Elastic medium stable eql

Payload Execution via Shell Pipe Detected by Defend for Containers

This rule detects when a payload is downloaded and piped to a shell inside a running container. This could indicate a threat actor downloaded a payload and executed it using a shell without the payload being stored on the filesystem.

View Source

Detection Logic

sequence by process.parent.entity_id, container.id with maxspan=1s
  [process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget")]
  [process where event.action in ("exec", "end") and
  /*
    If the flow is executed from a parent script, the event action will be "exec".
    If the flow is executed manually, the event action will be "end".
  */
   process.name like (
     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox",
     "python*", "perl*", "ruby*", "lua*", "php*"
   ) and
   process.args like (
     "-bash", "-dash", "-sh", "-tcsh", "-csh", "-zsh", "-ksh", "-fish",
     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
     "/bin/bash", "/bin/dash", "/bin/sh", "/bin/tcsh", "/bin/csh",
     "/bin/zsh", "/bin/ksh", "/bin/fish",
     "/usr/bin/bash", "/usr/bin/dash", "/usr/bin/sh", "/usr/bin/tcsh",
     "/usr/bin/csh", "/usr/bin/zsh", "/usr/bin/ksh", "/usr/bin/fish",
     "-busybox", "busybox", "/bin/busybox", "/usr/bin/busybox",
     "*python*", "*perl*", "*ruby*", "*lua*", "*php*", "/dev/fd/*"
   ) and
   not process.args in (
     "which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
     "man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
     "chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
     "chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
   )]

Field Validations

Loading…

Comments (0)

Loading comments...