Elastic Defend high stable eql

Linux Reverse Shell via Child

Detects the creation of a reverse shell through a shell with suspicious command line arguments. Attackers may spawn reverse shells to establish persistence onto a target system.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5s
  [network where event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and 
   process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and destination.ip != null and 
   not cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "::1")]
  [process where event.type == "start" and event.action == "exec" and 
   process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and (
     process.args in ("-i", "-il", "-li") or
     (process.parent.name == "socat" and process.parent.command_line like~ "*exec*")
   )
  ]

Field Validations

Loading…

Comments (0)

Loading comments...