Suspicious Interpreter Execution from Stdin

[rule]
description = """
Identifies interpreters started with - (stdin) where the command line suggests executing code from stdin. This is a
common technique used by attackers to execute code without leaving a trace in the command line.
"""
id = "4aed9b17-873d-48b2-86eb-1af2f695f7fe"
license = "Elastic License v2"
name = "Suspicious Interpreter Execution from Stdin"
os_list = ["linux", "macos"]
reference = [
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and
process.executable like (
 "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
 "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
 "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
 "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
 "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*"
 ) and
process.args == "-" and process.args_count <= 2 and
process.parent.executable like (
 "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
 "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
 "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
 "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
 "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*"
) and
not process.parent.args in ("/usr/sbin/needrestart", "/sbin/needrestart")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"