Potential Process Masquerading via Exec

[rule]
description = """
This rule detects process masquerading through the use of the `exec` command. The `exec` command can be used in
conjunction with the `-a` flag to change the name of the process in the process table. This technique is used by malware
to hide the true identity of a process from security tools and analysts.
"""
id = "e6669bc3-cb75-4fb3-91e0-ddaa06dd59b2"
license = "Elastic License v2"
name = "Potential Process Masquerading via Exec"
os_list = ["linux"]
version = "1.0.20"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args == "-c" and process.command_line : "* exec -a *" and not (
  process.executable like ("/nix/store/*", "/tmp/newroot/*") or
  process.parent.executable in (
    "/opt/warpdotdev/warp-terminal/warp", "/opt/sp/serverpilot/stats/bin/sp-stats", "/bin/bcompare", "/bin/su",
    "/usr/NX/bin/nxnode.bin", "/usr/bin/gnome-shell", "/var/lib/dpkg/info/udev.postinst", "/usr/bin/bcompare", 
    "/usr/bin/su", "/usr/bin/claude-bin"
  ) or
  process.parent.executable like (
    "/home/*/.local/share/claude/*", "/home/*/.local/bin/klaude", "/usr/local/*/claude-bin",
    "/home/*/.claude/remote/ccd-cli/*", "/home/*/.claude/remote/ccd-cli", "/claude-cli/versions/*",
    "/usr/scratch/*/git/*/atl/src/aitools/claude/claude-bin", "/opt/forticlient/epctrl",
    "/root/.claude/remote/ccd-cli/*", "/root/.local/share/claude/versions/*", "/mnt/fast/*/.local/share/claude/versions/*",
    "/opt/warpdotdev/warp-terminal/warp (deleted)", "/opt/local/share/claude/versions/*",
    "/usr/share/cursor/cursor", "/home/*/.grok/downloads/grok*linux-x86_64", "/home/*/.codex/*/bin/codex"
  ) or
  process.parent.args == "claude" or
  process.parent.name == "claude" or
  process.command_line like (
    "*/tmp/fzf-args*", "/opt/sp/serverpilot/*", "*/opt/forticlientems/*", "*WarpTerminal*", "/bin/bash -c exec -a bash*",
    "/bin/bash -c exec -a sp-agent /opt/sp/serverpilot/agent/bin/sp-agent", """bash -c exec -a "$0" "$@" reboot /usr/sbin/reboot.no-molly-guard""",
    "bash -c exec -a auto_upgrade_fcems /opt/forticlientemstmp/upgradeworker_linux_amd64 -config ./goEMS.conf",
    "bash -c exec -a cubin_gpu_pool_worker sleep *", "bash -c exec -a chroma sleep 7200",
    "bash -c exec -a 'oes-mfa-agent' /usr/bin/node* --enable-source-maps /opt/novell/oes-mfa-agent/app/mfa-agent/main",
    "bash -c exec -a auto_upgrade_fcems /opt/forticlientemstmp/emsworkers_linux_amd64 -worker_name=upgrade -config ./goEMS.conf",
    "/bin/bash -c exec -a /usr/bin/heidisql /usr/share/heidisql/heidisql  > /dev/null 2>&1 /usr/bin/heidisql",
    "/usr/bin/bash -c exec -a ems:uninstall /opt/forticlient/epctrl uninstall",
    "bash -c exec -a \"apt-get update\" /var/cache/apt/cdroms.list",
    "/bin/bash -c exec -a nvsm_apis_mosquitto /usr/sbin/mosquitto -c /etc/nvsm/nvsm-mqtt.config",
    "*SNAPSHOT_FILE=/home/*/.claude/shell-snapshots/snapshot*"
  ) or
  process.working_directory in ("/opt/novell/umc/apps/umc-server", "/opt/novell/umc/apps/oes-rest", "/usr/share/epoptes-client") or 
  process.args in (
    "exec -a sp-monitor /opt/sp/serverpilot/monitor/bin/monitor",
    "exec -a sp-stats /opt/sp/serverpilot/stats/bin/sp-stats",
    "/usr/bin/bcompare", "/usr/lib64/beyondcompare/BCompare"
  ) or
  process.parent.command_line == "runc init" or
  process.command_line == """bash -c exec -a "$0" "$@" shutdown /usr/sbin/shutdown.no-molly-guard -r now""" or
  (process.command_line == "bash -c exec -a '[sleep router failover]' sleep 1" and process.parent.command_line == "/bin/bash /init.sh")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"