Elastic medium stable eql

Suspicious Reading of procfs Syscall File

This rule detects command lines that reference another process or thread's procfs syscall file. The "/proc/<pid>/syscall" interface exposes the current syscall arguments, stack pointer, and instruction pointer, which can support process discovery and preparation for process injection. Self and thread-self aliases are excluded.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
(
  process.name in (
    "cat", "less", "more", "head", "tail", "nano", "vi", "vim", "strings", "nvim", "vim.basic",
    "vim.tiny", "od", "hexdump", "xxd", "hx", "hexedit", "pager", "tr"
  ) or
  (
    process.name in (
      "find", "awk", "gawk", "mawk", "nawk", "grep", "fgrep", "rgrep", "xargs", "sed", "tee"
    ) and
    process.args_count <= 20
  )
) and
process.command_line like "*/proc/*/syscall*" and
not (
  process.command_line like ("*/proc/self/syscall*", "*/proc/thread-self/syscall*") or
  process.args like "/proc/*/syscall/comm"
)

Field Validations

Loading…

Comments (0)

Loading comments...