Potential Credential Access via Ptrace

[rule]
description = """
Identifies potential credential access through ptrace. Attackers may abuse ptrace to inspect sensitive authentication
processes such as sshd, su, or sudo and extract credentials or session material from memory. This rule correlates
process execution with a ptrace request targeting one of these sensitive processes. Such behavior is uncommon by default
and should be investigated.
"""
id = "5243e34d-ce00-4fda-82bb-79f1e4e655ea"
license = "Elastic License v2"
name = "Potential Credential Access via Ptrace"
os_list = ["linux"]
reference = ["https://platformsecurity.com/blog/hawks-prey-snatching-ssh-credentials"]
version = "1.0.2"

query = '''
sequence with maxspan=15s
  [process where event.type == "start" and event.action == "exec" and process.name in (
    "sshd", "ssh",
    "su", "sudo", "sudoedit",
    "passwd", "chsh", "chfn", "newgrp", "gpasswd",
    "login", "agetty", "getty", "unix_chkpwd",
    "pkexec", "polkitd",
    "sssd", "sssd_pam", "sssd_nss",
    "krb5_child", "ldap_child", "nslcd", "winbindd"
  )] by process.pid 
  [process where event.type == "start" and event.action == "ptrace"] by process.Ext.ptrace.child_pid
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.007"
name = "Proc Filesystem"
reference = "https://attack.mitre.org/techniques/T1003/007/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "9.1.4"