Binary Executed from Shared Memory Directory

[rule]
description = """
Identifies the execution of a binary Linux shared memory directories: (/dev/shm/, /run/shm/). This activity is to be
considered highly abnormal and should be investigated. Threat actors have placed executables used for persistence on
high-uptime servers in these directories as system backdoors. Binaries executed from these directories are memory
resident making them harder to detect and allowing them to remain hidden for long periods of time.
"""
id = "78ae5dbd-477b-4ce7-a7f7-8c4b5e228df2"
license = "Elastic License v2"
name = "Binary Executed from Shared Memory Directory"
os_list = ["linux"]
reference = ["https://intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/"]
version = "1.0.11"

query = '''
process where event.type == "start" and event.action == "exec" and process.executable like ("/dev/shm/*", "/run/shm/*") and
not (
   (process.executable like "/dev/shm/gitlab/*" and process.pid == 0) or
   (process.executable like "/dev/shm/ansible-tmp*")
 )
'''

min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.3.0"