Suspicious Interactive Shell Execution

[rule]
description = """
Detects the suspicious use of the -i shell option indicating an interactive session via an abnormal parent process.
Threat actors have been observed using this technique to gain interactive command line access via their payloads in
order to maintain access and conduct post-exploitation actions on the objective.
"""
id = "71c3d317-7c92-4bd7-bbb1-b6ff62f94ebe"
license = "Elastic License v2"
name = "Suspicious Interactive Shell Execution"
os_list = ["macos"]
version = "1.0.10"

query = '''
sequence with maxspan=30s
[network where event.type == "start" and event.action == "connection_attempted" and 
  process.name like~ (".*", "osascript", "ruby*", "python*")] by process.entity_id
[process where event.type == "start" and event.action == "exec" and 
  (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
  (process.args in ("/bin/bash", "/usr/bin/bash", "/bin/sh", "/usr/bin/sh", "/bin/zsh", "/usr/bin/zsh", "/bin/dash", "/usr/bin/dash", "/bin/csh", "/usr/bin/csh", "/bin/tcsh", "/usr/bin/tcsh", "/bin/ksh", "/usr/bin/ksh", "/bin/tclsh", "/usr/bin/tclsh", "/bin/fish", "/usr/bin/fish", "/usr/local/bin/fish", "/opt/homebrew/bin/fish") or process.args like "*/bin/tclsh*") and
  process.args == "-i" and process.args_count == 2 and
  process.parent.name like~ (".*", "osascript", "ruby*", "python*")] by process.parent.entity_id
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"