From e241df5d76a5305d4691f95e04b6567c98dbbc18 Mon Sep 17 00:00:00 2001
From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Date: Tue, 12 Jul 2022 22:33:38 -0400
Subject: [PATCH] [Rule Tuning] Potential Reverse Shell Activity via Terminal
 (#2077)

* adjusted query rule to exclude noisy FPs

* adjusted event.action to be event.type

(cherry picked from commit 7581234fe86478f88b57c763d3b353624298a207)
---
 .../execution_revershell_via_shell_cmd.toml              | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/rules/cross-platform/execution_revershell_via_shell_cmd.toml b/rules/cross-platform/execution_revershell_via_shell_cmd.toml
index 5636e7bf3..fa83afeec 100644
--- a/rules/cross-platform/execution_revershell_via_shell_cmd.toml
+++ b/rules/cross-platform/execution_revershell_via_shell_cmd.toml
@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/01/07"
 maturity = "production"
-updated_date = "2022/03/31"
+updated_date = "2022/07/06"
 
 [rule]
 author = ["Elastic"]
@@ -30,7 +30,12 @@ type = "eql"
 query = '''
 process where event.type in ("start", "process_started") and
   process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
-  process.args:("*/dev/tcp/*", "*/dev/udp/*", "zsh/net/tcp", "zsh/net/udp")
+  process.args : ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and
+
+  /* noisy FPs */
+  not (process.parent.name : "timeout" and process.executable : "/var/lib/docker/overlay*") and
+  not process.command_line : ("*/dev/tcp/sirh_db/*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*", "*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*", "*/dev/tcp/127.*", "*/dev/udp/127.*", "*/dev/tcp/localhost/*") and
+  not process.parent.command_line : "runc init"
 '''