Unusual Linux Process Calling the Metadata Service
Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/09/22"
3integration = ["auditd_manager", "endpoint"]
4maturity = "production"
5updated_date = "2023/07/27"
6min_stack_comments = "New fields added: required_fields, related_integrations, setup"
7min_stack_version = "8.3.0"
8
9[rule]
10anomaly_threshold = 50
11author = ["Elastic"]
12description = """
13Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order
14to harvest credentials or user data scripts containing secrets.
15"""
16false_positives = [
17 """
18 A newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this
19 detection rule.
20 """,
21]
22from = "now-45m"
23interval = "15m"
24license = "Elastic License v2"
25machine_learning_job_id = ["v3_linux_rare_metadata_process"]
26name = "Unusual Linux Process Calling the Metadata Service"
27risk_score = 21
28rule_id = "9d302377-d226-4e12-b54c-1906b5aec4f6"
29severity = "low"
30tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Rule Type: ML", "Rule Type: Machine Learning", "Tactic: Credential Access"]
31type = "machine_learning"
32
33[[rule.threat]]
34framework = "MITRE ATT&CK"
35[[rule.threat.technique]]
36id = "T1552"
37name = "Unsecured Credentials"
38reference = "https://attack.mitre.org/techniques/T1552/"
39
40 [[rule.threat.technique.subtechnique]]
41 id = "T1552.005"
42 name = "Cloud Instance Metadata API"
43 reference = "https://attack.mitre.org/techniques/T1552/005/"
44
45
46[rule.threat.tactic]
47id = "TA0006"
48name = "Credential Access"
49reference = "https://attack.mitre.org/tactics/TA0006/"
Related rules
- Unusual Linux User Calling the Metadata Service
- Anomalous Linux Compiler Activity
- Anomalous Process For a Linux Population
- Unusual Linux Network Activity
- Unusual Linux Network Configuration Discovery