|
| 1 | +[metadata] |
| 2 | +creation_date = "2022/05/06" |
| 3 | +maturity = "production" |
| 4 | +updated_date = "2022/05/09" |
| 5 | + |
| 6 | +[rule] |
| 7 | +author = ["Elastic"] |
| 8 | +description = """ |
| 9 | +Identifies Linux binary(s) abuse to breakout out of restricted shells or environments by spawning an interactive system |
| 10 | +shell. The linux utility(s) activity of spawning shell is not a standard use of the binary for a user or system |
| 11 | +administrator. It may indicates an attempt to improve the capabilities or stability of an adversary access. |
| 12 | +""" |
| 13 | +from = "now-9m" |
| 14 | +index = ["logs-endpoint.events.*"] |
| 15 | +language = "eql" |
| 16 | +license = "Elastic License v2" |
| 17 | +name = "Linux Restricted Shell Breakout via Linux Binary(s)" |
| 18 | +references = [ |
| 19 | + "https://gtfobins.github.io/gtfobins/apt/", |
| 20 | + "https://gtfobins.github.io/gtfobins/apt-get/", |
| 21 | + "https://gtfobins.github.io/gtfobins/nawk/", |
| 22 | + "https://gtfobins.github.io/gtfobins/mawk/", |
| 23 | + "https://gtfobins.github.io/gtfobins/awk/", |
| 24 | + "https://gtfobins.github.io/gtfobins/gawk/", |
| 25 | + "https://gtfobins.github.io/gtfobins/busybox/", |
| 26 | + "https://gtfobins.github.io/gtfobins/c89/", |
| 27 | + "https://gtfobins.github.io/gtfobins/c99/", |
| 28 | + "https://gtfobins.github.io/gtfobins/cpulimit/", |
| 29 | + "https://gtfobins.github.io/gtfobins/crash/", |
| 30 | + "https://gtfobins.github.io/gtfobins/env/", |
| 31 | + "https://gtfobins.github.io/gtfobins/expect/", |
| 32 | + "https://gtfobins.github.io/gtfobins/find/", |
| 33 | + "https://gtfobins.github.io/gtfobins/flock/", |
| 34 | + "https://gtfobins.github.io/gtfobins/gcc/", |
| 35 | + "https://gtfobins.github.io/gtfobins/mysql/", |
| 36 | + "https://gtfobins.github.io/gtfobins/nice/", |
| 37 | + "https://gtfobins.github.io/gtfobins/ssh/", |
| 38 | + "https://gtfobins.github.io/gtfobins/vi/", |
| 39 | + "https://gtfobins.github.io/gtfobins/vim/", |
| 40 | + "https://gtfobins.github.io/gtfobins/capsh/", |
| 41 | + "https://gtfobins.github.io/gtfobins/byebug/", |
| 42 | +] |
| 43 | +risk_score = 47 |
| 44 | +rule_id = "52376a86-ee86-4967-97ae-1a05f55816f0" |
| 45 | +severity = "medium" |
| 46 | +tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution", "GTFOBins"] |
| 47 | +timestamp_override = "event.ingested" |
| 48 | +type = "eql" |
| 49 | + |
| 50 | +query = ''' |
| 51 | +process where event.type == "start" and |
| 52 | + |
| 53 | + /* launch shells from unusual process */ |
| 54 | + (process.name == "capsh" and process.args == "--") or |
| 55 | + |
| 56 | + /* launching shells from unusual parents or parent+arg combos */ |
| 57 | + (process.name in ("bash", "sh", "dash","ash") and |
| 58 | + (process.parent.name == "byebug") or |
| 59 | + |
| 60 | + /* shells specified in parent args */ |
| 61 | + /* nice rule is broken in 8.2 */ |
| 62 | + (process.parent.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash") and |
| 63 | + (process.parent.name == "nice") or |
| 64 | + (process.parent.name == "cpulimit" and process.parent.args == "-f") or |
| 65 | + (process.parent.name == "find" and process.parent.args == "-exec" and process.parent.args == ";") or |
| 66 | + (process.parent.name == "flock" and process.parent.args == "-u" and process.parent.args == "/") |
| 67 | + ) or |
| 68 | + |
| 69 | + /* shells specified in args */ |
| 70 | + (process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash") and |
| 71 | + (process.parent.name == "crash" and process.parent.args == "-h") or |
| 72 | + (process.name == "sensible-pager" and process.parent.name in ("apt", "apt-get") and process.parent.args == "changelog") |
| 73 | + /* scope to include more sensible-pager invoked shells with different parent process to reduce noise and remove false positives */ |
| 74 | + ) |
| 75 | + ) or |
| 76 | + (process.name == "busybox" and process.args_count == 2 and process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash") )or |
| 77 | + (process.name == "env" and process.args_count == 2 and process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "/bin/ash", "sh", "bash", "dash", "ash")) or |
| 78 | + (process.parent.name in ("vi", "vim") and process.parent.args == "-c" and process.parent.args in (":!/bin/bash", ":!/bin/sh", ":!bash", ":!sh")) or |
| 79 | + (process.parent.name in ("c89","c99", "gcc") and process.parent.args in ("sh,-s", "bash,-s", "dash,-s", "ash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s", "/bin/ash,-s") and process.parent.args == "-wrapper") or |
| 80 | + (process.parent.name == "expect" and process.parent.args == "-c" and process.parent.args in ("spawn /bin/sh;interact", "spawn /bin/bash;interact", "spawn /bin/dash;interact", "spawn sh;interact", "spawn bash;interact", "spawn dash;interact")) or |
| 81 | + (process.parent.name == "mysql" and process.parent.args == "-e" and process.parent.args in ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")) or |
| 82 | + (process.parent.name == "ssh" and process.parent.args == "-o" and process.parent.args in ("ProxyCommand=;sh 0<&2 1>&2", "ProxyCommand=;bash 0<&2 1>&2", "ProxyCommand=;dash 0<&2 1>&2", "ProxyCommand=;/bin/sh 0<&2 1>&2", "ProxyCommand=;/bin/bash 0<&2 1>&2", "ProxyCommand=;/bin/dash 0<&2 1>&2")) or |
| 83 | + (process.parent.name in ("nawk", "mawk", "awk", "gawk") and process.parent.args : "BEGIN {system(*)}") |
| 84 | +''' |
| 85 | + |
| 86 | + |
| 87 | +[[rule.threat]] |
| 88 | +framework = "MITRE ATT&CK" |
| 89 | +[[rule.threat.technique]] |
| 90 | +id = "T1059" |
| 91 | +name = "Command and Scripting Interpreter" |
| 92 | +reference = "https://attack.mitre.org/techniques/T1059/" |
| 93 | +[[rule.threat.technique.subtechnique]] |
| 94 | +id = "T1059.004" |
| 95 | +name = "Unix Shell" |
| 96 | +reference = "https://attack.mitre.org/techniques/T1059/004/" |
| 97 | + |
| 98 | + |
| 99 | + |
| 100 | +[rule.threat.tactic] |
| 101 | +id = "TA0002" |
| 102 | +name = "Execution" |
| 103 | +reference = "https://attack.mitre.org/tactics/TA0002/" |
0 commit comments