Elastic Defend high stable eql

Chattr Execution from Unusual Parent

This rule detects the execution of the "chattr" command from an unusual parent process. The "chattr" command is used to change file attributes, and is often used by attackers to hide files or directories or mark them as immutable and/or undeletable.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "chattr" and 
process.executable like ("/bin/chattr", "/usr/bin/chattr", "/usr/local/bin/chattr") and
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*") or process.parent.name like ".*") and
process.args like~ ("-*i*", "+*i*", "+*u*", "-*u*") and not (
  process.parent.name == "." or
  process.parent.executable like (
    "./scannerYaraALFA*", "/tmp/newroot/lib/systemd/systemd", "./ldap2sshkeys", "/tmp/newroot/var/lib/docker/rootfs/overlayfs/*/entrypoint.sh",
    "/tmp/newroot/opt/omnissa/*/bin/ws1HubUtil"
  ) or
  process.parent.executable in ("/tmp/newroot/usr/bin/sudo", "/tmp/newroot/usr/bin/zsh") or
  process.parent.args like "/root/.ansible/tmp/ansible-tmp-*/AnsiballZ_file.py"
)

Field Validations

Loading…

Comments (0)

Loading comments...