IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Suspicious Sysctl File Event Suspicious Termination of ESXI Process »
Elastic Docs ›Elastic Security Solution [8.6] ›Detections and alerts ›Prebuilt rule reference

Suspicious System Commands Executed by Previously Unknown Executable

edit

Suspicious System Commands Executed by Previously Unknown Executable

edit

This rule monitors for the execution of several commonly used system commands executed by a previously unknown executable located in commonly abused directories. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to run malicious code. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise.

Rule type: new_terms

Rule indices:

  • logs-endpoint.events.*
  • endgame-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • Domain: Endpoint
  • OS: Linux
  • Use Case: Threat Detection
  • Tactic: Execution
  • Data Source: Elastic Endgame

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
host.os.type : "linux" and event.category : "process" and
event.action : ("exec" or "exec_event" or "fork" or "fork_event") and
process.executable : (
  /bin/* or /usr/bin/* or /usr/share/* or /tmp/* or /var/tmp/* or /dev/shm/* or
  /etc/init.d/* or /etc/rc*.d/* or /etc/crontab or /etc/cron.*/* or /etc/update-motd.d/* or
  /usr/lib/update-notifier/* or /home/*/.* or /boot/* or /srv/* or /run/*
  ) and process.args : (
  "whoami" or "id" or "hostname" or "uptime" or "top" or "ifconfig" or "netstat" or "route" or
  "ps" or "pwd" or "ls"
  ) and not process.name : (
  "sudo" or "which" or "whoami" or "id" or "hostname" or "uptime" or "top" or "netstat" or "ps" or
  "pwd" or "ls" or "apt" or "dpkg" or "yum" or "rpm" or "dnf" or "dockerd" or "snapd" or "snap"
  )

Framework: MITRE ATT&CKTM

« Suspicious Sysctl File Event Suspicious Termination of ESXI Process »