Suspicious Network Connection Attempt by Root

Identifies an outbound network connection attempt followed by a session id change as the root user by the same process entity. This particular instantiation of a network connection is abnormal and should be investigated as it may indicate a potential reverse shell activity via a privileged process.

Rule type: eql
Rule indices:

• logs-endpoint.events.*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

• https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/
• https://twitter.com/GossiTheDog/status/1522964028284411907
• https://exatrack.com/public/Tricephalic_Hellkeeper.pdf

Tags:

• Domain: Endpoint
• OS: Linux
• Use Case: Threat Detection
• Tactic: Command and Control

Version: 104
Rule authors:

• Elastic

Rule license: Elastic License v2

Detection alerts from this rule indicate a strange or abnormal outbound connection attempt by a privileged process. Here are some possible avenues of investigation:

• Examine unusual and active sessions using commands such as 'last -a', 'netstat -a', and 'w -a'.
• Analyze processes and command line arguments to detect anomalous process execution that may be acting as a listener.
• Analyze anomalies in the use of files that do not normally initiate connections.
• Examine processes utilizing the network that do not normally have network communication.

sequence by process.entity_id with maxspan=1m
[network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and user.id == "0" and
    not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd","/usr/bin/ssh","/usr/bin/sshpass")]
[process where host.os.type == "linux" and event.action == "session_id_change" and user.id == "0" and
    not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd","/usr/bin/ssh","/usr/bin/sshpass")]
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Command and Control
  • Id: TA0011
  • Reference URL: https://attack.mitre.org/tactics/TA0011/

• Technique:

  • Name: Non-Application Layer Protocol
  • Id: T1095
  • Reference URL: https://attack.mitre.org/techniques/T1095/

Framework: MITRE ATT&CK

• Tactic:

  • Name: Privilege Escalation
  • Id: TA0004
  • Reference URL: https://attack.mitre.org/tactics/TA0004/

• Technique:

  • Name: Abuse Elevation Control Mechanism
  • Id: T1548
  • Reference URL: https://attack.mitre.org/techniques/T1548/

• Sub Technique:

  • Name: Sudo and Sudo Caching
  • Id: T1548.003
  • Reference URL: https://attack.mitre.org/techniques/T1548/003/