Chattr Execution from Unusual Parent

[rule]
description = """
This rule detects the execution of the "chattr" command from an unusual parent process. The "chattr" command is used to
change file attributes, and is often used by attackers to hide files or directories or mark them as immutable and/or
undeletable.
"""
id = "3f3e9299-1a05-4922-aef2-6d855a07f8ef"
license = "Elastic License v2"
name = "Chattr Execution from Unusual Parent"
os_list = ["linux"]
reference = [
    "https://www.trendmicro.com/en_nl/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html",
]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "chattr" and 
process.executable like ("/bin/chattr", "/usr/bin/chattr", "/usr/local/bin/chattr") and
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*") or process.parent.name like ".*") and
process.args like~ ("-*i*", "+*i*", "+*u*", "-*u*") and not (
  process.parent.name == "." or
  process.parent.executable like (
    "./scannerYaraALFA*", "/tmp/newroot/lib/systemd/systemd", "./ldap2sshkeys", "/tmp/newroot/var/lib/docker/rootfs/overlayfs/*/entrypoint.sh",
    "/tmp/newroot/opt/omnissa/*/bin/ws1HubUtil"
  ) or
  process.parent.executable in ("/tmp/newroot/usr/bin/sudo", "/tmp/newroot/usr/bin/zsh") or
  process.parent.args like "/root/.ansible/tmp/ansible-tmp-*/AnsiballZ_file.py"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"
[[threat.technique.subtechnique]]
id = "T1222.002"
name = "Linux and Mac File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"