Linux Restricted Shell Breakout via the mysql command

 1[metadata]
 2creation_date = "2022/03/09"
 3deprecation_date = "2022/05/09"
 4maturity = "deprecated"
 5updated_date = "2022/05/09"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies MySQL server abuse to break out from restricted environments by spawning an interactive system shell. The
11MySQL server is an open source relational database management system. The activity of spawning shell is not a standard
12use of this binary for a user or system administrator. It indicates a potentially malicious actor attempting to improve
13the capabilities or stability of their access.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Linux Restricted Shell Breakout via the mysql command"
20references = ["https://gtfobins.github.io/gtfobins/mysql/"]
21risk_score = 47
22rule_id = "83b2c6e5-e0b2-42d7-8542-8f3af86a1acb"
23severity = "medium"
24tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution", "GTFOBins"]
25timestamp_override = "event.ingested"
26type = "eql"
27
28query = '''
29process where event.type == "start" and process.name in ("bash", "sh", "dash") and
30  process.parent.name == "mysql" and process.parent.args == "-e" and
31  process.parent.args : ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")
32'''
33
34
35[[rule.threat]]
36framework = "MITRE ATT&CK"
37[[rule.threat.technique]]
38id = "T1059"
39name = "Command and Scripting Interpreter"
40reference = "https://attack.mitre.org/techniques/T1059/"
41[[rule.threat.technique.subtechnique]]
42id = "T1059.004"
43name = "Unix Shell"
44reference = "https://attack.mitre.org/techniques/T1059/004/"
45
46
47
48[rule.threat.tactic]
49id = "TA0002"
50name = "Execution"
51reference = "https://attack.mitre.org/tactics/TA0002/"