Direct Process Execution via Background Utility

  1[metadata]
  2creation_date = "2026/07/30"
  3integration = ["endpoint", "sentinel_one_cloud_funnel", "auditd_manager"]
  4maturity = "production"
  5updated_date = "2026/08/03"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This is a New Terms rule that identifies the first occurrence of setsid or nohup being used to directly
 11execute a process on a host. Attackers may leverage these tools to execute commands in a new session
 12and/or to ignore signals.
 13"""
 14from = "now-9m"
 15index = [
 16    "endgame-*",
 17    "logs-endpoint.events.process*",
 18    "logs-sentinel_one_cloud_funnel.*",
 19    "auditbeat-*",
 20    "logs-auditd_manager.auditd-*",
 21]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "Direct Process Execution via Background Utility"
 25note = """ ## Triage and analysis
 26
 27> **Disclaimer**:
 28> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 29
 30### Investigating Direct Process Execution via Background Utility
 31
 32This rule flags the first time a Linux host uses setsid, nohup, or disown to launch another process directly, which often means someone is detaching execution from the current terminal or login session. Attackers commonly use nohup to start a backdoor, reverse shell, or cryptominer after SSH access so the process keeps running after they disconnect and ignores normal hangup signals.
 33
 34### Possible investigation steps
 35
 36- Review the child process launched by the utility, including its full command line, executable path, working directory, and any redirected output files, to quickly separate routine administration from suspicious payload execution.
 37- Trace the full ancestry and session context around the launch, such as an interactive shell, SSH login, sudo elevation, script runner, or service account, to determine whether the execution came from an expected workflow or an unusual entry point.
 38- Assess the user and host history for similar behavior by checking recent logins, shell history, and prior detached launches on the same asset or by the same account, since a first-seen event from a normally quiet user often increases concern.
 39- Inspect immediate follow-on activity from the spawned process, especially outbound network connections, file downloads, child process creation, or persistence changes, because detached execution is commonly used to keep malicious tooling running after logout.
 40- Confirm with the system owner whether the command aligns with approved long-running tasks such as maintenance, backups, or software updates, and if not, preserve the binary and related artifacts for deeper analysis and potential containment.
 41
 42### False positive analysis
 43
 44- A Linux administrator may legitimately use nohup or setsid to launch an approved maintenance, backup, or data-processing script from an interactive shell so it continues after logout; verify the child command, executable path, initiating user, and execution time match expected operational activity on that host.
 45- An engineer troubleshooting or restarting a local application may detach the process with setsid during a remote session to avoid terminal interruption; verify the parent shell and account are authorized and that the spawned binary or script and working directory align with the host's normal application files.
 46
 47### Response and remediation
 48
 49- Isolate the affected Linux host from the network, terminate the detached child process started with `nohup`, `setsid`, or `disown` and any descendants, and preserve the executable, shell script, redirected output files, and shell history for evidence.
 50- Remove attacker persistence by deleting malicious cron jobs, systemd service or timer units, `rc.local` or shell profile modifications, unauthorized `authorized_keys` entries, and any dropped binaries or scripts referenced by the detached command.
 51- Reset compromised access by disabling or rotating credentials for the initiating account and any accounts used afterward, revoking active SSH sessions and tokens, and reviewing `sudoers`, newly added local users, and group memberships for unauthorized changes.
 52- Rebuild the host from a known-good image or restore from a trusted backup if the detached process ran a backdoor, reverse shell, downloader, or altered system binaries, and verify only approved packages, services, and startup items remain before returning it to production.
 53- Escalate to incident response immediately if the detached process contacted an external command-and-control address, executed from a writable temporary or home directory as root, spread to other hosts, or evidence shows credential theft or persistence beyond the original system.
 54- Harden the environment by restricting interactive use of backgrounding utilities where not required, tightening SSH and `sudo` access, enforcing application allowlisting and least privilege, and adding detections for detached launches from temporary directories, user home directories, and unexpected service accounts.
 55
 56"""
 57references = [
 58  "https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign?hl=en"
 59]
 60risk_score = 21
 61rule_id = "9dc1d59c-fc5f-4a73-8ca6-1473eabdff2a"
 62setup = """## Setup
 63
 64This rule requires data coming in from Elastic Defend.
 65
 66### Elastic Defend Integration Setup
 67Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 68
 69#### Prerequisite Requirements:
 70- Fleet is required for Elastic Defend.
 71- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 72
 73#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 74- Go to the Kibana home page and click "Add integrations".
 75- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 76- Click "Add Elastic Defend".
 77- Configure the integration name and optionally add a description.
 78- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 79- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 80- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 81- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 82For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 83- Click "Save and Continue".
 84- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 85For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 86"""
 87severity = "low"
 88tags = [
 89    "Domain: Endpoint",
 90    "OS: Linux",
 91    "Use Case: Threat Detection",
 92    "Tactic: Execution",
 93    "Tactic: Defense Evasion",
 94    "Data Source: Elastic Defend",
 95    "Data Source: Elastic Endgame",
 96    "Data Source: SentinelOne",
 97    "Data Source: Auditd Manager",
 98    "Resources: Investigation Guide"
 99]
100timestamp_override = "event.ingested"
101type = "new_terms"
102query = '''
103host.os.type:linux and event.category:process and
104event.action:("exec" or "exec_event" or "executed" or "process_started" or "start") and
105process.name:("setsid" or "nohup" or "disown") and process.args_count:2
106'''
107
108[[rule.threat]]
109framework = "MITRE ATT&CK"
110
111[[rule.threat.technique]]
112id = "T1059"
113name = "Command and Scripting Interpreter"
114reference = "https://attack.mitre.org/techniques/T1059/"
115
116[[rule.threat.technique.subtechnique]]
117id = "T1059.004"
118name = "Unix Shell"
119reference = "https://attack.mitre.org/techniques/T1059/004/"
120
121[rule.threat.tactic]
122id = "TA0002"
123name = "Execution"
124reference = "https://attack.mitre.org/tactics/TA0002/"
125
126[[rule.threat]]
127framework = "MITRE ATT&CK"
128
129[[rule.threat.technique]]
130id = "T1036"
131name = "Masquerading"
132reference = "https://attack.mitre.org/techniques/T1036/"
133
134[[rule.threat.technique.subtechnique]]
135id = "T1036.009"
136name = "Break Process Trees"
137reference = "https://attack.mitre.org/techniques/T1036/009/"
138
139[[rule.threat.technique]]
140id = "T1564"
141name = "Hide Artifacts"
142reference = "https://attack.mitre.org/techniques/T1564/"
143
144[rule.threat.tactic]
145id = "TA0005"
146name = "Defense Evasion"
147reference = "https://attack.mitre.org/tactics/TA0005/"
148
149[rule.new_terms]
150field = "new_terms_fields"
151value = ["process.parent.executable", "host.id", "process.command_line"]
152
153[[rule.new_terms.history_window_start]]
154field = "history_window_start"
155value = "now-5d"