From 7fc5ba164622d4850476cf217cbcbf5420ae54c2 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Wed, 10 Feb 2021 10:28:22 +0100 Subject: [PATCH] [New Rule] Persistence via Cron Tasks (#867) * [New Rule] Persistence via Cron Tasks * Update persistence_cron_jobs_creation_and_runtime.toml * Update persistence_cron_jobs_creation_and_runtime.toml * excluded noisy procs and root user * moved to cross-platform * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * excluding root user * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * relinted * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml Co-authored-by: Justin Ibarra Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Justin Ibarra --- ...stence_cron_jobs_creation_and_runtime.toml | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml diff --git a/rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml b/rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml new file mode 100644 index 000000000..f6a75a146 --- /dev/null +++ b/rules/cross-platform/persistence_cron_jobs_creation_and_runtime.toml @@ -0,0 +1,55 @@ +[metadata] +creation_date = "2021/01/15" +maturity = "production" +updated_date = "2021/01/15" + +[rule] +author = ["Elastic"] +description = """ +Identifies the creation or execution of a cron job. Adversaries may abuse cron jobs to perform task scheduling for +initial or recurring execution of malicious code. +""" +false_positives = ["Legitimate software or scripts using cron jobs for recurring tasks."] +from = "now-9m" +index = ["auditbeat-*", "logs-endpoint.events.*"] +language = "kuery" +license = "Elastic License" +name = "Potential Persistence via Cron Job" +references = ["https://archive.f-secure.com/weblog/archives/00002576.html", "https://ss64.com/osx/crontab.html"] +risk_score = 21 +rule_id = "b1c14366-f4f8-49a0-bcbb-51d2de8b0bb8" +severity = "low" +tags = ["Elastic", "Host", "Linux", "macOS", "Threat Detection", "Persistence"] +type = "query" + +query = ''' +event.category:process and event.type:(start or process_started or info) and + not user.name:root and + ((process.name:crontab and not process.args:("-l" or "-r" or "-e" or "-help" or "-h")) or + (process.parent.name:cron and not process.name:"running job" and + not process.executable:(/Applications/Docker.app/Contents/Resources/bin/docker or + /usr/bin/killall or + /usr/sbin/sendmail or + /usr/bin/env or + /usr/bin/timeshift or + /bin/rm))) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1053" +name = "Scheduled Task/Job" +reference = "https://attack.mitre.org/techniques/T1053/" +[[rule.threat.technique.subtechnique]] +id = "T1053.003" +name = "Cron" +reference = "https://attack.mitre.org/techniques/T1053/003/" + + + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/"