Potential Nologin SSH Backdoor

Source: github.com/elastic/protections-artifacts

This rule identifies instances where the nologin command is executed by the sshd process. This behavior is unusual and may indicate an attempt to manipulate a system user for backdoor access.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564.002` Hide Artifacts: Hidden Users

Rule body

[rule]
description = """
This rule identifies instances where the `nologin` command is executed by the `sshd` process. This behavior is unusual
and may indicate an attempt to manipulate a system user for backdoor access.
"""
id = "3bc8af69-707a-482c-b3c1-06bdb1530b94"
license = "Elastic License v2"
name = "Potential Nologin SSH Backdoor"
os_list = ["linux"]
reference = [
    "https://blog.exatrack.com/Perfctl-using-portainer-and-new-persistences/",
    "https://x.com/RFGroenewoud/status/1875112050218922010",
]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "nologin " and
process.parent.name == "sshd"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.002"
name = "Hidden Users"
reference = "https://attack.mitre.org/techniques/T1564/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

Stages and Predicates

Stage 1: `process`

process where event.type == "start" and event.action == "exec" and process.name == "nologin " and
process.parent.name == "sshd"

Indicators

These rows show field, operator, and value matches.