Elastic Defend high stable eql

Linux Hidden Folder or File Execution via Python

Detects possible Python-based malware that stages their files in a hidden directory or file. This rule looks for Python executions where the process arguments include references to hidden folders or files in the suspicious directories.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and
process.executable like~ ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.args : "python*" and process.args : ("/tmp/.*", "/var/tmp/.*", "/dev/shm/.*") and
not (
  process.parent.name in ("browser_tests", "unit_tests", "arduino-cli", "node", "python.original") or
  process.args like (
    "/tmp/.build/*", "/tmp/.sentrycli*", "/var/tmp/.mount_GIMP*", "/tmp/.mount_GIMP*", "/tmp/*/ansible-tmp-*/AnsiballZ*.py",
    "/tmp/selfgz*.py", "/home/*/git/roche/product-packages/common/hearst/test-submit-enclave-measurements.py",
    "/tmp/.ctx-mode-*", "/tmp/.tmp*/drivers/fake.*/run.py"
  ) or
  process.args in (
    "/opt/sev-snp-measure/measure.py", "/tmp/.__preview_vite_base_fixer.py", "/tmp/.soc_models_helper.py",
    "/opt/fortanix/enclave-os/blobs/kernel_enabled_gpu/bzImage"
  ) or
  process.parent.args like "/home/*/git/roche/product-packages/common/hearst/test-submit-enclave-measurements.py" or
  (
    process.parent.executable like "/home/*/node_modules/@openai/codex/bin/codex-x86_64-unknown-linux-musl" and
    process.command_line like "python3 /tmp/.tmp*"
  ) or
  (process.args in ("/usr/bin/ukify", "/bin/ukify") and process.args == "build") or 
  (process.args == "--include-private-keys" and process.parent.args like "/home/*/.ansible/tmp/ansible-tmp-*/ir_scan.sh") or
  (process.parent.executable == "./runc" and process.parent.command_line == "runc init") or
  (process.parent.executable like "/home/gitlab-runner/builds/*/bach" and process.args like "/tmp/.tmp*/*/run.py")
)

Field Validations

Loading…

Comments (0)

Loading comments...