Elastic high stable eql

Suspicious /proc/maps Discovery

Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name in ("cat", "grep", "tail", "less", "more", "egrep", "fgrep", "awk") and process.args like "/proc/*/maps" and
not (
  ?process.parent.args in ("/usr/bin/finalrd", "/sbin/chkrootkit", "./uac", "/usr/sbin/chkrootkit") or
  ?process.parent.executable in ("/usr/sbin/chkrootkit", "/sbin/chkrootkit") or
  ?process.parent.name == "uac" or
  ?process.parent.executable in ("/opt/secl/linux-ir-scripts-v3/thieves.sh", "/opt/traps/rpm-installer/setup.sh") or
  ?process.working_directory like ("/opt/traps/deb-installer", "/opt/Tanium/TaniumClient/*") or
  ?process.parent.executable like ("/home/*/sunlight/thieves.sh") or
  (?process.parent.executable == "/usr/lib/systemd/systemd" and ?process.parent.command_line == "/sbin/init") or
  ?process.group_leader.executable in ("/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent", "/opt/traps/bin/cytool")
)

Field Validations

Loading…

Comments (0)

Loading comments...