Renice or Ulimit Execution from Unusual Parent

[rule]
description = """
This rule detects the execution of the renice or ulimit commands from an unusual parent, which are used to change the
priority of processes or set resource limits for processes. Threat actors may abuse these commands to change the
priority of malicious processes. This is commonly used by miner malware to increase the priority of mining processes to
maximize the mining performance.
"""
id = "57ed0e43-643a-47f3-936e-138dc6f480da"
license = "Elastic License v2"
name = "Renice or Ulimit Execution from Unusual Parent"
os_list = ["linux"]
version = "1.0.8"

query = '''
process where event.type == "start" and event.action == "exec" and (
  process.name in ("ulimit", "renice") or (
    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
    process.command_line like ("*ulimit*", "*renice*")
  )
) and process.parent.executable != null and
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") or process.parent.name like ".*") and
not (
  process.parent.command_line in ("/bin/sh /usr/bin/byobu-status tmux_right", "runc init") or
  process.parent.executable like (
    "/tmp/newroot/*", "/tmp/vmis.*/vmware-installer/vmis-launcher", "/tmp/baum/easybuild/*", "/tmp/wbrashear/easybuild/*",
    "/tmp/par-*/temp-*/nbsu"
  ) or
  process.parent.name in ("java", "make", "python3.10.real")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"