author: Michael Haag, Splunk
datamodel:
- Endpoint.Processes
date: '2021-12-13'
description: The following analytic identifies the process name of Java, Apache, or
  Tomcat spawning a Linux shell. This is potentially indicative of exploitation of
  the Java application and may be related to current event CVE-2021-44228 (Log4Shell).
  The shells included in the macro are "sh", "ksh", "zsh", "bash", "dash", "rbash",
  "fish", "csh', "tcsh', "ion", "eshell". Upon triage, review parallel processes and
  command-line arguments to determine legitimacy.
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
  occurring correctly. Ensure EDR product is mapping OS Linux to the datamodel properly.
  Add any additional java process names for your environment to the analytic as needed.
id: 7b09db8a-5c20-11ec-9945-acde48001122
known_false_positives: Filtering may be required on internal developer build systems
  or classify assets as web facing and restrict the analytic based on asset type.
name: Linux Java Spawning Shell
references:
- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=java
  OR Processes.parent_process_name=apache OR Processes.parent_process_name=tomcat
  `linux_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_spawning_shell_filter`'
tags:
  analytic_story:
  - Log4Shell CVE-2021-44228
  confidence: 50
  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  cve:
  - CVE-2021-44228
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/java_spawn_shell_nix.log
  impact: 80
  kill_chain_phases:
  - Exploitation
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation.
  mitre_attack_id:
  - T1190
  observable:
  - name: dest
    role:
    - Victim
    type: Hostname
  - name: parent_process_name
    role:
    - Parent Process
    type: Parent Process
  - name: process_name
    role:
    - Child Process
    type: Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - Endpoint.Processes.dest
  - Endpoint.Processes.parent_process_id
  - Endpoint.Processes.parent_process_name
  - Endpoint.Processes.process
  - Endpoint.Processes.process_id
  - Endpoint.Processes.process_name
  - Endpoint.Processes.user
  - _time
  risk_score: 40
  security_domain: endpoint
type: TTP
version: 1