Potential User Authentication Prompt Phishing

[rule]
description = """
Identifies attempts to coerce the victim to enter their credentials via spawning a browser child process from an unusual
parent process pointing to a URL that resembles a legitimate authentication prompt.
"""
id = "7a3b422a-9223-4c6e-8545-d6eac3c2b7d8"
license = "Elastic License v2"
name = "Potential User Authentication Prompt Phishing"
os_list = ["linux"]
reference = ["https://www.wiz.io/blog/threat-actors-target-crypto-orgs"]
version = "1.0.2"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in (
  "zenity", "kdialog", "yad",
  "ssh-askpass", "ssh-askpass-gnome", "gnome-ssh-askpass",
  "ksshaskpass", "lxqt-openssh-askpass",
  "pinentry", "pinentry-gnome3", "pinentry-gtk-2", "pinentry-qt"
) and
process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*", "/root/*") and
process.command_line like~ (
  "*password*", "*passwd*", "*credential*", "*login*", "*authentication*", "*sudo*", "*ssh*", "*wallet*", "*keyring*",
  "*token*", "*2fa*", "*mfa*", "*pin*", "*secret*"
) and not (
  (
    process.name in ("pinentry", "pinentry-gnome3", "pinentry-gtk-2", "pinentry-qt") and
    process.args == "pinentry"
  ) or
  (
    process.name in ("ssh-askpass", "ssh-askpass-gnome", "gnome-ssh-askpass", "ksshaskpass", "lxqt-openssh-askpass") and
    process.parent.executable in ("/tmp/newroot/usr/bin/ssh-agent", "/tmp/newroot/usr/lib/git-core/git-remote-https", "/tmp/newroot/usr/bin/ssh")
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.002"
name = "GUI Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/002/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"