Elastic Defend high stable eql

Shared Memory File Turned Executable by Suspicious Parent

Detects when a file located in the shared memory directory is made executable using chmod via an abnormal or suspicious parent process. Malware will often drop a second stage payload or file and will need to make it executable before invoking it.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "chmod" and
process.args in ("4755", "755", "777", "0777", "+x", "a+x") and
process.args like "/dev/shm/*" and process.parent.executable != null and
not (
  (
    process.parent.executable == "/etc/init.d/nagios" and
    process.args in ("/dev/shm/tmp", "/dev/shm/var", "/dev/shm/checkresults")
  ) or
  process.parent.executable == "./install-attachment-registration-manager.sh" or
  process.parent.command_line == "runc init" or
  (
    process.working_directory like "/tmp/selfgz*" and
    process.parent.args ==  "./install-attachment-registration-manager.sh" and
    process.command_line == "chmod 777 /dev/shm/check-point"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...