[metadata]
creation_date = "2023/06/14"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "The single field New Term rule type used in this rule was added in Elastic 8.4"
min_stack_version = "8.4.0"
updated_date = "2023/08/24"

[rule]
author = ["Elastic"]
description = """
This rule monitors for the execution of several commonly used system commands executed by a previously unknown
executable located in commonly abused directories. An alert from this rule can indicate the presence of potentially 
malicious activity, such as the execution of unauthorized or suspicious processes attempting to run malicious code. 
Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the 
system and its data from potential compromise.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "endgame-*"]
language = "kuery"
license = "Elastic License v2"
name = "Suspicious System Commands Executed by Previously Unknown Executable"
risk_score = 21
rule_id = "e9001ee6-2d00-4d2f-849e-b8b1fb05234c"
severity = "low"
tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame"]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
host.os.type:linux and event.category:process and event.action:(exec or exec_event or fork or fork_event) and 
process.executable:(
  /bin/* or /usr/bin/* or /usr/share/* or /tmp/* or /var/tmp/* or /dev/shm/* or
  /etc/init.d/* or /etc/rc*.d/* or /etc/crontab or /etc/cron.*/* or /etc/update-motd.d/* or 
  /usr/lib/update-notifier/* or /home/*/.* or /boot/* or /srv/* or /run/*) 
  and process.args:(whoami or id or hostname or uptime or top or ifconfig or netstat or route or ps or pwd or ls) and 
  not process.name:(sudo or which or whoami or id or hostname or uptime or top or netstat or ps or pwd or ls or apt or 
  dpkg or yum or rpm or dnf or dockerd or docker or snapd or snap) and
  not process.parent.executable:(/bin/* or /usr/bin/* or /run/k3s/* or /etc/network/* or /opt/Elastic/*)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
  
[rule.threat.tactic]
name = "Execution"
id = "TA0002"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat.technique]]
name = "Command and Scripting Interpreter"
id = "T1059"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
name = "Unix Shell"
id = "T1059.004"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.new_terms]
field = "new_terms_fields"
value = ["process.executable"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-14d"