security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Tuning & New Rule] Linux Reverse Shell & DR Tuning (#3254)

Browse Source 
* [Rule Tuning & New Rule] Linux Reverse Shell

* [Tuning & New Rule] Linux Reverse Shells

* Name change

* Update rules/linux/execution_shell_via_child_tcp_utility_linux.toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* Update execution_shell_via_child_tcp_utility_linux.toml

* Update execution_shell_via_background_process.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
This commit is contained in:
Ruben Groenewoud
2023-12-18 09:36:21 +01:00
committed by GitHub
parent a6c5cfc418
commit 84824c67fd
9 changed files with 185 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_shell_via_java_revshell_linux.toml
+15 -4
View File
@@ -49,7 +49,13 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
"""
severity = "medium"
tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"]
tags = [
"Domain: Endpoint",
"OS: Linux",
"Use Case: Threat Detection",
"Tactic: Execution",
"Data Source: Elastic Defend"
]
type = "eql"
query = '''
sequence by host.id with maxspan=5s
@@ -57,9 +63,14 @@ sequence by host.id with maxspan=5s
process.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and
destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1"
] by process.entity_id
[process where host.os.type == "linux" and event.action == "exec" and
process.parent.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and
process.parent.args : "-jar" and process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
[process where host.os.type == "linux" and event.action == "exec" and process.parent.executable : (
"/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*"
) and process.parent.args : "-jar" and process.name in (
"bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish"
) and not process.args : (
"-xe", "/tmp/jenkins*.sh", "*/var/lib/jenkins/workspace/*", "vmstat*", "asterisk*", "mpstat*", "/usr/bin/ps*", "umask", "*yum*", "uptime -s",
"df -h . | awk '{print $2}'", "free | awk \"/Mem:/\" | awk '{print $2}'"
)
] by process.parent.entity_id
'''