Multi-Value Secret Searching via Find

[rule]
description = """
Identifies the execution of the find command with a multi-value search pattern to collect sensitive information. This is
a common technique used by attackers to collect sensitive information from the system.
"""
id = "18405ccf-5443-4577-8b25-629aac642002"
license = "Elastic License v2"
name = "Multi-Value Secret Searching via Find"
os_list = ["linux"]
reference = [
    "https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential-harvester",
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.1"

query = '''
sequence by process.parent.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and process.name == "find" and 
  process.args == "-type" and process.args == "f" and process.command_line like~ (
    "*password*", "*passwd*", "*pwd*", "*secret*", "*token*", "*apikey*", "*api.key*", "*access_key*",
    "*private_key*", "*client_secret*", "*credential*", "*auth*", "*bearer*",
    "*begin private*", "*begin openssh private*", "*begin rsa private*", "*begin dsa private*", "*begin ec private*",
    "*id_rsa*", "*id_dsa*", "*id_ecdsa*", "*id_ed25519*", "*ssh-rsa*", "*ghp_*", "*github_pat*", "*xoxb-*",
    "*hooks.slack.com*", "*discord.com/api/webhooks*", "*/.aws/*", "*/.env *", "*/.azure/*",
    "*azure_client_id*", "*azure_tenant_id*", "*azure_client_secret*", "*azure_federated_token_file*",
    "*identity_endpoint*", "*identity_header*", "*msi_endpoint*", "*msi_secret*", "*/var/run/secrets/azure/*",
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*", "*client_email*",
    "*/var/run/secrets/google/*", "*google_application_credentials*", "*/run/secrets/kubernetes.io/serviceaccount/*"
  ) and process.parent.executable != null and
  not (
    (process.args == "-L" and process.args == "-xdev") or
    process.parent.args like (
      "/etc/cron.daily/plesk-rrd-cleaner", "/war-deployment/ops.servers/backup.sh", "/home/*/tools/unyo/mulpay_deletelog.sh",
      "/usr/local/psa/admin/sbin/spamtrain", "plz-out/bin/pipeline/authn/authn.bin.sh", "/usr/bin/makepkg"
    ) or
    process.command_line in (
      "find /etc/zerum-stacks/lynx/wdr_proxy/.htpasswd -type f",
      "find /run/credentials/getty@tty4.service -xdev -type f ( -perm -0002 -a ! -perm -1000 )",
      "find /run/credentials/getty@tty3.service -xdev -type f ( -perm -0002 -a ! -perm -1000 )",
      "find /run/snapd/ns/authd-msentraid.mnt -xdev -type f -perm -002 -exec chmod o-w {} ;"
    ) or
    process.command_line like "find /var/tmp/portage/*" or
    process.parent.executable in ("/usr/bin/make", "/usr/bin/sw-engine", "/usr/local/bin/build_rpm") or
    process.working_directory like (
      "/opt/rapid7/ir_agent/components/endpoint_broker/common", "/__w/Modular-Teepee/Modular-Teepee",
      "/build*", "/opt/netconfs/home/*", "/tmp/plz_sandbox"
    ) or
    process.args like (
      "/run/credentials/systemd-*.service", "/var/lib/sannav/docker/containers/*/mounts/secrets", "/snap/authd-msentraid/*",
      "/home/*/.cache/yay/1password/pkg/1password/*", "/var/tmp/dracut.*/initramfs"
    ) or
    (process.parent.name == "bash" and process.parent.command_line like "*XDG_CONFIG_HOME*" and process.working_directory == "/tmp/plz_sandbox")
  )] as event0
  [process where event.type == "start" and event.action == "exec" and process.name == "find" and 
  not startswith~(process.command_line, event0.process.command_line) and
  process.args == "-type" and process.args == "f" and process.command_line like~ (
    "*password*", "*passwd*", "*pwd*", "*secret*", "*token*", "*apikey*", "*api.key*", "*access_key*",
    "*private_key*", "*client_secret*", "*credential*", "*auth*", "*bearer*",
    "*begin private*", "*begin openssh private*", "*begin rsa private*", "*begin dsa private*", "*begin ec private*",
    "*id_rsa*", "*id_dsa*", "*id_ecdsa*", "*id_ed25519*", "*ssh-rsa*", "*ghp_*", "*github_pat*", "*xoxb-*",
    "*hooks.slack.com*", "*discord.com/api/webhooks*", "*/.aws/*", "*/.env *", "*/.azure/*",
    "*azure_client_id*", "*azure_tenant_id*", "*azure_client_secret*", "*azure_federated_token_file*",
    "*identity_endpoint*", "*identity_header*", "*msi_endpoint*", "*msi_secret*", "*/var/run/secrets/azure/*",
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*", "*client_email*",
    "*/var/run/secrets/google/*", "*google_application_credentials*", "*/run/secrets/kubernetes.io/serviceaccount/*"
  )] as event1
  [process where event.type == "start" and event.action == "exec" and process.name == "find" and
  not startswith~(process.command_line, event1.process.command_line) and
  process.args == "-type" and process.args == "f" and process.command_line like~ (
    "*password*", "*passwd*", "*pwd*", "*secret*", "*token*", "*apikey*", "*api.key*", "*access_key*",
    "*private_key*", "*client_secret*", "*credential*", "*auth*", "*bearer*",
    "*begin private*", "*begin openssh private*", "*begin rsa private*", "*begin dsa private*", "*begin ec private*",
    "*id_rsa*", "*id_dsa*", "*id_ecdsa*", "*id_ed25519*", "*ssh-rsa*", "*ghp_*", "*github_pat*", "*xoxb-*",
    "*hooks.slack.com*", "*discord.com/api/webhooks*", "*/.aws/*", "*/.env *", "*/.azure/*",
    "*azure_client_id*", "*azure_tenant_id*", "*azure_client_secret*", "*azure_federated_token_file*",
    "*identity_endpoint*", "*identity_header*", "*msi_endpoint*", "*msi_secret*", "*/var/run/secrets/azure/*",
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*", "*client_email*",
    "*/var/run/secrets/google/*", "*google_application_credentials*", "*/run/secrets/kubernetes.io/serviceaccount/*"
  )]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[threat.technique]]
id = "T1083"
name = "File and Directory Discovery"
reference = "https://attack.mitre.org/techniques/T1083/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"
[[threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"


[[threat.technique]]
id = "T1119"
name = "Automated Collection"
reference = "https://attack.mitre.org/techniques/T1119/"


[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.4.0"