Potential Reverse Shell Activity via Terminal

  1[metadata]
  2creation_date = "2020/01/07"
  3integration = ["endpoint"]
  4maturity = "production"
  5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
  6min_stack_version = "8.3.0"
  7updated_date = "2023/10/19"
  8
  9[rule]
 10author = ["Elastic"]
 11description = "Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity."
 12from = "now-9m"
 13index = ["auditbeat-*", "logs-endpoint.events.*"]
 14language = "eql"
 15license = "Elastic License v2"
 16name = "Potential Reverse Shell Activity via Terminal"
 17note = """## Triage and analysis
 18
 19### Investigating Potential Reverse Shell Activity via Terminal
 20
 21A reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are vulnerable since the connection is outgoing. This activity is typically the result of vulnerability exploitation, malware infection, or penetration testing.
 22
 23This rule identifies commands that are potentially related to reverse shell activities using shell applications.
 24
 25#### Possible investigation steps
 26
 27- Examine the command line and extract the target domain or IP address information.
 28  - Check if the domain is newly registered or unexpected.
 29  - Check the reputation of the domain or IP address.
 30  - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the domain or IP address.
 31- Investigate other alerts associated with the user/host during the past 48 hours.
 32- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 33- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 34
 35### False positive analysis
 36
 37- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 38
 39### Response and remediation
 40
 41- Initiate the incident response process based on the outcome of the triage.
 42- Isolate the involved host to prevent further post-compromise behavior.
 43- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 44- Take actions to terminate processes and connections used by the attacker.
 45- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 46- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 47- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 48"""
 49references = [
 50    "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md",
 51    "https://github.com/WangYihang/Reverse-Shell-Manager",
 52    "https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
 53]
 54risk_score = 73
 55rule_id = "a1a0375f-22c2-48c0-81a4-7c2d11cc6856"
 56setup = """## Setup
 57
 58If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
 59events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
 60Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
 61`event.ingested` to @timestamp.
 62For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
 63"""
 64severity = "high"
 65tags = ["Domain: Endpoint",
 66        "OS: Linux",
 67        "OS: macOS",
 68        "Use Case: Threat Detection",
 69        "Tactic: Execution",
 70        "Resources: Investigation Guide",
 71        "Data Source: Elastic Defend"
 72        ]
 73timestamp_override = "event.ingested"
 74type = "eql"
 75
 76query = '''
 77process where event.type in ("start", "process_started") and
 78  process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
 79  process.args : ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and
 80
 81  /* noisy FPs */
 82  not (process.parent.name : "timeout" and process.executable : "/var/lib/docker/overlay*") and
 83  not process.command_line : (
 84    "*/dev/tcp/sirh_db/*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*", "*dev/tcp/kafka/*",
 85    "*/dev/tcp/$0/$1*", "*/dev/tcp/127.*", "*/dev/udp/127.*", "*/dev/tcp/localhost/*", "*/dev/tcp/itom-vault/*") and
 86  not process.parent.command_line : "runc init"
 87'''
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91
 92[[rule.threat.technique]]
 93id = "T1059"
 94name = "Command and Scripting Interpreter"
 95reference = "https://attack.mitre.org/techniques/T1059/"
 96
 97[rule.threat.tactic]
 98id = "TA0002"
 99name = "Execution"
100reference = "https://attack.mitre.org/tactics/TA0002/"