security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Small Linux DR Tuning (#3074)

Browse Source 
* [Rule tuning] Adressing community issue

* Changed title

* Changed IG title
This commit is contained in:
Ruben Groenewoud
2023-09-05 14:20:57 +02:00
committed by GitHub
parent 811d1b7727
commit 6115a68aba
2 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_shell_evasion_linux_binary.toml
+8 -4
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/08/04"
updated_date = "2023/09/05"
[rule]
author = ["Elastic"]
@@ -108,7 +108,10 @@ process where host.os.type == "linux" and event.type == "start" and
/* launching shells from unusual parents or parent+arg combos */
(process.name : "*sh" and (
(process.parent.name : ("byebug", "ftp", "strace", "zip", "*awk", "git", "tar") and
(process.parent.name : "*awk" and process.parent.args : "BEGIN {system(*)}") or
(process.parent.name == "git" and process.parent.args : ("*PAGER*", "!*sh", "exec *sh") or
process.args : ("*PAGER*", "!*sh", "exec *sh") and not process.name == "ssh" ) or
(process.parent.name : ("byebug", "ftp", "strace", "zip", "tar") and
(
process.parent.args : "BEGIN {system(*)}" or
(process.parent.args : ("*PAGER*", "!*sh", "exec *sh") or process.args : ("*PAGER*", "!*sh", "exec *sh")) or
@@ -125,7 +128,8 @@ process where host.os.type == "linux" and event.type == "start" and
(
(process.parent.name == "nice") or
(process.parent.name == "cpulimit" and process.parent.args == "-f") or
(process.parent.name == "find" and process.parent.args == "-exec" and process.parent.args == ";" and process.parent.args == "-p") or
(process.parent.name == "find" and process.parent.args == "." and process.parent.args == "-exec" and
process.parent.args == ";" and process.parent.args : "/bin/*sh") or
(process.parent.name == "flock" and process.parent.args == "-u" and process.parent.args == "/")
)
)
@@ -140,7 +144,7 @@ process where host.os.type == "linux" and event.type == "start" and
)) or
(process.name == "busybox" and event.action == "exec" and process.args_count == 2 and process.args : "*sh" and not
process.executable : "/var/lib/docker/overlay2/*/merged/bin/busybox" and not (process.parent.args == "init" and
process.parent.args == "runc") and not process.parent.args in ("ls-remote", "push", "fetch")) or
process.parent.args == "runc") and not process.parent.args in ("ls-remote", "push", "fetch") and not process.parent.name == "mkinitramfs") or
(process.name == "env" and process.args_count == 2 and process.args : "*sh") or
(process.parent.name in ("vi", "vim") and process.parent.args == "-c" and process.parent.args : ":!*sh") or
(process.parent.name in ("c89", "c99", "gcc") and process.parent.args : "*sh,-s" and process.parent.args == "-wrapper") or