File Transfer or Listener Established via Netcat

  1[metadata]
  2creation_date = "2020/02/18"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2024/05/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by
 11exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data
 12exfiltration.
 13"""
 14false_positives = [
 15    """
 16    Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux
 17    distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may
 18    originate from scripts, automation tools, and frameworks.
 19    """,
 20]
 21from = "now-9m"
 22index = ["auditbeat-*", "logs-endpoint.events.*"]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "File Transfer or Listener Established via Netcat"
 26note = """## Triage and analysis
 27
 28### Investigating Netcat Network Activity
 29
 30Netcat is a dual-use command line tool that can be used for various purposes, such as port scanning, file transfers, and connection tests. Attackers can abuse its functionality for malicious purposes such creating bind shells or reverse shells to gain access to the target system.
 31
 32A reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are vulnerable since the connection is outgoing.
 33
 34A bind shell is a type of backdoor that attackers set up on the target host and binds to a specific port to listen for an incoming connection from the attacker.
 35
 36This rule identifies potential reverse shell or bind shell activity using Netcat by checking for the execution of Netcat followed by a network connection.
 37
 38#### Possible investigation steps
 39
 40- Examine the command line to identify if the command is suspicious.
 41- Extract and examine the target domain or IP address.
 42  - Check if the domain is newly registered or unexpected.
 43  - Check the reputation of the domain or IP address.
 44  - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the domain or IP address.
 45- Investigate other alerts associated with the user/host during the past 48 hours.
 46- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 47- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 48
 49### False positive analysis
 50
 51- Netcat is a dual-use tool that can be used for benign or malicious activity. It is included in some Linux distributions, so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks.
 52
 53### Response and remediation
 54
 55- Initiate the incident response process based on the outcome of the triage.
 56- Isolate the involved host to prevent further post-compromise behavior.
 57- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 58- Block the identified indicators of compromise (IoCs).
 59- Take actions to terminate processes and connections used by the attacker.
 60- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 61- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 62- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 63"""
 64references = [
 65    "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet",
 66    "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf",
 67    "https://en.wikipedia.org/wiki/Netcat",
 68    "https://www.hackers-arise.com/hacking-fundamentals",
 69    "https://null-byte.wonderhowto.com/how-to/hack-like-pro-use-netcat-swiss-army-knife-hacking-tools-0148657/",
 70    "https://levelup.gitconnected.com/ethical-hacking-part-15-netcat-nc-and-netcat-f6a8f7df43fd",
 71]
 72risk_score = 47
 73rule_id = "adb961e0-cb74-42a0-af9e-29fc41f88f5f"
 74setup = """## Setup
 75
 76This rule requires data coming in from one of the following integrations:
 77- Elastic Defend
 78- Auditbeat
 79
 80### Elastic Defend Integration Setup
 81Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 82
 83#### Prerequisite Requirements:
 84- Fleet is required for Elastic Defend.
 85- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 86
 87#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 88- Go to the Kibana home page and click "Add integrations".
 89- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 90- Click "Add Elastic Defend".
 91- Configure the integration name and optionally add a description.
 92- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 93- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 94- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 95- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 96For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 97- Click "Save and Continue".
 98- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 99For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
100
101### Auditbeat Setup
102Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
103
104#### The following steps should be executed in order to add the Auditbeat on a Linux System:
105- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
106- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
107- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
108- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
109- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
110"""
111severity = "medium"
112tags = [
113    "Domain: Endpoint",
114    "OS: Linux",
115    "Use Case: Threat Detection",
116    "Tactic: Execution",
117    "Resources: Investigation Guide",
118    "Data Source: Elastic Defend",
119]
120type = "eql"
121
122query = '''
123sequence by process.entity_id
124  [process where host.os.type == "linux" and event.type == "start" and
125      process.name:("nc","ncat","netcat","netcat.openbsd","netcat.traditional") and (
126          /* bind shell to echo for command execution */
127          (process.args:("-l","-p") and process.args:("-c","echo","$*"))
128          /* bind shell to specific port */
129          or process.args:("-l","-p","-lp")
130          /* reverse shell to command-line interpreter used for command execution */
131          or (process.args:("-e") and process.args:("/bin/bash","/bin/sh"))
132          /* file transfer via stdout */
133          or process.args:(">","<")
134          /* file transfer via pipe */
135          or (process.args:("|") and process.args:("nc","ncat"))
136      )]
137  [network where host.os.type == "linux" and (process.name == "nc" or process.name == "ncat" or process.name == "netcat" or
138                  process.name == "netcat.openbsd" or process.name == "netcat.traditional")]
139'''
140
141
142[[rule.threat]]
143framework = "MITRE ATT&CK"
144[[rule.threat.technique]]
145id = "T1059"
146name = "Command and Scripting Interpreter"
147reference = "https://attack.mitre.org/techniques/T1059/"
148[[rule.threat.technique.subtechnique]]
149id = "T1059.004"
150name = "Unix Shell"
151reference = "https://attack.mitre.org/techniques/T1059/004/"
152
153
154
155[rule.threat.tactic]
156id = "TA0002"
157name = "Execution"
158reference = "https://attack.mitre.org/tactics/TA0002/"