Linux Shell Evasion Rule Tuning (#1878)

* Linux Shell Evasion Rule Tuning

* Update execution_python_tty_shell.toml

* Update rules/linux/execution_apt_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_apt_binary.toml

* Update rules/linux/execution_awk_binary_shell.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_awk_binary_shell.toml

* Update rules/linux/execution_c89_c99_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_c89_c99_binary.toml

* Update rules/linux/execution_cpulimit_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_cpulimit_binary.toml

* Update rules/linux/execution_expect_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_expect_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_expect_binary.toml

* Update rules/linux/execution_find_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_find_binary.toml

* Update rules/linux/execution_gcc_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_gcc_binary.toml

* Update rules/linux/execution_mysql_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_mysql_binary.toml

* Update rules/linux/execution_nice_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_nice_binary.toml

* Update rules/linux/execution_ssh_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_ssh_binary.toml

* Update execution_perl_tty_shell.toml

* Update execution_python_tty_shell.toml

* Update rules/linux/execution_apt_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_awk_binary_shell.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_c89_c99_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_cpulimit_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_expect_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_find_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_gcc_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_mysql_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_nice_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_ssh_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

rules/linux/execution_apt_binary.toml

@@ -26,10 +26,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m 
-  [process where process.name : ("apt", "apt-get") and process.args : "changelog"] 
-  [process where process.name : "sensible-pager" and process.args : ("/bin/sh", "/bin/bash") and 
-   process.parent.name : ("apt", "apt-get")]
+process where event.type == "start" and process.name == "sensible-pager" and 
+  process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "sh", "bash", "dash") and 
+  process.parent.name in ("apt", "apt-get") and process.parent.args == "changelog"
 '''
 
 

rules/linux/execution_awk_binary_shell.toml

@@ -25,9 +25,8 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m 
-  [process where process.name : ("nawk", "mawk", "awk", "gawk") and process.args : "BEGIN {system(*)}"] 
-  [process where process.parent.name : ("nawk", "mawk", "awk", "gawk") and process.name : ("sh", "bash")]
+process where event.type == "start" and process.name in ("sh", "bash", "dash") and 
+  process.parent.name in ("nawk", "mawk", "awk", "gawk") and process.parent.args : "BEGIN {system(*)}"
 '''
 
 

rules/linux/execution_busybox_binary.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2022/03/15"
 maturity = "production"
-updated_date = "2022/03/15"
+updated_date = "2022/03/24"
 
 [rule]
 author = ["Elastic"]
@@ -25,7 +25,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where event.type == "start" and process.name : "busybox" and process.args_count == 2 and process.args : ("/bin/sh", "/bin/ash", "sh", "ash")
+process where event.type == "start" and process.name == "busybox" and process.args_count == 2 and process.args in ("/bin/sh", "/bin/ash", "sh", "ash")
 '''
 
 

rules/linux/execution_c89_c99_binary.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2022/03/15"
 maturity = "production"
-updated_date = "2022/03/15"
+updated_date = "2022/03/24"
 
 [rule]
 author = ["Elastic"]
@@ -25,9 +25,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m
-[process where process.name :("c89","c99") and process.args == "-wrapper" and process.args : ("sh,-s", "bash,-s", "dash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s")]
-[process where process.parent.name : ("bash", "sh", "dash")]
+process where event.type == "start" and process.name in ("sh", "dash", "bash") and 
+  process.parent.name in ("c89","c99") and process.parent.args == "-wrapper" and 
+  process.parent.args in ("sh,-s", "bash,-s", "dash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s") 
 '''
 
 

rules/linux/execution_cpulimit_binary.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2022/03/17"
 maturity = "production"
-updated_date = "2022/03/17"
+updated_date = "2022/03/24"
 
 [rule]
 author = ["Elastic"]
@@ -26,9 +26,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m
-[process where event.type == "start" and process.name == "cpulimit" and process.args == "-f" and process.args : ("/bin/sh", "/bin/bash", "/bin/dash", "sh", "bash", "dash")]
-[process where process.parent.name == "cpulimit" and process.name : ("bash", "sh", "dash")]
+process where event.type == "start" and process.name in ("bash", "sh", "dash") and 
+  process.parent.name == "cpulimit" and process.parent.args == "-f" and 
+  process.parent.args in ("/bin/sh", "/bin/bash", "/bin/dash", "sh", "bash", "dash") 
 '''
 
 

rules/linux/execution_crash_binary.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2022/03/21"
 maturity = "production"
-updated_date = "2022/03/21"
+updated_date = "2022/03/24"
 
 [rule]
 author = ["Elastic"]
@@ -25,9 +25,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m
-[process where event.type == "start" and process.name == "crash" and process.args : "-h"]
-[process where process.parent.name == "crash" and process.name : "sh"]
+process where event.type == "start" and process.parent.name == "crash" and process.parent.args == "-h" and process.name == "sh"
 '''
 
 

rules/linux/execution_expect_binary.toml

@@ -1,6 +1,6 @@
 [metadata]
 creation_date = "2022/03/07"
-maturity = "development"
+maturity = "production"
 updated_date = "2022/03/28"
 
 [rule]
@@ -25,9 +25,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m 
-[process where process.name == "expect" and process.args : "-c" and process.args : ("spawn /bin/sh;interact", "spawn /bin/bash;interact", "spawn /bin/dash;interact", "spawn sh;interact","spawn bash;interact", "spawn dash;interact")] 
-[process where process.parent.name == "expect" and process.name : ("bash", "sh", "dash")]
+process where event.type == "start" and process.name in ("bash", "sh", "dash") and 
+  process.parent.name == "expect" and process.parent.args == "-c" and 
+  process.parent.args in ("spawn /bin/sh;interact", "spawn /bin/bash;interact", "spawn /bin/dash;interact", "spawn sh;interact", "spawn bash;interact", "spawn dash;interact") 
 '''
 
 

rules/linux/execution_find_binary.toml

@@ -25,9 +25,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m
-[process where process.name == "find" and process.args : "-exec" and process.args : ("/bin/bash", "/bin/sh", "bash", "sh") and process.args : ";"]
-[process where process.parent.name == "find" and process.name : ("bash", "sh")]
+process where event.type == "start" and process.name in ("bash", "sh") and 
+  process.parent.name == "find" and process.parent.args == "-exec" and 
+  process.parent.args == ";" and process.parent.args in ("/bin/bash", "/bin/sh", "bash", "sh")
 '''
 
 

rules/linux/execution_gcc_binary.toml

@@ -25,9 +25,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m
-[process where process.name == "gcc" and process.args == "-wrapper" and process.args : ("sh,-s", "bash,-s", "dash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s")]
-[process where process.parent.name == "gcc" and process.name : ("bash", "sh", "dash")]
+process where event.type == "start" and process.name in ("sh", "dash", "bash")  and 
+  process.parent.name == "gcc" and process.parent.args == "-wrapper" and 
+  process.parent.args in ("sh,-s", "bash,-s", "dash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s")
 '''
 
 

rules/linux/execution_mysql_binary.toml

@@ -25,9 +25,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m
-[process where process.name == "mysql" and process.args == "-e" and process.args : ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")]
-[process where process.parent.name == "mysql" and process.name : ("bash", "sh", "dash")]
+process where event.type == "start" and process.name in ("bash", "sh", "dash") and 
+  process.parent.name == "mysql" and process.parent.args == "-e" and 
+  process.parent.args : ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash") 
 '''
 
 

rules/linux/execution_nice_binary.toml

@@ -26,9 +26,8 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m
-[process where event.type == "start" and process.name == "nice" and process.args : ("/bin/bash", "/bin/sh", "/bin/dash", "sh", "bash", "dash")]
-[process where process.name : ("bash", "sh", "dash")]
+process where event.type == "start" and process.name in ("bash", "sh", "dash") and 
+  process.parent.name == "nice" and process.parent.args in ("/bin/bash", "/bin/sh", "/bin/dash", "sh", "bash", "dash")
 '''
 
 

rules/linux/execution_perl_tty_shell.toml

@@ -39,4 +39,3 @@ reference = "https://attack.mitre.org/techniques/T1059/"
 id = "TA0002"
 name = "Execution"
 reference = "https://attack.mitre.org/tactics/TA0002/"
-

rules/linux/execution_python_tty_shell.toml

@@ -41,4 +41,3 @@ reference = "https://attack.mitre.org/techniques/T1059/"
 id = "TA0002"
 name = "Execution"
 reference = "https://attack.mitre.org/tactics/TA0002/"
-

rules/linux/execution_ssh_binary.toml

@@ -25,9 +25,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by host.id, process.pid with maxspan=1m
-[process where process.name == "ssh" and process.args == "-o" and process.args : ("ProxyCommand=;sh*", "ProxyCommand=;bash*", "ProxyCommand=;dash*", "ProxyCommand=;/bin/sh*", "ProxyCommand=;/bin/bash*", "ProxyCommand=;/bin/dash*")]
-[process where process.parent.name == "ssh" and process.name : ("bash", "sh", "dash")]
+process where event.type == "start" and process.name : ("bash", "sh", "dash") and 
+  process.parent.name == "ssh" and process.parent.args == "-o" and 
+  process.parent.args in ("ProxyCommand=;sh 0<&2 1>&2", "ProxyCommand=;bash 0<&2 1>&2", "ProxyCommand=;dash 0<&2 1>&2", "ProxyCommand=;/bin/sh 0<&2 1>&2", "ProxyCommand=;/bin/bash 0<&2 1>&2", "ProxyCommand=;/bin/dash 0<&2 1>&2")
 '''
 
 

rules/linux/execution_vi_binary.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2022/03/03"
 maturity = "production"
-updated_date = "2022/03/22"
+updated_date = "2022/03/24"
 
 [rule]
 author = ["Elastic"]