Suspicious Linux Process Connection to Bulletproof Hosting ASN

This rule detects outbound connection attempts from unusual Linux process locations or common living-off-the-land utilities to autonomous systems associated with bulletproof or high-abuse hosting. Adversaries often stage payloads in world-writable or web directories and beacon to infrastructure that ignores abuse reports, including providers such as Storm Industries, Ecatel/IP Volume, Aeza, and Proton66.

Rule type: eql
Rule indices:

  • logs-endpoint.events.network*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Domain: Network
  • OS: Linux
  • Platform: Linux
  • Rule Type: Event Correlation (EQL)
  • Use Case: Threat Detection
  • Tactic: Command and Control
  • Tactic: Execution
  • Data Source: Elastic Defend
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires data coming in from Elastic Defend.

Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

  • Fleet is required for Elastic Defend.
  • To configure Fleet Server refer to the documentation.
  • Go to the Kibana home page and click "Add integrations".
  • In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
  • Click "Add Elastic Defend".
  • Configure the integration name and optionally add a description.
  • Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
  • Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. Helper guide.
  • We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
  • Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the helper guide.
  • Click "Save and Continue".
  • To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the helper guide.

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

This rule flags a Linux process that initiates an outbound connection to an ASN commonly associated with bulletproof or high-abuse hosting. The process is either running from an unusual location such as /tmp, /dev/shm, a web directory, or memfd, or it is a downloader, shell, or interpreter frequently abused to fetch and launch follow-on payloads. A typical pattern is a dropped ELF in /tmp or a webshell-spawned curl/wget/python process beaconing to providers such as Storm Industries, Ecatel/IP Volume, Aeza, or Proton66.

ASN enrichment is applied at ingest. Confirm destination.as.number and destination.as.organization.name on the source event, because the endpoint agent does not populate these fields natively.

  • Review the process executable path, name, command line, parent lineage, user, and working directory to determine whether the connection came from a dropped binary, a webshell, or an expected administrative tool.
  • Enrich the destination IP with ASN, organization, reputation, passive DNS, and related hosts that contacted the same address or ASN around the same time.
  • Correlate nearby file, process, and DNS activity on the same host.id and process.entity_id for payload writes, chmod/exec of the same path, interpreter downloads, or additional beacons.
  • Check whether the destination was reached by raw IP with no preceding DNS lookup, which is common for malware command-and-control.
  • Scope the same process hash, destination IP, and ASN across the environment, and review web server, SSH, and privilege-escalation telemetry if the parent is a web process or an unusual interactive shell.
  • An administrator or automation job may use curl, wget, python, or a shell to retrieve packages or updates from a VPS that happens to sit in a high-abuse ASN such as HOSTKEY, Aeza, or FlokiNET; confirm the parent process, change record, and destination ownership.
  • Software installers, self-extracting packages, or development builds running from /tmp can make outbound connections during setup; verify the binary path, publisher, and whether the destination is expected for that installer.
  • Privacy-oriented or Tor-related tooling hosted on FlokiNET or similar providers can trigger this rule; validate that the process and destination match an approved use case.
  • Isolate the affected Linux host from the network except for approved management access, terminate the suspicious process tree, and block the destination IP, domain, and ASN at DNS, proxy, and firewall layers where policy allows.
  • Preserve the executable, command line, destination IP, ASN, and related files under /tmp, /var/tmp, /dev/shm, web directories, and memfd for forensic review.
  • Remove attacker footholds including dropped binaries, webshells, cron or systemd persistence, and unauthorized SSH keys, then rotate credentials exposed on the host.
  • Rebuild or restore the host from a known-good image if a malicious payload executed, and hunt for the same hash, destination, or ASN on other systems.
  • Escalate to incident response if the process ran as root, the same infrastructure appears on multiple hosts, or you observe follow-on payload execution, credential access, or lateral movement.
network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and
(
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "*/www/html/*",
    "/lost+found/*", "/var/mail/*", "/var/www/*", "/mnt/*", "/media/*", "/proc/*/fd/*", "?memfd:*", "memfd:*",
    "*/wp-content/*", "*/wp-includes/*", "*/wp-admin/*"
  ) or
  process.name in (
    "curl", "wget", "ftp", "tftp", "scp", "rsync", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
    "busybox", "timeout", "env", "bun"
  ) or
  process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node*", "deno*")
) and
destination.as.number in (
  // Storm Industries / StormCloud / Pfcloud / OMEGATECH
  202412, 214472, 219502, 51396,
  // Ecatel / IP Volume / Novogara / SpectraIP
  48090, 56611, 57717, 62068, 202425, 202769, 204655,
  // 4Vendeta / Tamatiya
  200391, 204428, 207812,
  // KoDDoS / Amarutu
  206264,
  // 1337 Services (rdp.sh)
  210558,
  // TEAM-HOST
  202984,
  // HOSTKEY (frequently abused for malware C2)
  50867, 57043,
  // Proton66 / Prospero
  198953, 200593,
  // Aeza / Hypercore (OFAC)
  210644, 211522, 215552, 216246,
  // Stark / PQ.Hosting / WorkTitans / MIRhosting / UFO Hosting
  33993, 44477, 52000, 209847,
  // Zservers / XHost
  213010, 213194, 61336, 216071,
  // Media Land (OFAC)
  48721, 206728, 211409, 215311,
  // ELITETEAM / 1337TEAM
  39770, 51381, 56873, 60424,
  // aurologic downstream BPH brands
  209800, 210281, 213887, 214351, 214940, 214943, 215789, 216309,
  // QWINS, GCSAS, Cloudzy, HostSlick, AlexHost, FlokiNET, PINSPB
  14956, 44050, 200019, 200651, 208046, 213702, 215540,
  // FUNNULL / CTG Server
  152194,
  // First Server Limited
  50113, 204997, 205090,
  // CrazyRDP / Delis
  211252, 394711,
  // BtHoster / BTCloud
  213388, 213790, 214295,
  // SHANGXING
  400619
)

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK