Potential Execution via XZBackdoor

 1[metadata]
 2creation_date = "2024/04/01"
 3integration = ["endpoint"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10It identifies potential malicious shell executions through remote SSH and detects cases where the sshd service suddenly
11terminates soon after successful execution, suggesting suspicious behavior similar to the XZ backdoor.
12"""
13from = "now-9m"
14index = ["logs-endpoint.events.*"]
15language = "eql"
16license = "Elastic License v2"
17name = "Potential Execution via XZBackdoor"
18references = ["https://github.com/amlweems/xzbot", "https://access.redhat.com/security/cve/CVE-2024-3094"]
19risk_score = 73
20rule_id = "7afc6cc9-8800-4c7f-be6b-b688d2dea248"
21severity = "high"
22tags = [
23    "Domain: Endpoint",
24    "OS: Linux",
25    "Use Case: Threat Detection",
26    "Tactic: Credential Access",
27    "Tactic: Persistence",
28    "Tactic: Lateral Movement",
29    "Data Source: Elastic Defend",
30]
31timestamp_override = "event.ingested"
32type = "eql"
33
34query = '''
35sequence by host.id, user.id with maxspan=1s
36 [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "sshd" and
37    process.args == "-D" and process.args == "-R"] by process.pid, process.entity_id
38 [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.parent.name == "sshd" and 
39  process.executable != "/usr/sbin/sshd"] by process.parent.pid, process.parent.entity_id
40 [process where host.os.type == "linux" and event.action == "end" and process.name == "sshd" and process.exit_code != 0] by process.pid, process.entity_id
41 [network where host.os.type == "linux" and event.type == "end" and event.action == "disconnect_received" and process.name == "sshd"] by process.pid, process.entity_id
42'''
43
44
45[[rule.threat]]
46framework = "MITRE ATT&CK"
47[[rule.threat.technique]]
48id = "T1543"
49name = "Create or Modify System Process"
50reference = "https://attack.mitre.org/techniques/T1543/"
51
52
53[rule.threat.tactic]
54id = "TA0003"
55name = "Persistence"
56reference = "https://attack.mitre.org/tactics/TA0003/"
57[[rule.threat]]
58framework = "MITRE ATT&CK"
59[[rule.threat.technique]]
60id = "T1556"
61name = "Modify Authentication Process"
62reference = "https://attack.mitre.org/techniques/T1556/"
63
64
65[rule.threat.tactic]
66id = "TA0006"
67name = "Credential Access"
68reference = "https://attack.mitre.org/tactics/TA0006/"
69[[rule.threat]]
70framework = "MITRE ATT&CK"
71[[rule.threat.technique]]
72id = "T1021"
73name = "Remote Services"
74reference = "https://attack.mitre.org/techniques/T1021/"
75[[rule.threat.technique.subtechnique]]
76id = "T1021.004"
77name = "SSH"
78reference = "https://attack.mitre.org/techniques/T1021/004/"
79
80
81[[rule.threat.technique]]
82id = "T1563"
83name = "Remote Service Session Hijacking"
84reference = "https://attack.mitre.org/techniques/T1563/"
85[[rule.threat.technique.subtechnique]]
86id = "T1563.001"
87name = "SSH Hijacking"
88reference = "https://attack.mitre.org/techniques/T1563/001/"
89
90
91
92[rule.threat.tactic]
93id = "TA0008"
94name = "Lateral Movement"
95reference = "https://attack.mitre.org/tactics/TA0008/"