Suspicious Interactive Shell Spawned From Inside A Container

 1[metadata]
 2creation_date = "2023/04/26"
 3integration = ["cloud_defend"]
 4maturity = "production"
 5min_stack_comments = "New Integration: Cloud Defend"
 6min_stack_version = "8.8.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = "This rule detects when an interactive shell is spawned inside a running container. This could indicate a potential container breakout attempt or an attacker's attempt to gain unauthorized access to the underlying host."
12false_positives = ["""
13  Legitimate users and processes, such as system administration tools, may utilize shell utilities inside a container resulting in false positives.
14  """
15]
16from = "now-6m"
17index = ["logs-cloud_defend*"]
18interval = "5m"
19language = "eql"
20license = "Elastic License v2"
21name = "Suspicious Interactive Shell Spawned From Inside A Container"
22tags = ["Data Source: Elastic Defend for Containers", "Domain: Container", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution"]
23risk_score = 73
24rule_id = "8d3d0794-c776-476b-8674-ee2e685f6470"
25severity = "high"
26timestamp_override = "event.ingested"
27type = "eql"
28
29query = """
30process where container.id: "*" and
31event.type== "start" and 
32
33/*D4C consolidates closely spawned event.actions, this excludes end actions to only capture ongoing processes*/
34event.action in ("fork", "exec") and event.action != "end"
35 and process.entry_leader.same_as_process== false and
36(
37(process.executable: "*/*sh" and process.args: ("-i", "-it")) or
38process.args: "*/*sh"
39)
40"""
41
42[[rule.threat]]
43framework = "MITRE ATT&CK"
44
45  [rule.threat.tactic]
46  id = "TA0002"
47  reference = "https://attack.mitre.org/tactics/TA0002/"
48  name = "Execution"
49
50  [[rule.threat.technique]]
51  id = "T1059"
52  reference = "https://attack.mitre.org/techniques/T1059/"
53  name = "Command and Scripting Interpreter"
54
55    [[rule.threat.technique.subtechnique]]
56    id = "T1059.004"
57    reference = "https://attack.mitre.org/techniques/T1059/004/"
58    name = "Unix Shell"