Elastic Defend high stable eql

Egress Network Connection from RPM Package

This rule monitors for egress network connections from processes that are executed from an RPM package parent. Attackers can backdoor an RPM package to establish initial access, or install a malicious RPM package to maintain persistence.

View Source

Detection Logic

sequence with maxspan=3s
  [process where event.type == "start" and event.action == "exec" and
   process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.parent.args : "/var/tmp/rpm-tmp.*" and not (
     (process.name == "curl" and process.command_line like ("*.microsoft.com/api/report*", "*check.percona.com*")) or
     process.executable in ("/sbin/runuser", "/usr/sbin/runuser") or
     process.working_directory like~ (
       "/builds/packages/naudit-repos", "/disco_flowlytics/docker/overlay2/*", "/builddir/build/BUILD/librdkafka-*/mklove/deps/src/libzstd"
     ) or
     process.args : ("/usr/local/cpanel/3rdparty/wp-toolkit/*", "/usr/bin/rpmkeys") or
     (process.executable == "/bin/sudo" and process.args in (
       "https://global.endpoint.security.micro",
       "https://global.endpoint.security.micros"
       )
     ) or
     (process.name == "curl" and process.args == "sudo" and process.args == "mdatp" and process.args == "--cacert") or
     process.command_line like "runuser -u mdatp*" or
     process.name == "sudo"
   )
  ] by process.entity_id
  [network where event.type == "start" and event.action == "connection_attempted" and not (
     destination.ip == null or
     destination.ip == "0.0.0.0" or
     cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8", "172.31.0.0/16"
       ) or
      process.executable in (
      "/opt/cisco/amp/bin/ampinsthelper", "/usr/libexec/platform-python", "/sbin/update-pciids",
      "/etc/nginx/ea-nginx/config-scripts/global/config-scripts-global-cloudflare",
      "/opt/kerio/GFIAgent/GFIAgentInstaller", "/usr/share/centrifydc/libexec/adinfo",
      "/opt/teleport/system/bin/tsh"
      ) or
      process.executable like "/usr/local/cpanel/3rdparty/perl/*/bin/perl"
    )
  ] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...