Suspicious Linux Process Connection to Bulletproof Hosting ASN

  1[metadata]
  2creation_date = "2026/09/17"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/17"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule detects outbound connection attempts from unusual Linux process locations or common living-off-the-land
 11utilities to autonomous systems associated with bulletproof or high-abuse hosting. Adversaries often stage payloads
 12in world-writable or web directories and beacon to infrastructure that ignores abuse reports, including providers
 13such as Storm Industries, Ecatel/IP Volume, Aeza, and Proton66.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.network*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "Suspicious Linux Process Connection to Bulletproof Hosting ASN"
 20note = """## Triage and analysis
 21
 22> **Disclaimer**:
 23> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 24
 25### Investigating Suspicious Linux Process Connection to Bulletproof Hosting ASN
 26
 27This rule flags a Linux process that initiates an outbound connection to an ASN commonly associated with bulletproof or high-abuse hosting. The process is either running from an unusual location such as `/tmp`, `/dev/shm`, a web directory, or `memfd`, or it is a downloader, shell, or interpreter frequently abused to fetch and launch follow-on payloads. A typical pattern is a dropped ELF in `/tmp` or a webshell-spawned `curl`/`wget`/`python` process beaconing to providers such as Storm Industries, Ecatel/IP Volume, Aeza, or Proton66.
 28
 29ASN enrichment is applied at ingest. Confirm `destination.as.number` and `destination.as.organization.name` on the source event, because the endpoint agent does not populate these fields natively.
 30
 31### Possible investigation steps
 32
 33- Review the process executable path, name, command line, parent lineage, user, and working directory to determine whether the connection came from a dropped binary, a webshell, or an expected administrative tool.
 34- Enrich the destination IP with ASN, organization, reputation, passive DNS, and related hosts that contacted the same address or ASN around the same time.
 35- Correlate nearby file, process, and DNS activity on the same `host.id` and `process.entity_id` for payload writes, `chmod`/`exec` of the same path, interpreter downloads, or additional beacons.
 36- Check whether the destination was reached by raw IP with no preceding DNS lookup, which is common for malware command-and-control.
 37- Scope the same process hash, destination IP, and ASN across the environment, and review web server, SSH, and privilege-escalation telemetry if the parent is a web process or an unusual interactive shell.
 38
 39### False positive analysis
 40
 41- An administrator or automation job may use `curl`, `wget`, `python`, or a shell to retrieve packages or updates from a VPS that happens to sit in a high-abuse ASN such as HOSTKEY, Aeza, or FlokiNET; confirm the parent process, change record, and destination ownership.
 42- Software installers, self-extracting packages, or development builds running from `/tmp` can make outbound connections during setup; verify the binary path, publisher, and whether the destination is expected for that installer.
 43- Privacy-oriented or Tor-related tooling hosted on FlokiNET or similar providers can trigger this rule; validate that the process and destination match an approved use case.
 44
 45### Response and remediation
 46
 47- Isolate the affected Linux host from the network except for approved management access, terminate the suspicious process tree, and block the destination IP, domain, and ASN at DNS, proxy, and firewall layers where policy allows.
 48- Preserve the executable, command line, destination IP, ASN, and related files under `/tmp`, `/var/tmp`, `/dev/shm`, web directories, and `memfd` for forensic review.
 49- Remove attacker footholds including dropped binaries, webshells, cron or systemd persistence, and unauthorized SSH keys, then rotate credentials exposed on the host.
 50- Rebuild or restore the host from a known-good image if a malicious payload executed, and hunt for the same hash, destination, or ASN on other systems.
 51- Escalate to incident response if the process ran as root, the same infrastructure appears on multiple hosts, or you observe follow-on payload execution, credential access, or lateral movement.
 52"""
 53references = [
 54  "https://attack.mitre.org/techniques/T1071/",
 55  "https://www.spamhaus.org/blocklists/do-not-route-or-peer/",
 56]
 57risk_score = 73
 58rule_id = "01d8b52c-61b0-4a28-96cf-14d5b3c01e05"
 59setup = """## Setup
 60
 61This rule requires data coming in from Elastic Defend.
 62
 63### Elastic Defend Integration Setup
 64Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 65
 66#### Prerequisite Requirements:
 67- Fleet is required for Elastic Defend.
 68- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 69
 70#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 71- Go to the Kibana home page and click "Add integrations".
 72- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 73- Click "Add Elastic Defend".
 74- Configure the integration name and optionally add a description.
 75- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 76- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 77- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 78- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 79For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 80- Click "Save and Continue".
 81- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 82For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 83"""
 84severity = "high"
 85tags = [
 86    "Domain: Endpoint",
 87    "Domain: Network",
 88    "OS: Linux",
 89    "Platform: Linux",
 90    "Rule Type: Event Correlation (EQL)",
 91    "Use Case: Threat Detection",
 92    "Tactic: Command and Control",
 93    "Tactic: Execution",
 94    "Data Source: Elastic Defend",
 95    "Resources: Investigation Guide",
 96]
 97timestamp_override = "event.ingested"
 98type = "eql"
 99query = '''
100network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and
101(
102  process.executable like (
103    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "*/www/html/*",
104    "/lost+found/*", "/var/mail/*", "/var/www/*", "/mnt/*", "/media/*", "/proc/*/fd/*", "?memfd:*", "memfd:*",
105    "*/wp-content/*", "*/wp-includes/*", "*/wp-admin/*"
106  ) or
107  process.name in (
108    "curl", "wget", "ftp", "tftp", "scp", "rsync", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
109    "busybox", "timeout", "env", "bun"
110  ) or
111  process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node*", "deno*")
112) and
113destination.as.number in (
114  // Storm Industries / StormCloud / Pfcloud / OMEGATECH
115  202412, 214472, 219502, 51396,
116  // Ecatel / IP Volume / Novogara / SpectraIP
117  48090, 56611, 57717, 62068, 202425, 202769, 204655,
118  // 4Vendeta / Tamatiya
119  200391, 204428, 207812,
120  // KoDDoS / Amarutu
121  206264,
122  // 1337 Services (rdp.sh)
123  210558,
124  // TEAM-HOST
125  202984,
126  // HOSTKEY (frequently abused for malware C2)
127  50867, 57043,
128  // Proton66 / Prospero
129  198953, 200593,
130  // Aeza / Hypercore (OFAC)
131  210644, 211522, 215552, 216246,
132  // Stark / PQ.Hosting / WorkTitans / MIRhosting / UFO Hosting
133  33993, 44477, 52000, 209847,
134  // Zservers / XHost
135  213010, 213194, 61336, 216071,
136  // Media Land (OFAC)
137  48721, 206728, 211409, 215311,
138  // ELITETEAM / 1337TEAM
139  39770, 51381, 56873, 60424,
140  // aurologic downstream BPH brands
141  209800, 210281, 213887, 214351, 214940, 214943, 215789, 216309,
142  // QWINS, GCSAS, Cloudzy, HostSlick, AlexHost, FlokiNET, PINSPB
143  14956, 44050, 200019, 200651, 208046, 213702, 215540,
144  // FUNNULL / CTG Server
145  152194,
146  // First Server Limited
147  50113, 204997, 205090,
148  // CrazyRDP / Delis
149  211252, 394711,
150  // BtHoster / BTCloud
151  213388, 213790, 214295,
152  // SHANGXING
153  400619
154)
155'''
156
157[[rule.threat]]
158framework = "MITRE ATT&CK"
159
160[[rule.threat.technique]]
161id = "T1071"
162name = "Application Layer Protocol"
163reference = "https://attack.mitre.org/techniques/T1071/"
164
165[rule.threat.tactic]
166id = "TA0011"
167name = "Command and Control"
168reference = "https://attack.mitre.org/tactics/TA0011/"
169
170[[rule.threat]]
171framework = "MITRE ATT&CK"
172
173[[rule.threat.technique]]
174id = "T1059"
175name = "Command and Scripting Interpreter"
176reference = "https://attack.mitre.org/techniques/T1059/"
177
178[[rule.threat.technique.subtechnique]]
179id = "T1059.004"
180name = "Unix Shell"
181reference = "https://attack.mitre.org/techniques/T1059/004/"
182
183[rule.threat.tactic]
184id = "TA0002"
185name = "Execution"
186reference = "https://attack.mitre.org/tactics/TA0002/"