mirror of
https://github.com/elastic/protections-artifacts
synced 2026-06-08 14:02:19 +00:00
protectionsmachine
60 lines
1.9 KiB
TOML
60 lines
1.9 KiB
TOML
[rule]
|
|
description = """
|
|
This rule monitors for suspicious Lua command executions by detecting the start of a Lua process with a command line
|
|
argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments
|
|
include operations to execute code, create subprocesses, and encode or decode data.
|
|
"""
|
|
id = "5383342f-7ddd-46c6-90dc-349499df90f1"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious Lua Command Execution"
|
|
os_list = ["linux"]
|
|
version = "1.0.3"
|
|
|
|
query = '''
|
|
process where event.type == "start" and event.action == "exec" and process.name like~ "lua*" and
|
|
process.args == "-e" and process.command_line like~ (
|
|
"*os.execute(*", "*io.popen(*", "*load(*", "*loadstring(*", "*require(*", "*dofile(*",
|
|
"*package.loadlib(*", "*base64.decode(*", "*base64.encode(*", "*zlib.inflate(*",
|
|
"*zlib.deflate(*", "*zlib.decompress(*", "*zlib.compress(*", "*socket.bind(*",
|
|
"*socket.connect(*", "*socket.receive(*", "*socket.send(*", "*socket.tcp(*",
|
|
"*socket.udp(*", "*socket.listen(*", "*socket.accept(*", "*net.http.request(*",
|
|
"*net.http.get(*", "*net.http.post(*", "*http.request(*", "*http.get(*", "*http.post(*"
|
|
) and not (
|
|
process.parent.name in ("make", "configure") or
|
|
process.command_line in ("lua -e require('cjson')", "lua -e require('socket')")
|
|
)
|
|
'''
|
|
|
|
min_endpoint_version = "7.15.0"
|
|
optional_actions = []
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.entity_id"
|
|
state = 0
|
|
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.parent.entity_id"
|
|
state = 0
|
|
|
|
[[threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
[[threat.technique.subtechnique]]
|
|
id = "T1059.011"
|
|
name = "Lua"
|
|
reference = "https://attack.mitre.org/techniques/T1059/011/"
|
|
|
|
|
|
|
|
[threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[internal]
|
|
min_endpoint_version = "7.15.0"
|