Manual Memory Password Searching Activity

[rule]
description = """
This rule detects the use of the 'strings' command to search for passwords in memory. Attackers may leverage this
technique to extract sensitive information from memory. This behavior should not happen by default, and should be
investigated thoroughly.
"""
id = "e3d9bd45-315f-47a6-8675-475e2d3f29ff"
license = "Elastic License v2"
name = "Manual Memory Password Searching Activity"
os_list = ["linux"]
reference = ["https://github.com/controlplaneio/truffleproc", "https://github.com/hajzer/bash-memory-dump"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "strings" and process.args == "/dev/mem"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.007"
name = "Proc Filesystem"
reference = "https://attack.mitre.org/techniques/T1003/007/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"