Socat Process Activity

 1[metadata]
 2creation_date = "2020/02/18"
 3deprecation_date = "2021/04/15"
 4maturity = "deprecated"
 5updated_date = "2021/04/15"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell,
11or by serving a shell on a listening port. Socat is also sometimes used for lateral movement.
12"""
13false_positives = [
14    """
15    Socat is a dual-use tool that can be used for benign or malicious activity. Some normal use of this program, at
16    varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is
17    more likely to be suspicious.
18    """,
19]
20from = "now-9m"
21index = ["auditbeat-*", "logs-endpoint.events.*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "Socat Process Activity"
25references = ["https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/#method-2-using-socat"]
26risk_score = 47
27rule_id = "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126"
28severity = "medium"
29tags = ["Elastic", "Host", "Linux", "Threat Detection"]
30timestamp_override = "event.ingested"
31type = "query"
32
33query = '''
34event.category:process and event.type:(start or process_started) and process.name:socat and not process.args:-V
35'''