Runuser Executed via Suspicious Parent

[rule]
description = """
Identifies the execution of the runuser command via a suspicious parent process. This may be used by malicious actors to
gain access to a user's account without requiring the user to enter their password, after collecting the user's
password, potentially via a social engineering attack.
"""
id = "5e30b945-8059-4086-979e-e440c5304174"
license = "Elastic License v2"
name = "Runuser Executed via Suspicious Parent"
os_list = ["linux"]
reference = ["https://www.wiz.io/blog/threat-actors-target-crypto-orgs"]
version = "1.0.2"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "runuser" and
process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*", "/root/*") and
not (
  process.parent.executable like (
    "/home/*/.local/share/uv/python/cpython-*-linux-x86_64-gnu/bin/python3*", "/tmp/newroot/var/lib/dpkg/info/*.postinst",
    "/root/.codex/packages/standalone/releases/*-x86_64-unknown-linux-musl/bin/codex", "/tmp/newroot/usr/sbin/akmods",
    "/root/.gxsetup/cvpkgadd/install"
  ) or
  process.parent.command_line == "/bin/bash /root/startup.sh"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.002"
name = "GUI Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/002/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"