Multi-Value Secret Searching via Grep

[rule]
description = """
Identifies the execution of the grep, egrep, fgrep or pgrep commands with a multi-value search pattern to collect
sensitive information. This is a common technique used by attackers to collect sensitive information from the system.
"""
id = "2d00bedd-28aa-4a54-a1e0-92fa00765540"
license = "Elastic License v2"
name = "Multi-Value Secret Searching via Grep"
os_list = ["linux"]
reference = [
    "https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential-harvester",
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.4"

query = '''
sequence by process.parent.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
  process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
  process.command_line like~ (
    "*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
    "*|conf*", "*conf|*", "*|cnf*", "*cnf|*",  "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
    "*|auth*", "*auth|*", "*|passwd*",  "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
    "*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
  ) and
  not (process.parent.args like ("/var/tmp/rpm-tmp*", "/usr/openv/netbackup/bin/private/nb_init_cfg") and process.command_line like "*/tmp/NBInstallAnswer.conf")] as event0
  [process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
  not startswith~(process.command_line, event0.process.command_line) and
  process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
  process.command_line like~ (
    "*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
    "*|conf*", "*conf|*", "*|cnf*", "*cnf|*",  "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
    "*|auth*", "*auth|*", "*|passwd*",  "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
    "*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
  )] as event1
  [process where event.type == "start" and event.action == "exec" and process.name in ("grep", "egrep", "fgrep", "pgrep") and
  not startswith~(process.command_line, event1.process.command_line) and
  process.command_line regex~ """.*\([a-z]{1,15}\|[a-z]{1,15}.*\).*""" and
  process.command_line like~ (
    "*|pem*", "*pem|*", "*|key*", "*key|*", "*|cred*", "*cred|*", "*|db*", "*db|*", "*|sqlite*", "*sqlite|*", "*|ssh*", "*ssh|*",
    "*|conf*", "*conf|*", "*|cnf*", "*cnf|*",  "*|ini*", "*ini|*", "*|secret*", "*secret|*", "*|token*", "*token|*",
    "*|auth*", "*auth|*", "*|passwd*",  "*passwd|*", "*|shadow*", "*shadow|*", "*|env*", "*env|*", "*|database*", "*database|*",
    "*|mysql*", "*mysql|*", "*|postgres*", "*postgres|*", "*|mongo*", "*mongo|*", "*|redis*", "*redis|*", "*|vault*", "*vault|*"
  )]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[threat.technique]]
id = "T1083"
name = "File and Directory Discovery"
reference = "https://attack.mitre.org/techniques/T1083/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"
[[threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"


[[threat.technique]]
id = "T1119"
name = "Automated Collection"
reference = "https://attack.mitre.org/techniques/T1119/"


[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.4.0"