[New Rule] Persistence via Cron Tasks (#867)

* [New Rule] Persistence via Cron Tasks * Update persistence_cron_jobs_creation_and_runtime.toml * Update persistence_cron_jobs_creation_and_runtime.toml * excluded noisy procs and root user * moved to cross-platform * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * excluding root user * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * relinted * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
2021-02-10 10:28:22 +01:00
parent 51498f6022
commit 7fc5ba1646
1 changed files with 55 additions and 0 deletions
@@ -0,0 +1,55 @@
+[metadata]
+creation_date = "2021/01/15"
+maturity = "production"
+updated_date = "2021/01/15"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies the creation or execution of a cron job. Adversaries may abuse cron jobs to perform task scheduling for
+initial or recurring execution of malicious code.
+"""
+false_positives = ["Legitimate software or scripts using cron jobs for recurring tasks."]
+from = "now-9m"
+index = ["auditbeat-*", "logs-endpoint.events.*"]
+language = "kuery"
+license = "Elastic License"
+name = "Potential Persistence via Cron Job"
+references = ["https://archive.f-secure.com/weblog/archives/00002576.html", "https://ss64.com/osx/crontab.html"]
+risk_score = 21
+rule_id = "b1c14366-f4f8-49a0-bcbb-51d2de8b0bb8"
+severity = "low"
+tags = ["Elastic", "Host", "Linux", "macOS", "Threat Detection", "Persistence"]
+type = "query"
+
+query = '''
+event.category:process and event.type:(start or process_started or info) and
+  not user.name:root and
+  ((process.name:crontab and not process.args:("-l" or "-r" or "-e" or "-help" or "-h")) or
+    (process.parent.name:cron and not process.name:"running job" and
+       not process.executable:(/Applications/Docker.app/Contents/Resources/bin/docker or
+                               /usr/bin/killall or
+                               /usr/sbin/sendmail or
+                               /usr/bin/env or
+                               /usr/bin/timeshift or
+                               /bin/rm)))
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1053"
+name = "Scheduled Task/Job"
+reference = "https://attack.mitre.org/techniques/T1053/"
+[[rule.threat.technique.subtechnique]]
+id = "T1053.003"
+name = "Cron"
+reference = "https://attack.mitre.org/techniques/T1053/003/"
+
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"