Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation

  1[metadata]
  2creation_date = "2026/08/17"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/10"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not
 11the Azure Linux Agent certificate under /var/lib/waagent. Adversaries can scrape WireServer certificates, mint a
 12LinuxTransport identity, and decrypt extension protectedSettings with openssl cms -decrypt or smime -decrypt.
 13"""
 14false_positives = [
 15    """
 16    Custom configuration-management that decrypts CMS blobs with an organization key outside /var/lib/waagent. Confirm
 17    the key path and exclude the specific command line after review.
 18    """,
 19]
 20from = "now-9m"
 21index = ["logs-endpoint.events.process-*"]
 22language = "eql"
 23license = "Elastic License v2"
 24name = "Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation"
 25note = """## Triage and analysis
 26
 27### Investigating Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation
 28
 29CyberCX-style WireServer abuse on Linux generates `openssl req -x509 -subj /CN=LinuxTransport`, posts the public
 30certificate to WireServer `comp=certificates`, then runs `openssl cms -decrypt` or `openssl smime -decrypt` with
 31`temp.key`, `wireserver.key`, or another non-waagent key to unwrap protectedSettings.
 32
 33Benign Azure Linux Agent activity looks like:
 34
 35`openssl cms -inform DER -decrypt -recip /var/lib/waagent/<thumbprint>.crt -inkey /var/lib/waagent/<thumbprint>.prv`
 36
 37The Azure Linux Agent is excluded by certificate path in process arguments (`/var/lib/waagent/*`) and by
 38parent executables `/usr/sbin/waagent` and `/usr/bin/waagent`. This does not exclude Python or
 39`run-command-extension` as parents because attacker scripts invoked via Run Command use those parents
 40with a non-waagent key. The agent itself also runs `openssl req ... /CN=LinuxTransport` with output
 41under `/var/lib/waagent/`; that argument path exclusion covers it.
 42
 43### Possible investigation steps
 44
 45- Review `process.command_line` and `process.args` for `LinuxTransport`, `wireserver.key`, `temp.key`, `payload.p7m`,
 46  or `payload.pfx`.
 47- Inspect parent and grandparent: Run Command (`/var/lib/waagent/run-command/`) or an interactive shell is higher
 48  risk than a one-off admin session with a ticket.
 49- Correlate with network events from curl to `168.63.129.16` ports 80 and 32526 on the same host.
 50- Search StorageRead logs for anonymous or SAS GetBlob of the same storage account after the decrypt.
 51- Hunt for the generated key files (`temp.key`, `wireserver.key`) on disk and in `/tmp`.
 52
 53### False positive analysis
 54
 55- The Azure Linux Agent decrypt path under `/var/lib/waagent/` and waagent parent executables
 56  (`/usr/sbin/waagent`, `/usr/bin/waagent`) are excluded.
 57- Legitimate certificate tooling that uses `-subj /CN=LinuxTransport` is unexpected; treat as suspicious until proven
 58  otherwise.
 59
 60### Response and remediation
 61
 62- Isolate the VM, delete attacker-generated keys and decrypted payloads, and rotate secrets that were in
 63  protectedSettings (SAS, connection strings, CSE script contents).
 64- Rotate the VM managed identity and review extension configuration.
 65- Revoke any SAS that was replayed from the decrypted settings.
 66"""
 67references = [
 68    "https://cybercx.com.au/blog/azure-ssrf-metadata/",
 69    "https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/",
 70    "https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services",
 71    "https://gtfobins.github.io/gtfobins/openssl/",
 72]
 73risk_score = 47
 74rule_id = "5bb27863-2da6-4d0d-879a-1efb10479c39"
 75severity = "medium"
 76tags = [
 77    "Domain: Endpoint",
 78    "Domain: Cloud",
 79    "OS: Linux",
 80    "Use Case: Threat Detection",
 81    "Platform: Azure",
 82    "Platform: Linux",
 83    "Tactic: Credential Access",
 84    "Tactic: Defense Evasion",
 85    "Data Source: Elastic Defend",
 86    "Resources: Investigation Guide",
 87]
 88timestamp_override = "event.ingested"
 89type = "eql"
 90
 91query = '''
 92process where host.os.type == "linux" and event.type == "start" and
 93event.action in ("exec", "exec_event", "start") and process.name == "openssl" and
 94(
 95  (
 96    process.args in ("cms", "smime") and process.args == "-decrypt"
 97  ) or
 98  (
 99    process.args == "req" and process.args : "*LinuxTransport*"
100  )
101) and
102not process.args like "/var/lib/waagent/*" and
103not process.parent.executable like (
104  "/usr/sbin/waagent",
105  "/usr/bin/waagent"
106)
107'''
108
109
110[[rule.threat]]
111framework = "MITRE ATT&CK"
112[[rule.threat.technique]]
113id = "T1552"
114name = "Unsecured Credentials"
115reference = "https://attack.mitre.org/techniques/T1552/"
116[[rule.threat.technique.subtechnique]]
117id = "T1552.005"
118name = "Cloud Instance Metadata API"
119reference = "https://attack.mitre.org/techniques/T1552/005/"
120
121
122
123[rule.threat.tactic]
124id = "TA0006"
125name = "Credential Access"
126reference = "https://attack.mitre.org/tactics/TA0006/"
127[[rule.threat]]
128framework = "MITRE ATT&CK"
129[[rule.threat.technique]]
130id = "T1140"
131name = "Deobfuscate/Decode Files or Information"
132reference = "https://attack.mitre.org/techniques/T1140/"
133
134
135[rule.threat.tactic]
136id = "TA0005"
137name = "Defense Evasion"
138reference = "https://attack.mitre.org/tactics/TA0005/"