Netcat Listener Established Inside A Container

 1[metadata]
 2creation_date = "2023/04/26"
 3integration = ["cloud_defend"]
 4maturity = "production"
 5min_stack_comments = "New Integration: Cloud Defend"
 6min_stack_version = "8.8.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = "This rule detects an established netcat listener running inside a container. Netcat is a utility used for reading and writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for persistence or exfiltrating data."
12false_positives = ["""
13  There is a potential for false positives if the container is used for legitimate tasks that require the use of netcat, such as network troubleshooting, testing or system monitoring. It is important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity or part of legitimate container activity.
14  """]
15from = "now-6m"
16index = ["logs-cloud_defend*"]
17interval = "5m"
18language = "eql"
19license = "Elastic License v2"
20name = "Netcat Listener Established Inside A Container"
21risk_score = 73
22rule_id = "a52a9439-d52c-401c-be37-2785235c6547"
23severity = "high"
24tags = ["Data Source: Elastic Defend for Containers", "Domain: Container", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution"]
25timestamp_override = "event.ingested"
26type = "eql"
27
28query = """
29process where container.id: "*" and event.type== "start" 
30and event.action in ("fork", "exec") and 
31(
32process.name:("nc","ncat","netcat","netcat.openbsd","netcat.traditional") or
33/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
34process.args: ("nc","ncat","netcat","netcat.openbsd","netcat.traditional")
35) and (
36          /* bind shell to echo for command execution */
37          (process.args:("-*l*", "--listen", "-*p*", "--source-port") and process.args:("-c", "--sh-exec", "-e", "--exec", "echo","$*"))
38          /* bind shell to specific port */
39          or process.args:("-*l*", "--listen", "-*p*", "--source-port")
40          )
41"""
42
43[[rule.threat]]
44framework = "MITRE ATT&CK"
45
46  [rule.threat.tactic]
47  id = "TA0002"
48  reference = "https://attack.mitre.org/tactics/TA0002/"
49  name = "Execution"
50
51  [[rule.threat.technique]]
52  id = "T1059"
53  reference = "https://attack.mitre.org/techniques/T1059/"
54  name = "Command and Scripting Interpreter"
55
56    [[rule.threat.technique.subtechnique]]
57    id = "T1059.004"
58    reference = "https://attack.mitre.org/techniques/T1059/004/"
59    name = "Unix Shell"