Potential Reverse Shell Activity via Terminal

[rule]
description = "Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity."
id = "d0e45f6c-1f83-4d97-a8d9-c8f9eb61c15c"
license = "Elastic License v2"
name = "Potential Reverse Shell Activity via Terminal"
os_list = ["macos"]
reference = [
    "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md",
    "https://github.com/WangYihang/Reverse-Shell-Manager",
    "https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
]
version = "1.0.47"

query = '''
process where event.action == "exec" and process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
process.command_line like~ ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and 
process.parent.executable != null and 
not (
  process.parent.name == "timeout" or
  process.command_line like~ (
    "*/dev/tcp/sirh_db/*", "*/dev/tcp/itom-vault/8200*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*",
    "*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*", "*/dev/tcp/::1/*", "*/dev/tcp/livelog.default.svc.cluster.local*",
    "*/dev/tcp/db.default.svc.cluster.local*", "*/dev/tcp/127.*", "*/dev/udp/127.*", "*/dev/tcp/localhost/*",
    "*/dev/tcp/splunk*telconet.net/*",
    "bash -c timeout 2 bash -c 'echo > /dev/tcp/kafka*' 2>/dev/null && echo 'Connected' || echo 'Failed'", 
    "*/dev/tcp/*echo*", "*.claude/shell-snapshots/*echo*"
  ) or
  process.parent.command_line in ("runc init", "/usr/bin/python /opt/oracle/dcs/exacd_netchk/exacd_netchk.py") or
  process.parent.args in ("/usr/local/bin/runc", "/opt/bitnami/scripts/keycloak/setup.sh", "/usr/bin/testssl.sh") or
  process.working_directory == "/opt/rapid7/ir_agent/components/endpoint_broker/common" or
  process.parent.executable like (
    "/opt/cdf/data/containerd/*", "/usr/bin/consul", "/usr/sbin/sshd", "/usr/bin/runc", "/usr/share/cursor/cursor", 
    "/home/*/.nvm/versions/node/*/bin/node", "/home/*/t38-k8s/*/k8sts", "/home/*/.opencode/bin/opencode",
    "/usr/bin/gnome-shell", "/usr/bin/coreutils", "/home/*/.local/bin/kiro-cli-chat",
    "/opt/Tychon/Endpoint/bin/TychonCoreService", "/usr/local/bin/teleport", "/opt/teleport/system/bin/teleport",
    "/usr/bin/claude-bin", "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode",
    "/home/*/.local/share/claude/versions/*", "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl",
    "/opt/homebrew/Cellar/coreutils/*/bin/gtimeout", "/usr/local/Cellar/coreutils/*/bin/gtimeout"
  ) or
  (process.parent.name == "sudo" and process.parent.command_line like "*teleport-installer*") or
  (
    process.args like "/dev/tcp/nomzk-client-svc/*" and
    process.executable like "/opt/cdf/data/containerd/state/io.containerd.runtime.v2.task/k8s.io/*/rootfs/usr/bin/bash"
  ) or
  (process.args like "-l source*/tmp/claude*" and process.parent.name == "node") or
  (process.working_directory == "/opt/Tychon/Endpoint/bin" and process.parent.command_line == "/usr/bin/bash -s") or
  (process.command_line like "*claude*" and process.parent.command_line == "claude")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"