Jonhnathan
f02ffbbe13
* [Security Content] Add Investigation Guides - 8.5 * Update persistence_run_key_and_startup_broad.toml * Apply suggestions from security-docs review review * Update execution_suspicious_jar_child_process.toml * Apply suggestions from review
98 lines
4.1 KiB
TOML
98 lines
4.1 KiB
TOML
[metadata]
|
|
creation_date = "2021/01/19"
|
|
maturity = "production"
|
|
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
|
min_stack_version = "8.3.0"
|
|
updated_date = "2022/09/20"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
Identifies suspicious child processes of the Java interpreter process. This may indicate an attempt to execute a
|
|
malicious JAR file or an exploitation attempt via a JAVA specific vulnerability.
|
|
"""
|
|
from = "now-9m"
|
|
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
|
language = "eql"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious JAVA Child Process"
|
|
note = """## Triage and analysis
|
|
|
|
### Investigating Suspicious Java Child Process
|
|
|
|
This rule identifies a suspicious child process of the Java interpreter process. It may indicate an attempt to execute
|
|
a malicious JAR file or an exploitation attempt via a Java specific vulnerability.
|
|
|
|
#### Possible investigation steps
|
|
|
|
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
|
|
for prevalence and whether they are located in expected locations.
|
|
- Investigate other alerts associated with the user/host during the past 48 hours.
|
|
- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
|
|
connections.
|
|
- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any
|
|
spawned child processes.
|
|
- Examine the command line to determine if the command executed is potentially harmful or malicious.
|
|
- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
|
|
|
|
### False positive analysis
|
|
|
|
- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination
|
|
of process and command line conditions.
|
|
|
|
### Response and remediation
|
|
|
|
- Initiate the incident response process based on the outcome of the triage.
|
|
- Isolate the involved hosts to prevent further post-compromise behavior.
|
|
- Remove and block malicious artifacts identified during triage.
|
|
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
|
|
identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
|
|
systems, and web services.
|
|
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
|
|
malware components.
|
|
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
|
|
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
|
|
mean time to respond (MTTR).
|
|
|
|
## Setup
|
|
|
|
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
|
|
"""
|
|
references = [
|
|
"https://www.lunasec.io/docs/blog/log4j-zero-day/",
|
|
"https://github.com/christophetd/log4shell-vulnerable-app",
|
|
"https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf",
|
|
]
|
|
risk_score = 47
|
|
rule_id = "8acb7614-1d92-4359-bfcf-478b6d9de150"
|
|
severity = "medium"
|
|
tags = ["Elastic", "Host", "Linux", "macOS", "Threat Detection", "Execution"]
|
|
timestamp_override = "event.ingested"
|
|
type = "eql"
|
|
|
|
query = '''
|
|
process where event.type in ("start", "process_started") and
|
|
process.parent.name : "java" and
|
|
process.name : ("sh", "bash", "dash", "ksh", "tcsh", "zsh", "curl", "wget")
|
|
'''
|
|
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[rule.threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1059.007"
|
|
name = "JavaScript"
|
|
reference = "https://attack.mitre.org/techniques/T1059/007/"
|
|
|
|
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|