IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elastic Security Solution [8.6] ›Detections and alerts ›Prebuilt rule reference
« Suspicious Sysctl File Event Suspicious Termination of ESXI Process »

Suspicious System Commands Executed by Previously Unknown Executableedit

This rule monitors for the execution of several commonly used system commands executed by a previously unknown executable located in commonly abused directories. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to run malicious code. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise.

Rule type: new_terms

Rule indices:

  • logs-endpoint.events.*
  • endgame-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • Domain: Endpoint
  • OS: Linux
  • Use Case: Threat Detection
  • Tactic: Execution
  • Data Source: Elastic Endgame

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule queryedit

host.os.type : "linux" and event.category : "process" and
event.action : ("exec" or "exec_event" or "fork" or "fork_event") and
process.executable : (
  /bin/* or /usr/bin/* or /usr/share/* or /tmp/* or /var/tmp/* or /dev/shm/* or
  /etc/init.d/* or /etc/rc*.d/* or /etc/crontab or /etc/cron.*/* or /etc/update-motd.d/* or
  /usr/lib/update-notifier/* or /home/*/.* or /boot/* or /srv/* or /run/*
  ) and process.args : (
  "whoami" or "id" or "hostname" or "uptime" or "top" or "ifconfig" or "netstat" or "route" or
  "ps" or "pwd" or "ls"
  ) and not process.name : (
  "sudo" or "which" or "whoami" or "id" or "hostname" or "uptime" or "top" or "netstat" or "ps" or
  "pwd" or "ls" or "apt" or "dpkg" or "yum" or "rpm" or "dnf" or "dockerd" or "snapd" or "snap"
  )

Framework: MITRE ATT&CKTM

« Suspicious Sysctl File Event Suspicious Termination of ESXI Process »