Potential Suspicious File Edit

  1[metadata]
  2creation_date = "2023/07/25"
  3maturity = "production"
  4min_stack_comments = "New fields added: required_fields, related_integrations, setup"
  5min_stack_version = "8.3.0"
  6updated_date = "2024/02/22"
  7integration = ["endpoint"]
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12This rule monitors for the potential edit of a suspicious file. In Linux, when editing a file through an editor, a 
 13temporary .swp file is created. By monitoring for the creation of this .swp file, we can detect potential file edits of
 14suspicious files. The execution of this rule is not a clear sign of the file being edited, as just opening the file 
 15through an editor will trigger this event. Attackers may alter any of the files added in this rule to establish
 16persistence, escalate privileges or perform reconnaisance on the system. 
 17"""
 18from = "now-9m"
 19index = ["logs-endpoint.events.*", "endgame-*"]
 20language = "eql"
 21license = "Elastic License v2"
 22max_signals = 1
 23name = "Potential Suspicious File Edit"
 24risk_score = 21
 25rule_id = "3728c08d-9b70-456b-b6b8-007c7d246128"
 26severity = "low"
 27tags = [
 28        "Domain: Endpoint",
 29        "OS: Linux",
 30        "Use Case: Threat Detection",
 31        "Tactic: Persistence",
 32        "Tactic: Privilege Escalation",
 33        "Data Source: Elastic Endgame",
 34        "Data Source: Elastic Defend"
 35        ]
 36timestamp_override = "event.ingested"
 37type = "eql"
 38query = '''
 39file where event.action in ("creation", "file_create_event") and file.extension == "swp" and 
 40file.path : (
 41  /* common interesting files and locations */
 42  "/etc/.shadow.swp", "/etc/.shadow-.swp", "/etc/.shadow~.swp", "/etc/.gshadow.swp", "/etc/.gshadow-.swp",
 43  "/etc/.passwd.swp", "/etc/.pwd.db.swp", "/etc/.master.passwd.swp", "/etc/.spwd.db.swp", "/etc/security/.opasswd.swp",
 44  "/etc/.environment.swp", "/etc/.profile.swp", "/etc/sudoers.d/.*.swp", "/etc/ld.so.conf.d/.*.swp",
 45  "/etc/init.d/.*.swp", "/etc/.rc.local.swp", "/etc/rc*.d/.*.swp", "/dev/shm/.*.swp", "/etc/update-motd.d/.*.swp",
 46  "/usr/lib/update-notifier/.*.swp",
 47
 48  /* service, timer, want, socket and lock files */
 49  "/etc/systemd/system/.*.swp", "/usr/local/lib/systemd/system/.*.swp", "/lib/systemd/system/.*.swp",
 50  "/usr/lib/systemd/system/.*.swp","/home/*/.config/systemd/user/.*.swp", "/run/.*.swp", "/var/run/.*.swp/",
 51
 52  /* profile and shell configuration files */  
 53  "/home/*.profile.swp", "/home/*.bash_profile.swp", "/home/*.bash_login.swp", "/home/*.bashrc.swp", "/home/*.bash_logout.swp",
 54  "/home/*.zshrc.swp", "/home/*.zlogin.swp", "/home/*.tcshrc.swp", "/home/*.kshrc.swp", "/home/*.config.fish.swp",
 55  "/root/*.profile.swp", "/root/*.bash_profile.swp", "/root/*.bash_login.swp", "/root/*.bashrc.swp", "/root/*.bash_logout.swp",
 56  "/root/*.zshrc.swp", "/root/*.zlogin.swp", "/root/*.tcshrc.swp", "/root/*.kshrc.swp", "/root/*.config.fish.swp"
 57)
 58'''
 59
 60[[rule.threat]]
 61framework = "MITRE ATT&CK"
 62
 63[rule.threat.tactic]
 64id = "TA0003"
 65name = "Persistence"
 66reference = "https://attack.mitre.org/tactics/TA0003/"
 67
 68[[rule.threat.technique]]
 69id = "T1037"
 70name = "Boot or Logon Initialization Scripts"
 71reference = "https://attack.mitre.org/techniques/T1037/"
 72
 73[[rule.threat.technique.subtechnique]]
 74id = "T1037.004"
 75name = "RC Scripts"
 76reference = "https://attack.mitre.org/techniques/T1037/004/"
 77
 78[[rule.threat.technique]]
 79id = "T1574"
 80name = "Hijack Execution Flow"
 81reference = "https://attack.mitre.org/techniques/T1574/"
 82
 83[[rule.threat.technique.subtechnique]]
 84id = "T1574.006"
 85name = "Dynamic Linker Hijacking"
 86reference = "https://attack.mitre.org/techniques/T1574/006/"
 87
 88[[rule.threat.technique]]
 89id = "T1543"
 90name = "Create or Modify System Process"
 91reference = "https://attack.mitre.org/techniques/T1543/"
 92
 93[[rule.threat.technique.subtechnique]]
 94id = "T1543.002"
 95name = "Systemd Service"
 96reference = "https://attack.mitre.org/techniques/T1543/002/"
 97
 98[[rule.threat]]
 99framework = "MITRE ATT&CK"
100
101[rule.threat.tactic]
102id = "TA0004"
103name = "Privilege Escalation"
104reference = "https://attack.mitre.org/tactics/TA0004/"
105
106[[rule.threat.technique]]
107id = "T1548"
108name = "Abuse Elevation Control Mechanism"
109reference = "https://attack.mitre.org/techniques/T1548/"
110
111[[rule.threat.technique.subtechnique]]
112id = "T1548.003"
113name = "Sudo and Sudo Caching"
114reference = "https://attack.mitre.org/techniques/T1548/003/"