Process Started from Process ID (PID) File
Identifies a new process starting from a process ID (PID), lock or reboot file within the temporary file storage paradigm (tmpfs) directory /var/run directory. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2022/05/11"
3integration = ["endpoint"]
4maturity = "production"
5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6min_stack_version = "8.3.0"
7updated_date = "2023/06/22"
8
9[rule]
10author = ["Elastic"]
11description = """
12Identifies a new process starting from a process ID (PID), lock or reboot file within the temporary file storage
13paradigm (tmpfs) directory /var/run directory. On Linux, the PID files typically hold the process ID to track previous
14copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables
15and other tasks, disguising itself or these files as legitimate PID files.
16"""
17false_positives = [
18 """
19 False-Positives (FP) should be at a minimum with this detection as PID files are meant to hold process IDs, not
20 inherently be executables that spawn processes.
21 """,
22]
23from = "now-9m"
24index = ["logs-endpoint.events.*", "endgame-*"]
25language = "eql"
26license = "Elastic License v2"
27name = "Process Started from Process ID (PID) File"
28note = """## Triage and analysis
29
30### Investigating Process Started from Process ID (PID) File
31Detection alerts from this rule indicate a process spawned from an executable masqueraded as a legitimate PID file which is very unusual and should not occur. Here are some possible avenues of investigation:
32- Examine parent and child process relationships of the new process to determine if other processes are running.
33- Examine the /var/run directory using Osquery to determine other potential PID files with unsually large file sizes, indicative of it being an executable: "SELECT f.size, f.uid, f.type, f.path from file f WHERE path like '/var/run/%%';"
34- Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation."""
35references = [
36 "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/",
37 "https://twitter.com/GossiTheDog/status/1522964028284411907",
38 "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf",
39 "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor",
40]
41risk_score = 73
42rule_id = "3688577a-d196-11ec-90b0-f661ea17fbce"
43severity = "high"
44tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Threat: BPFDoor", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
45timestamp_override = "event.ingested"
46type = "eql"
47
48query = '''
49process where host.os.type == "linux" and event.type == "start" and user.id == "0" and
50 process.executable regex~ """/var/run/\w+\.(pid|lock|reboot)"""
51'''
52
53
54[[rule.threat]]
55framework = "MITRE ATT&CK"
56[[rule.threat.technique]]
57id = "T1059"
58name = "Command and Scripting Interpreter"
59reference = "https://attack.mitre.org/techniques/T1059/"
60
61
62[rule.threat.tactic]
63id = "TA0002"
64name = "Execution"
65reference = "https://attack.mitre.org/tactics/TA0002/"
Triage and analysis
Investigating Process Started from Process ID (PID) File
Detection alerts from this rule indicate a process spawned from an executable masqueraded as a legitimate PID file which is very unusual and should not occur. Here are some possible avenues of investigation:
- Examine parent and child process relationships of the new process to determine if other processes are running.
- Examine the /var/run directory using Osquery to determine other potential PID files with unsually large file sizes, indicative of it being an executable: "SELECT f.size, f.uid, f.type, f.path from file f WHERE path like '/var/run/%%';"
- Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation.
References
Related rules
- Binary Executed from Shared Memory Directory
- BPF filter applied using TC
- Cron Job Created or Changed by Previously Unknown Process
- Interactive Terminal Spawned via Perl
- Interactive Terminal Spawned via Python