.006"
|
|
name = "Python"
|
|
reference = "https://attack.mitre.org/techniques/T1059/006/"
|
|
|
|
|
|
|
|
[threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[internal]
|
|
min_endpoint_version = "7.15.0"
|