Potential VSingle Malware Infection

[rule]
description = """
Identifies the execution traces of the Vsingle malware. Vsingle is a Linux trojan that attempts to retrieve C2 servers
information from GitHub.
"""
id = "fa59e598-8adc-4798-af82-9f878934d975"
license = "Elastic License v2"
name = "Potential VSingle Malware Infection"
os_list = ["linux"]
reference = [
    "https://blogs.jpcert.or.jp/en/2021/03/Lazarus_malware3.html",
    "https://blogs.jpcert.or.jp/en/2022/07/vsingle.html",
]
version = "1.0.25"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("wget", "curl") and
process.args like~ ("https://*.php?uid=*&jsid=*", "https://*.php?uid=*&upw=*" ,"*/tmp/.sess_*", "*HTTP/{print $2}*")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"