Potential Multi Architecture File Downloads

[rule]
description = """
Identifies the execution of curl, wget or ftpg to download payloads named by architecture type in preparation for
execution. This behavior is consistent with Mirai bot deployment shell scripts.
"""
id = "276a5df0-7e20-4218-ade1-3f3ed711d4cb"
license = "Elastic License v2"
name = "Potential Multi Architecture File Downloads"
os_list = ["linux"]
reference = ["https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"]
version = "1.0.24"

query = '''
sequence by process.parent.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget", "ftpg") and
   process.args like~ (
     "http*mipsel", "http*i686", "http*sparc", "http*mips", "http*sh4","http*x86", "http*armv6l", "http*powerpc",
     "http*i586", "http*m68k", "http*armv4l", "http*armv5l", "http*mpsl", "http*arm4", "http*arm5", "http*arm6",
     "http*arm7", "http*ppc"
   )]
  [process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget", "ftpg") and
   process.args like~ (
     "http*mipsel", "http*i686", "http*sparc", "http*mips", "http*sh4","http*x86", "http*armv6l", "http*powerpc",
     "http*i586", "http*m68k", "http*armv4l", "http*armv5l", "http*mpsl", "http*arm4", "http*arm5", "http*arm6",
     "http*arm7", "http*ppc"
   )]
  [process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget", "ftpg") and
   process.args like~ (
     "http*mipsel", "http*i686", "http*sparc", "http*mips", "http*sh4","http*x86", "http*armv6l", "http*powerpc",
     "http*i586", "http*m68k", "http*armv4l", "http*armv5l", "http*mpsl", "http*arm4", "http*arm5", "http*arm6",
     "http*arm7", "http*ppc"
   )]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"