User Session File Deletion

[rule]
description = """
Detects the deletion of user session files on Linux systems. These files are used to store user session information.
Unauthorized deletion of these files can be an indicator of an attacker attempting to hide their session from common
tooling such as "w".
"""
id = "7a06d6d6-45e7-4ec2-a39e-bfd6b5d9157a"
license = "Elastic License v2"
name = "User Session File Deletion"
os_list = ["linux"]
version = "1.0.4"

query = '''
file where event.type == "deletion" and file.path like ("/run/systemd/sessions/*", "/var/run/systemd/sessions/*") and
process.executable != null and
not (
  process.executable in (
    "/usr/lib/systemd/systemd-logind", "/usr/lib/systemd/systemd-logind (deleted)", "/usr/libexec/elogind/elogind", 
    "/lib/systemd/systemd-logind", "/lib/systemd/systemd-logind (deleted)", "/lib/systemd/systemd",
    "/usr/lib/systemd/systemd", "/sbin/ebtables-restore", "/usr/sbin/nft", "/usr/bin/systemctl", "/bin/lxc-info",
    "/usr/bin/dpkg", "/usr/bin/smbclient", "/usr/bin/gpg-agent", "/sbin/vgs", "/usr/sbin/ebtables", "/usr/bin/gpgconf",
    "/usr/lib/elogind/elogind", "/usr/lib/elogind/elogind (deleted)"
  ) or
  process.executable like (
    "/nix/store/*/lib/systemd/systemd-logind", "/usr/lib/systemd/systemd-logind*",
    "/var/lib/containers/storage/overlay/*/merged/usr/lib/systemd/systemd-logind",
    "/zpool/*/usr/lib/systemd/systemd-logind (deleted)", "/zpool/*/usr/lib/systemd/systemd-logind"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"