File Creation, Execution and Self-Deletion in Suspicious Directory

  1[metadata]
  2creation_date = "2023/08/28"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2025/02/04"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule monitors for the creation of a file, followed by its execution and self-deletion in a short timespan within a
 11directory often used for malicious purposes by threat actors. This behavior is often used by malware to execute
 12malicious code and delete itself to hide its tracks.
 13"""
 14from = "now-9m"
 15index = ["logs-endpoint.events.file*", "logs-endpoint.events.process*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "File Creation, Execution and Self-Deletion in Suspicious Directory"
 19risk_score = 47
 20rule_id = "09bc6c90-7501-494d-b015-5d988dc3f233"
 21setup = """## Setup
 22
 23This rule requires data coming in from Elastic Defend.
 24
 25### Elastic Defend Integration Setup
 26Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 27
 28#### Prerequisite Requirements:
 29- Fleet is required for Elastic Defend.
 30- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 31
 32#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 33- Go to the Kibana home page and click "Add integrations".
 34- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 35- Click "Add Elastic Defend".
 36- Configure the integration name and optionally add a description.
 37- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 38- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 39- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 40- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 41For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 42- Click "Save and Continue".
 43- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 44For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 45"""
 46severity = "medium"
 47tags = [
 48    "Domain: Endpoint",
 49    "OS: Linux",
 50    "Use Case: Threat Detection",
 51    "Tactic: Execution",
 52    "Data Source: Elastic Defend",
 53    "Resources: Investigation Guide",
 54]
 55type = "eql"
 56query = '''
 57sequence by host.id, user.id with maxspan=1m
 58  [file where host.os.type == "linux" and event.action == "creation" and
 59   process.name in ("curl", "wget", "fetch", "ftp", "sftp", "scp", "rsync", "ld") and
 60   file.path : ("/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*",
 61     "/run/*", "/var/run/*", "/var/www/*", "/proc/*/fd/*")] by file.name
 62  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
 63   process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
 64   not process.parent.executable like (
 65     "/tmp/VeeamApp*", "/tmp/rajh/spack-stage/*", "plz-out/bin/vault/bridge/test/e2e/base/bridge-dev",
 66     "/usr/bin/ranlib", "/usr/bin/ar", "plz-out/bin/vault/bridge/test/e2e/base/local-k8s"
 67   )] by process.name
 68  [file where host.os.type == "linux" and event.action == "deletion" and
 69   file.path : (
 70     "/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/var/www/*", "/proc/*/fd/*"
 71    ) and not process.name in ("rm", "ld", "conftest", "link", "gcc", "getarch", "ld")] by file.name
 72'''
 73note = """## Triage and analysis
 74
 75> **Disclaimer**:
 76> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 77
 78### Investigating File Creation, Execution and Self-Deletion in Suspicious Directory
 79
 80In Linux environments, temporary directories like `/tmp` and `/var/tmp` are often used for storing transient files. Adversaries exploit these directories to execute malicious payloads and erase traces by creating, running, and deleting files swiftly. The detection rule identifies this pattern by monitoring file creation, execution, and deletion events within these directories, flagging suspicious activities that align with common malware behaviors.
 81
 82### Possible investigation steps
 83
 84- Review the file creation event details, focusing on the file path and name to determine if it matches known malicious patterns or if it is a legitimate file.
 85- Examine the process execution event, paying attention to the process name and parent process name to identify if the execution was initiated by a suspicious or unauthorized shell.
 86- Investigate the user.id and host.id associated with the events to determine if the activity aligns with expected user behavior or if it indicates potential compromise.
 87- Check for any network activity or connections initiated by the process to identify potential data exfiltration or communication with command and control servers.
 88- Analyze the deletion event to confirm whether the file was removed by a legitimate process or if it was part of a self-deletion mechanism used by malware.
 89- Correlate these events with any other alerts or logs from the same host or user to identify patterns or additional indicators of compromise.
 90
 91### False positive analysis
 92
 93- Development and testing activities in temporary directories can trigger false positives. Exclude specific paths or processes related to known development tools or scripts that frequently create, execute, and delete files in these directories.
 94- Automated system maintenance scripts may perform similar actions. Identify and whitelist these scripts by their process names or paths to prevent unnecessary alerts.
 95- Backup or deployment tools like Veeam or Spack may use temporary directories for legitimate operations. Add exceptions for these tools by specifying their executable paths or process names.
 96- Temporary file operations by legitimate applications such as web servers or database services might be flagged. Monitor and exclude these applications by their known behaviors or specific file paths they use.
 97- Regular system updates or package installations can involve temporary file handling. Recognize and exclude these activities by identifying the associated package manager processes or update scripts.
 98
 99### Response and remediation
100
101- Isolate the affected host immediately to prevent further spread of the potential malware. Disconnect it from the network to contain the threat.
102- Terminate any suspicious processes identified in the alert, especially those executed from temporary directories, to stop any ongoing malicious activity.
103- Conduct a thorough examination of the affected directories (/tmp, /var/tmp, etc.) to identify and remove any remaining malicious files or scripts.
104- Restore any affected systems from a known good backup to ensure that no remnants of the malware remain.
105- Update and patch the affected system to close any vulnerabilities that may have been exploited by the threat actor.
106- Enhance monitoring and logging on the affected host and similar systems to detect any recurrence of this behavior, focusing on file creation, execution, and deletion events in temporary directories.
107- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems may be compromised."""
108
109[[rule.threat]]
110framework = "MITRE ATT&CK"
111
112[[rule.threat.technique]]
113id = "T1059"
114name = "Command and Scripting Interpreter"
115reference = "https://attack.mitre.org/techniques/T1059/"
116
117[[rule.threat.technique.subtechnique]]
118id = "T1059.004"
119name = "Unix Shell"
120reference = "https://attack.mitre.org/techniques/T1059/004/"
121
122[rule.threat.tactic]
123id = "TA0002"
124name = "Execution"
125reference = "https://attack.mitre.org/tactics/TA0002/"