Elastic Defend high stable eql

Binary Execution from Unusual Location through Shell Profile

This rule identifies a process that executes a binary from an unusual location through a shell profile configuration. Threat actors can establish persistence by altering shell profile configurations to execute malicious commands or scripts upon user login. These modifications cause the shell launched during login to execute the malicious payload, resulting in a sequence where an authentication event is followed by the execution of a payload in a suspicious location.

View Source

Detection Logic

sequence with maxspan=3s
  [process where event.type == "change" and event.action == "uid_change" and (
     process.name in ("su", "sudo", "sshd", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") or
     process.name like ("python*", "php*", "perl*", "ruby*", "lua*")
   ) and not (
     process.executable like ("/srv/snp/docker/*", "/nix/store/*") or
       process.args in (
         "/usr/lib/ubuntu-advantage/apt_news.py", "/usr/lib/ubuntu-advantage/esm_cache.py", "apt-get", "apt",
         "systemctl"
      ) or
       process.command_line like "su cloudendure -c /usr/bin/nice*"
     )
  ] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and process.executable like (
     "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/srv/*", "/tmp/*",
     "/var/tmp/*", "/var/log/*"
   ) and process.args_count == 1 and
   not (
     process.executable like (
       "/run/*/newroot/*", "/srv/snp/docker/*", "/tmp/newroot/*", "/var/tmp/cpuid/cpuid", "/tmp/.mount_*/jetbrains-toolbox",
       "/var/tmp/buildah*/mnt/rootfs/bin/readlink", "/var/tmp/rackware/bin/rwdmi", "/srv/zorg-sync/venv/bin/python",
       "/tmp/makeself.*", "/tmp/selfgz*", "/tmp/tmp.*/rustup-init", "/tmp/go-build*"
     ) or
     process.parent.executable like (
       "/tmp/newroot/*", "/tmp/usr/bin/sudo", "/tmp/usr/sbin/sshd", "/tmp/go-build*", "/snap/btop/*/usr/local/bin/btop",
       "/opt/appimagelauncher.AppDir/usr/lib/*/appimagelauncher/binfmt-bypass", "/tmp/snap.rootfs_*"
     )
   )
  ] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...