[metadata]
creation_date = "2023/04/26"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/04/26"

[rule]
author = ["Elastic"]
description = """
Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz.
Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits
a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by
dumping the process and extracting lines that have a high probability of containing cleartext passwords.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Linux Credential Dumping via Proc Filesystem"
references = [
    "https://github.com/huntergregal/mimipenguin",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781"
]
risk_score = 47
rule_id = "ef100a2e-ecd4-4f72-9d1e-2f779ff3c311"
severity = "medium"
tags = ["Elastic", "Host", "Linux", "Threat Detection", "Credential Access"]
type = "eql"
query = '''
sequence by process.parent.name,host.name with maxspan=1m
[process where host.os.type == "linux" and process.name == "ps" and event.action == "exec"
 and process.args in ("-eo", "pid", "command") ]

[process where host.os.type == "linux" and process.name == "strings" and event.action == "exec"
 and process.args : "/tmp/*" ]
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[rule.threat.technique.subtechnique]]
id = "T1003.007"
name = "Proc Filesystem"
reference = "https://attack.mitre.org/techniques/T1003/007/"

[[rule.threat.technique]]
id = "T1212"
name = "Exploitation for Credential Access"
reference = "https://attack.mitre.org/techniques/T1212/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"