Recently Downloaded File Made Executable and Run

[rule]
description = """
This rule detects a sequence of events where a network connection is initiated to download a file to a world-writeable
directory, followed by the execution of a chmod or chown command, and then another process execution. This pattern may
indicate an attacker attempting to download a payload, modify its permissions to make it executable, and then execute
it.
"""
id = "d67ef864-5567-4675-b2eb-7dfd4443e8af"
license = "Elastic License v2"
name = "Recently Downloaded File Made Executable and Run"
os_list = ["linux"]
version = "1.0.7"

query = '''
sequence by process.parent.entity_id with maxspan=10s
  [file where event.type == "creation" and process.name in ("wget", "curl") and
   file.path like ("/tmp/*", "/var/tmp/*", "/dev/shm/*")] as event0
  [process where event.type == "start" and event.action == "exec" and process.name == "chmod" and
   process.command_line like~ (
     /* symbolic exec */
     "*+x*", "*+X*", "*=x*", "*=*x*",
     /* setuid/setgid & copy-perms */
     "*u+s*", "*g+s*", "*u=s*", "*g=s*", "*g=u*", "*o=u*",
     /* numeric: 3-digit forms where any position is 1/3/5/7 */
     "*7??*", "*?7?*", "*??7*",
     "*5??*", "*?5?*", "*??5*",
     "*3??*", "*?3?*", "*??3*",
     "*1??*", "*?1?*", "*??1*",
     /* numeric: 4-digit forms (leading special bit), same idea */
     "*?7??*", "*?5??*", "*?3??*", "*?1??*"
  ) and
  process.args_count >= 2 and
  stringcontains(process.command_line, event0.file.name) and
  not process.command_line like~ ("*-h*","*--help*","*-V*","*--version*")]
  [process where event.type == "start" and event.action == "exec" and startswith~(process.executable, event0.file.path) and
   not (
     process.parent.executable == "/usr/local/bin/check_idle.sh" or
     process.executable like (
       "/var/lib/docker/*", "/tmp/tmp.*/rustup-init", "/tmp/cis-diagnose-rc-amd64", "/tmp/tmp.*/juliainstaller",
       "/etc/actions-runner-*", "/builds/*/snyk", "/tmp/mpm", "/tmp/coder.*/coder", "/tmp/helm"
     ) or
     (process.executable like "/tmp/teleport-*/install.sh" and process.args == "/usr/bin/env" and process.working_directory like "/tmp/teleport-*") or
     (process.executable == "/tmp/garage" and process.parent.args == "/garage-init") or
     process.working_directory like "/var/lib/waagent/*"
   )]
'''

min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.6.0"