Potential SSH Password Grabbing via strace

 1[metadata]
 2creation_date = "2025/11/10"
 3integration = ["endpoint"]
 4maturity = "production"
 5updated_date = "2025/11/10"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects potential SSH password grabbing via the use of strace on sshd processes. Attackers may use strace to capture
11sensitive information, such as passwords, by tracing system calls made by the sshd process. This rule looks for a sequence
12of events where an sshd process ends followed closely by the start of a strace process. This may be indicative of an attacker
13attempting to capture SSH credentials.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.process-*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Potential SSH Password Grabbing via strace"
20references = [
21    "https://github.com/braindead-sec/ssh-grabber",
22    "https://dfir.ch/posts/strace/",
23]
24risk_score = 47
25rule_id = "9eaa3fb1-3f70-48ed-bb0e-d7ae4d3c8f28"
26severity = "medium"
27tags = [
28    "Domain: Endpoint",
29    "OS: Linux",
30    "Use Case: Threat Detection",
31    "Tactic: Persistence",
32    "Tactic: Credential Access",
33    "Data Source: Elastic Defend",
34]
35timestamp_override = "event.ingested"
36type = "eql"
37query = '''
38sequence by host.id with maxspan=3s
39  [process where host.os.type == "linux" and event.type == "end" and process.name == "sshd"]
40  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "strace"]
41'''
42
43[[rule.threat]]
44framework = "MITRE ATT&CK"
45
46[[rule.threat.technique]]
47id = "T1556"
48name = "Modify Authentication Process"
49reference = "https://attack.mitre.org/techniques/T1556/"
50
51[rule.threat.tactic]
52id = "TA0006"
53name = "Credential Access"
54reference = "https://attack.mitre.org/tactics/TA0006/"
55
56[[rule.threat]]
57framework = "MITRE ATT&CK"
58
59[[rule.threat.technique]]
60id = "T1554"
61name = "Compromise Host Software Binary"
62reference = "https://attack.mitre.org/techniques/T1554/"
63
64[rule.threat.tactic]
65id = "TA0003"
66name = "Persistence"
67reference = "https://attack.mitre.org/tactics/TA0003/"