Execution of Memory File Descriptor via Interactive Session

[rule]
description = """
Detects when a file descriptor in the proc (temporary) file system is executed via an interactive session. This activity
indicates an active attempt to execute an in-memory file and should be considered highly abnormal or suspicious. This
activity can occur when the memfd syscall is utilized to create a memory resident file, like a payload, and then execute
it via command and control.
"""
id = "fbc224a0-5469-4c0c-953d-fc57e0293197"
license = "Elastic License v2"
name = "Execution of Memory File Descriptor via Interactive Session"
os_list = ["linux"]
reference = [
    "https://github.com/MythicAgents/merlin/blob/main/Payload_Type/merlin/container/commands/memfd.go",
    "https://x-c3ll.github.io/posts/fileless-memfd_create/",
]
version = "1.0.22"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.executable regex """/proc/(self|[0-9]{1,7})/fd/[0-9]{1,7}""" and process.interactive == true and
not (
  process.command_line in ("runc init", "/var/gdn/assets/linux/bin/runc init", "/usr/sbin/pfman", "lxc-attach -n rdsd.lv") or
  process.args == "datadog-ipc-helper" or
  process.parent.command_line == "/sbin/init" or
  process.parent.executable in (
    "/usr/sbin/runc", "/usr/libexec/snapd/snap-confine", "/var/lib/snapd/snap/bin/direnv", "/usr/lib/systemd/systemd",
    "/usr/bin/runc", "/usr/bin/login", "/usr/bin/nvidia-cdi-hook", "/usr/bin/buildkit-runc", "/usr/bin/nordlayer",
    "/usr/sbin/nordlayer", "/usr/libexec/nordlayer/nordlayer-setcap", "/sbin/apk", "/opt/sophos-spl/plugins/runtimedetections/bin/runtimedetections"
  ) or
  process.parent.executable like (
    "/proc/self/fd/*/*", "/home/*/.local/share/JetBrains/Toolbox/apps/rider/bin/rider", "/usr/bin/tini",
    "/home/*/.codex/*/codex-linux-sandbox"
  ) or
  (process.parent.name == "init" and process.args == "/usr/lib/systemd/systemd-executor") or
  (process.parent.name like "python*" and process.args == "-m" and process.args == "test.regrtest" and process.args == "--pgo")
)
'''

min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.3.0"