Namespace Manipulation Using Unshare

 1[metadata]
 2creation_date = "2022/08/30"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges
13or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the
14host and access other resources or escalate privileges.
15"""
16from = "now-9m"
17index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"]
18language = "eql"
19license = "Elastic License v2"
20name = "Namespace Manipulation Using Unshare"
21references = [
22    "https://man7.org/linux/man-pages/man1/unshare.1.html",
23    "https://www.crowdstrike.com/blog/cve-2022-0185-kubernetes-container-escape-using-linux-kernel-exploit/",
24]
25risk_score = 47
26rule_id = "d00f33e7-b57d-4023-9952-2db91b1767c4"
27severity = "medium"
28tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
29timestamp_override = "event.ingested"
30type = "eql"
31
32query = '''
33process where host.os.type == "linux" and event.type == "start" and event.action : ("exec", "exec_event") and
34process.executable: "/usr/bin/unshare" and
35not process.parent.executable: ("/usr/bin/udevadm", "*/lib/systemd/systemd-udevd", "/usr/bin/unshare") and
36not process.args : "/usr/bin/snap"
37'''
38
39
40[[rule.threat]]
41framework = "MITRE ATT&CK"
42[[rule.threat.technique]]
43id = "T1543"
44name = "Create or Modify System Process"
45reference = "https://attack.mitre.org/techniques/T1543/"
46
47
48[rule.threat.tactic]
49id = "TA0004"
50name = "Privilege Escalation"
51reference = "https://attack.mitre.org/tactics/TA0004/"