Potential Reverse Shell

 1[metadata]
 2creation_date = "2023/07/04"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/08/10"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12This detection rule identifies suspicious network traffic patterns associated with TCP reverse shell activity. This
13activity consists of a parent-child relationship where a network event is followed by the creation of a shell process.
14An attacker may establish a Linux TCP reverse shell to gain remote access to a target system.
15"""
16from = "now-9m"
17index = ["logs-endpoint.events.*"]
18language = "eql"
19license = "Elastic License v2"
20name = "Potential Reverse Shell"
21references = [
22    "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md"
23]
24risk_score = 47
25rule_id = "48b3d2e3-f4e8-41e6-95e6-9b2091228db3"
26severity = "medium"
27tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"]
28type = "eql"
29query = '''
30sequence by host.id with maxspan=1s
31[ network where host.os.type == "linux" and event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and 
32  process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and 
33  destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ] by process.entity_id
34[ process where host.os.type == "linux" and event.type == "start" and event.action : ("exec", "fork") and 
35  process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and 
36  process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") ] by process.parent.entity_id
37'''
38
39[[rule.threat]]
40framework = "MITRE ATT&CK"
41
42[rule.threat.tactic]
43name = "Execution"
44id = "TA0002"
45reference = "https://attack.mitre.org/tactics/TA0002/"
46
47[[rule.threat.technique]]
48id = "T1059"
49name = "Command and Scripting Interpreter"
50reference = "https://attack.mitre.org/techniques/T1059/"
51
52[[rule.threat.technique.subtechnique]]
53id = "T1059.004"
54name = "Unix Shell"
55reference = "https://attack.mitre.org/techniques/T1059/004/"
56
57[[rule.threat]]
58framework = "MITRE ATT&CK"
59
60[rule.threat.tactic]
61name = "Command and Control"
62id = "TA0011"
63reference = "https://attack.mitre.org/tactics/TA0011/"
64
65[[rule.threat.technique]]
66name = "Application Layer Protocol"
67id = "T1071"
68reference = "https://attack.mitre.org/techniques/T1071/"