diff --git a/rules/linux/execution_apt_binary.toml b/rules/_deprecated/execution_apt_binary.toml similarity index 95% rename from rules/linux/execution_apt_binary.toml rename to rules/_deprecated/execution_apt_binary.toml index d3099ebe9..b9e8ef882 100644 --- a/rules/linux/execution_apt_binary.toml +++ b/rules/_deprecated/execution_apt_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/02/24" -maturity = "production" -updated_date = "2022/03/31" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_awk_binary_shell.toml b/rules/_deprecated/execution_awk_binary_shell.toml similarity index 95% rename from rules/linux/execution_awk_binary_shell.toml rename to rules/_deprecated/execution_awk_binary_shell.toml index a6ee81e58..887a04ae0 100644 --- a/rules/linux/execution_awk_binary_shell.toml +++ b/rules/_deprecated/execution_awk_binary_shell.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/02/24" -maturity = "production" -updated_date = "2022/03/31" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_busybox_binary.toml b/rules/_deprecated/execution_busybox_binary.toml similarity index 79% rename from rules/linux/execution_busybox_binary.toml rename to rules/_deprecated/execution_busybox_binary.toml index d6554baed..60ebef005 100644 --- a/rules/linux/execution_busybox_binary.toml +++ b/rules/_deprecated/execution_busybox_binary.toml @@ -1,15 +1,16 @@ [metadata] creation_date = "2022/03/15" -maturity = "production" -updated_date = "2022/03/24" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] description = """ Identifies Linux binary busybox abuse to break out from restricted environments by spawning an interactive system -shell.The busybox is software utility suite that provides several Unix utilities in a single executable file and the activity of spawing a shell is -not a standard use of this binary by a user or system administrator. It indicates a potentially -malicious actor attempting to improve the capabilities or stability of their access. +shell.The busybox is software utility suite that provides several Unix utilities in a single executable file and the +activity of spawing a shell is not a standard use of this binary by a user or system administrator. It indicates a +potentially malicious actor attempting to improve the capabilities or stability of their access. """ from = "now-9m" index = ["logs-endpoint.events.*"] diff --git a/rules/linux/execution_c89_c99_binary.toml b/rules/_deprecated/execution_c89_c99_binary.toml similarity index 95% rename from rules/linux/execution_c89_c99_binary.toml rename to rules/_deprecated/execution_c89_c99_binary.toml index 2200b836a..ef9876948 100644 --- a/rules/linux/execution_c89_c99_binary.toml +++ b/rules/_deprecated/execution_c89_c99_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/15" -maturity = "production" -updated_date = "2022/03/31" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_cpulimit_binary.toml b/rules/_deprecated/execution_cpulimit_binary.toml similarity index 91% rename from rules/linux/execution_cpulimit_binary.toml rename to rules/_deprecated/execution_cpulimit_binary.toml index a2351a429..f9aa125cf 100644 --- a/rules/linux/execution_cpulimit_binary.toml +++ b/rules/_deprecated/execution_cpulimit_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/17" -maturity = "production" -updated_date = "2022/03/31" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] @@ -9,8 +10,8 @@ description = """ Identifies Linux binary cpulimit abuse to break out from restricted environments by spawning an interactive system shell. The cpulimit utility is used to restrict the CPU usage of a process in cases of CPU or system load exceeding the defined threshold and the activity of spawning a shell is not a standard use of this binary by a user or system -administrator. This can potentially indicate a malicious actor attempting to improve the capabilities or stability of their -access. +administrator. This can potentially indicate a malicious actor attempting to improve the capabilities or stability of +their access. """ from = "now-9m" index = ["logs-endpoint.events.*"] diff --git a/rules/linux/execution_crash_binary.toml b/rules/_deprecated/execution_crash_binary.toml similarity index 94% rename from rules/linux/execution_crash_binary.toml rename to rules/_deprecated/execution_crash_binary.toml index 1ce3568a1..4609674a5 100644 --- a/rules/linux/execution_crash_binary.toml +++ b/rules/_deprecated/execution_crash_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/21" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_env_binary.toml b/rules/_deprecated/execution_env_binary.toml similarity index 94% rename from rules/linux/execution_env_binary.toml rename to rules/_deprecated/execution_env_binary.toml index d4563ba11..1eef6d4f5 100644 --- a/rules/linux/execution_env_binary.toml +++ b/rules/_deprecated/execution_env_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/02/24" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_expect_binary.toml b/rules/_deprecated/execution_expect_binary.toml similarity index 95% rename from rules/linux/execution_expect_binary.toml rename to rules/_deprecated/execution_expect_binary.toml index 3e698ecf0..c28cc2d3e 100644 --- a/rules/linux/execution_expect_binary.toml +++ b/rules/_deprecated/execution_expect_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/07" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_find_binary.toml b/rules/_deprecated/execution_find_binary.toml similarity index 95% rename from rules/linux/execution_find_binary.toml rename to rules/_deprecated/execution_find_binary.toml index d09e2498e..4f084bf59 100644 --- a/rules/linux/execution_find_binary.toml +++ b/rules/_deprecated/execution_find_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/02/28" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_flock_binary.toml b/rules/_deprecated/execution_flock_binary.toml similarity index 95% rename from rules/linux/execution_flock_binary.toml rename to rules/_deprecated/execution_flock_binary.toml index 19ed27e48..1fecfb49c 100644 --- a/rules/linux/execution_flock_binary.toml +++ b/rules/_deprecated/execution_flock_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/22" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_gcc_binary.toml b/rules/_deprecated/execution_gcc_binary.toml similarity index 95% rename from rules/linux/execution_gcc_binary.toml rename to rules/_deprecated/execution_gcc_binary.toml index d2b163a28..5fac6b60f 100644 --- a/rules/linux/execution_gcc_binary.toml +++ b/rules/_deprecated/execution_gcc_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/09" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_mysql_binary.toml b/rules/_deprecated/execution_mysql_binary.toml similarity index 95% rename from rules/linux/execution_mysql_binary.toml rename to rules/_deprecated/execution_mysql_binary.toml index cff334632..5a968a55e 100644 --- a/rules/linux/execution_mysql_binary.toml +++ b/rules/_deprecated/execution_mysql_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/09" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_ssh_binary.toml b/rules/_deprecated/execution_ssh_binary.toml similarity index 95% rename from rules/linux/execution_ssh_binary.toml rename to rules/_deprecated/execution_ssh_binary.toml index b5038ccb3..16d1487c0 100644 --- a/rules/linux/execution_ssh_binary.toml +++ b/rules/_deprecated/execution_ssh_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/10" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_vi_binary.toml b/rules/_deprecated/execution_vi_binary.toml similarity index 95% rename from rules/linux/execution_vi_binary.toml rename to rules/_deprecated/execution_vi_binary.toml index 48838367b..e9d832c9a 100644 --- a/rules/linux/execution_vi_binary.toml +++ b/rules/_deprecated/execution_vi_binary.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2022/03/03" -maturity = "production" -updated_date = "2022/04/29" +deprecation_date = "2022/05/09" +maturity = "deprecated" +updated_date = "2022/05/09" [rule] author = ["Elastic"] diff --git a/rules/linux/execution_nice_binary.toml b/rules/linux/execution_nice_binary.toml deleted file mode 100644 index 5089ed27d..000000000 --- a/rules/linux/execution_nice_binary.toml +++ /dev/null @@ -1,51 +0,0 @@ -[metadata] -creation_date = "2022/03/07" -maturity = "development" -updated_date = "2022/03/31" - -[rule] -author = ["Elastic"] -description = """ -Identifies Linux binary nice abuse to break out from restricted environments by spawning an interactive system shell.The -nice command is used to invoke a utility or a shell script with a particular CPU priority, thus giving the process more -or less CPU and the activity of spawning shell is not a standard use of this binary for a user or system -administrator.It indicates a potentially malicious actor attempting to improve the capabilities or stability of their -access. -""" -from = "now-9m" -index = ["logs-endpoint.events.*"] -language = "eql" -license = "Elastic License v2" -name = "Linux Restricted Shell Breakout via nice Shell evasion" -references = ["https://gtfobins.github.io/gtfobins/nice/"] -risk_score = 47 -rule_id = "22755f7f-1e1e-4528-a75f-bb3f4026d1b9" -severity = "medium" -tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution", "GTFOBins"] -timestamp_override = "event.ingested" -type = "eql" - -query = ''' -process where event.type == "start" and process.name in ("bash", "sh", "dash") and - process.parent.name == "nice" and process.parent.args in ("/bin/bash", "/bin/sh", "/bin/dash", "sh", "bash", "dash") -''' - - -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1059" -name = "Command and Scripting Interpreter" -reference = "https://attack.mitre.org/techniques/T1059/" -[[rule.threat.technique.subtechnique]] -id = "T1059.004" -name = "Unix Shell" -reference = "https://attack.mitre.org/techniques/T1059/004/" - - - -[rule.threat.tactic] -id = "TA0002" -name = "Execution" -reference = "https://attack.mitre.org/tactics/TA0002/" - diff --git a/rules/linux/execution_shell_evasion_linux_binary.toml b/rules/linux/execution_shell_evasion_linux_binary.toml new file mode 100644 index 000000000..31a7dce98 --- /dev/null +++ b/rules/linux/execution_shell_evasion_linux_binary.toml @@ -0,0 +1,103 @@ +[metadata] +creation_date = "2022/05/06" +maturity = "production" +updated_date = "2022/05/09" + +[rule] +author = ["Elastic"] +description = """ +Identifies Linux binary(s) abuse to breakout out of restricted shells or environments by spawning an interactive system +shell. The linux utility(s) activity of spawning shell is not a standard use of the binary for a user or system +administrator. It may indicates an attempt to improve the capabilities or stability of an adversary access. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Linux Restricted Shell Breakout via Linux Binary(s)" +references = [ + "https://gtfobins.github.io/gtfobins/apt/", + "https://gtfobins.github.io/gtfobins/apt-get/", + "https://gtfobins.github.io/gtfobins/nawk/", + "https://gtfobins.github.io/gtfobins/mawk/", + "https://gtfobins.github.io/gtfobins/awk/", + "https://gtfobins.github.io/gtfobins/gawk/", + "https://gtfobins.github.io/gtfobins/busybox/", + "https://gtfobins.github.io/gtfobins/c89/", + "https://gtfobins.github.io/gtfobins/c99/", + "https://gtfobins.github.io/gtfobins/cpulimit/", + "https://gtfobins.github.io/gtfobins/crash/", + "https://gtfobins.github.io/gtfobins/env/", + "https://gtfobins.github.io/gtfobins/expect/", + "https://gtfobins.github.io/gtfobins/find/", + "https://gtfobins.github.io/gtfobins/flock/", + "https://gtfobins.github.io/gtfobins/gcc/", + "https://gtfobins.github.io/gtfobins/mysql/", + "https://gtfobins.github.io/gtfobins/nice/", + "https://gtfobins.github.io/gtfobins/ssh/", + "https://gtfobins.github.io/gtfobins/vi/", + "https://gtfobins.github.io/gtfobins/vim/", + "https://gtfobins.github.io/gtfobins/capsh/", + "https://gtfobins.github.io/gtfobins/byebug/", +] +risk_score = 47 +rule_id = "52376a86-ee86-4967-97ae-1a05f55816f0" +severity = "medium" +tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution", "GTFOBins"] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +process where event.type == "start" and + + /* launch shells from unusual process */ + (process.name == "capsh" and process.args == "--") or + + /* launching shells from unusual parents or parent+arg combos */ + (process.name in ("bash", "sh", "dash","ash") and + (process.parent.name == "byebug") or + + /* shells specified in parent args */ + /* nice rule is broken in 8.2 */ + (process.parent.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash") and + (process.parent.name == "nice") or + (process.parent.name == "cpulimit" and process.parent.args == "-f") or + (process.parent.name == "find" and process.parent.args == "-exec" and process.parent.args == ";") or + (process.parent.name == "flock" and process.parent.args == "-u" and process.parent.args == "/") + ) or + + /* shells specified in args */ + (process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash") and + (process.parent.name == "crash" and process.parent.args == "-h") or + (process.name == "sensible-pager" and process.parent.name in ("apt", "apt-get") and process.parent.args == "changelog") + /* scope to include more sensible-pager invoked shells with different parent process to reduce noise and remove false positives */ + ) + ) or + (process.name == "busybox" and process.args_count == 2 and process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash") )or + (process.name == "env" and process.args_count == 2 and process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash")) or + (process.parent.name in ("vi", "vim") and process.parent.args == "-c" and process.parent.args in (":!/bin/bash", ":!/bin/sh", ":!bash", ":!sh")) or + (process.parent.name in ("c89","c99", "gcc") and process.parent.args in ("sh,-s", "bash,-s", "dash,-s", "ash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s", "/bin/ash,-s") and process.parent.args == "-wrapper") or + (process.parent.name == "expect" and process.parent.args == "-c" and process.parent.args in ("spawn /bin/sh;interact", "spawn /bin/bash;interact", "spawn /bin/dash;interact", "spawn sh;interact", "spawn bash;interact", "spawn dash;interact")) or + (process.parent.name == "mysql" and process.parent.args == "-e" and process.parent.args in ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")) or + (process.parent.name == "ssh" and process.parent.args == "-o" and process.parent.args in ("ProxyCommand=;sh 0<&2 1>&2", "ProxyCommand=;bash 0<&2 1>&2", "ProxyCommand=;dash 0<&2 1>&2", "ProxyCommand=;/bin/sh 0<&2 1>&2", "ProxyCommand=;/bin/bash 0<&2 1>&2", "ProxyCommand=;/bin/dash 0<&2 1>&2")) or + (process.parent.name in ("nawk", "mawk", "awk", "gawk") and process.parent.args : "BEGIN {system(*)}") +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.004" +name = "Unix Shell" +reference = "https://attack.mitre.org/techniques/T1059/004/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/"