Elastic medium stable eql

Linux User Account Credential Modification

This rule detects Linux user account credential modification events where the echo command is used to directly echo a password into the passwd or shadow utilities. This technique is used by malware to automate the process of user account credential modification on Linux systems post-infection.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.command_line like (
  "*echo*> /etc/passwd*", "*echo*>/etc/passwd*",
  "*echo*> /etc/shadow*", "*echo*>/etc/shadow*"
) and
not (
  process.parent.command_line == "runc init" or
  process.parent.executable in ("/usr/bin/make", "/bin/make")
)

Field Validations

Loading…

Comments (0)

Loading comments...