Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation

Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not the Azure Linux Agent certificate under /var/lib/waagent. Adversaries can scrape WireServer certificates, mint a LinuxTransport identity, and decrypt extension protectedSettings with openssl cms -decrypt or smime -decrypt.

Rule type: eql
Rule indices:

  • logs-endpoint.events.process-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Domain: Cloud
  • OS: Linux
  • Use Case: Threat Detection
  • Platform: Azure
  • Platform: Linux
  • Tactic: Credential Access
  • Tactic: Defense Evasion
  • Data Source: Elastic Defend
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

CyberCX-style WireServer abuse on Linux generates openssl req -x509 -subj /CN=LinuxTransport, posts the public certificate to WireServer comp=certificates, then runs openssl cms -decrypt or openssl smime -decrypt with temp.key, wireserver.key, or another non-waagent key to unwrap protectedSettings.

Benign Azure Linux Agent activity looks like:

openssl cms -inform DER -decrypt -recip /var/lib/waagent/<thumbprint>.crt -inkey /var/lib/waagent/<thumbprint>.prv

The Azure Linux Agent is excluded by certificate path in process arguments (/var/lib/waagent/*) and by parent executables /usr/sbin/waagent and /usr/bin/waagent. This does not exclude Python or run-command-extension as parents because attacker scripts invoked via Run Command use those parents with a non-waagent key. The agent itself also runs openssl req ... /CN=LinuxTransport with output under /var/lib/waagent/; that argument path exclusion covers it.

  • Review process.command_line and process.args for LinuxTransport, wireserver.key, temp.key, payload.p7m, or payload.pfx.
  • Inspect parent and grandparent: Run Command (/var/lib/waagent/run-command/) or an interactive shell is higher risk than a one-off admin session with a ticket.
  • Correlate with network events from curl to 168.63.129.16 ports 80 and 32526 on the same host.
  • Search StorageRead logs for anonymous or SAS GetBlob of the same storage account after the decrypt.
  • Hunt for the generated key files (temp.key, wireserver.key) on disk and in /tmp.
  • The Azure Linux Agent decrypt path under /var/lib/waagent/ and waagent parent executables (/usr/sbin/waagent, /usr/bin/waagent) are excluded.
  • Legitimate certificate tooling that uses -subj /CN=LinuxTransport is unexpected; treat as suspicious until proven otherwise.
  • Isolate the VM, delete attacker-generated keys and decrypted payloads, and rotate secrets that were in protectedSettings (SAS, connection strings, CSE script contents).
  • Rotate the VM managed identity and review extension configuration.
  • Revoke any SAS that was replayed from the decrypted settings.
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start") and process.name == "openssl" and
(
  (
    process.args in ("cms", "smime") and process.args == "-decrypt"
  ) or
  (
    process.args == "req" and process.args : "*LinuxTransport*"
  )
) and
not process.args like "/var/lib/waagent/*" and
not process.parent.executable like (
  "/usr/sbin/waagent",
  "/usr/bin/waagent"
)

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK