Process Started from Process ID (PID) File

 1[metadata]
 2creation_date = "2022/05/11"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies a new process starting from a process ID (PID), lock or reboot file within the temporary file storage
13paradigm (tmpfs) directory /var/run directory. On Linux, the PID files typically hold the process ID to track previous
14copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables
15and other tasks, disguising itself or these files as legitimate PID files.
16"""
17false_positives = [
18    """
19    False-Positives (FP) should be at a minimum with this detection as PID files are meant to hold process IDs, not
20    inherently be executables that spawn processes.
21    """,
22]
23from = "now-9m"
24index = ["logs-endpoint.events.*", "endgame-*"]
25language = "eql"
26license = "Elastic License v2"
27name = "Process Started from Process ID (PID) File"
28note = """## Triage and analysis
29
30### Investigating Process Started from Process ID (PID) File
31Detection alerts from this rule indicate a process spawned from an executable masqueraded as a legitimate PID file which is very unusual and should not occur. Here are some possible avenues of investigation:
32- Examine parent and child process relationships of the new process to determine if other processes are running.
33- Examine the /var/run directory using Osquery to determine other potential PID files with unsually large file sizes, indicative of it being an executable: "SELECT f.size, f.uid, f.type, f.path from file f WHERE path like '/var/run/%%';"
34- Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation."""
35references = [
36    "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/",
37    "https://twitter.com/GossiTheDog/status/1522964028284411907",
38    "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf",
39    "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor",
40]
41risk_score = 73
42rule_id = "3688577a-d196-11ec-90b0-f661ea17fbce"
43severity = "high"
44tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Threat: BPFDoor", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
45timestamp_override = "event.ingested"
46type = "eql"
47
48query = '''
49process where host.os.type == "linux" and event.type == "start" and user.id == "0" and
50  process.executable regex~ """/var/run/\w+\.(pid|lock|reboot)"""
51'''
52
53
54[[rule.threat]]
55framework = "MITRE ATT&CK"
56[[rule.threat.technique]]
57id = "T1059"
58name = "Command and Scripting Interpreter"
59reference = "https://attack.mitre.org/techniques/T1059/"
60
61
62[rule.threat.tactic]
63id = "TA0002"
64name = "Execution"
65reference = "https://attack.mitre.org/tactics/TA0002/"