Suspicious Web Server Child Process Execution Detected via Defend for Containers

This rule detects the exploitation of a web server through the execution of a suspicious process by common web server user accounts. Attackers may upload a web shell to a web server to maintain access to the system.

Rule type: eql
Rule indices:

logs-cloud_defend.process*

Rule Severity: medium
Risk Score: 47
Runs every: 5m
Searches indices from: now-6m
Maximum alerts per execution: 100
References:

Tags:

Data Source: Elastic Defend for Containers
Domain: Container
OS: Linux
Use Case: Threat Detection
Tactic: Persistence
Tactic: Execution
Tactic: Command and Control

Version: 1
Rule authors:

Elastic

Rule license: Elastic License v2

Rule Query

		process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.parent.name in (
      "apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "mongrel_rails", "gunicorn",
      "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn",
      "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel", "php-cgi",
      "php-fcgi", "php-cgi.cagefs", "catalina.sh", "hiawatha", "lswsctrl"
  ) or
  process.parent.name like "php-fpm*" or
  user.name in ("apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9") or
  user.id in ("33", "498", "48") or
  (process.parent.name == "java" and process.parent.working_directory like "/u0?/*") or
  process.parent.working_directory like "/var/www/*"
) and (
  (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox")) or
  (process.args in (
    "bash", "/bin/bash", "/usr/bin/bash", "/usr/local/bin/bash",
    "dash", "/bin/dash", "/usr/bin/dash", "/usr/local/bin/dash",
    "sh", "/bin/sh", "/usr/bin/sh", "/usr/local/bin/sh",
    "tcsh", "/bin/tcsh", "/usr/bin/tcsh", "/usr/local/bin/tcsh",
    "csh", "/bin/csh", "/usr/bin/csh", "/usr/local/bin/csh",
    "zsh", "/bin/zsh", "/usr/bin/zsh", "/usr/local/bin/zsh",
    "ksh", "/bin/ksh", "/usr/bin/ksh", "/usr/local/bin/ksh",
    "fish", "/bin/fish", "/usr/bin/fish", "/usr/local/bin/fish",
    "busybox", "/bin/busybox", "/usr/bin/busybox", "/usr/local/bin/busybox"
  ))
) and process.args == "-c" and container.id like "?*"
		
	

Framework: MITRE ATT&CK

Tactic:
- Name: Persistence
- Id: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Server Software Component
- Id: T1505
- Reference URL: https://attack.mitre.org/techniques/T1505/
Sub Technique:
- Name: Web Shell
- Id: T1505.003
- Reference URL: https://attack.mitre.org/techniques/T1505/003/

Framework: MITRE ATT&CK

Tactic:
- Name: Execution
- Id: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Command and Scripting Interpreter
- Id: T1059
- Reference URL: https://attack.mitre.org/techniques/T1059/
Sub Technique:
- Name: Unix Shell
- Id: T1059.004
- Reference URL: https://attack.mitre.org/techniques/T1059/004/

Framework: MITRE ATT&CK

Tactic:
- Name: Command and Control
- Id: TA0011
- Reference URL: https://attack.mitre.org/tactics/TA0011/
Technique:
- Name: Application Layer Protocol
- Id: T1071
- Reference URL: https://attack.mitre.org/techniques/T1071/