Suspicious Python Command Execution

[rule]
description = """
This rule monitors for suspicious Python command executions by detecting the start of a Python process with a command
line argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments
include operations to execute code, create subprocesses, and encode or decode data.
"""
id = "028d01ae-bfbf-438e-a0d0-23aee55ea5c9"
license = "Elastic License v2"
name = "Suspicious Python Command Execution"
os_list = ["linux"]
version = "1.0.19"

query = '''
process where event.type == "start" and event.action == "exec" and process.name like "python*" and
process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.args == "-c" and (
  (
    process.command_line like~ ("*import *os;*", "*import *os,*", "*import *pty;*",  "*import *pty,*") and
    process.command_line like~ ("*os.system*", "*os.setuid*", "*os.dup2*", "*pty*", "*os.popen(*")
  ) or
  (
    process.command_line like~ ("*import *socket;*", "*import *socket,*") and
    process.command_line like~ ("*.connect(*", "*os.getenv*", "*os.dup2*", "*socket.socket(*", "*.bind(*") and
    process.command_line like~ "*/bin/*sh*"
  ) or
  (
    process.command_line like~ ("*import *subprocess*;", "*import *subprocess,*") and
    process.command_line like~ "*subprocess.call*"
  ) or
  (
    process.command_line like~ ("*base64*", "*binascii*", "*zlib*", "*gzip*", "*bz2*", "*lzma*", "*marshal.loads(*", "*pickle.loads(*") and
    process.command_line like~ ("*exec(*", "*eval(*")
  ) or
  (
    process.command_line like~ "*import *wave*" and
    process.command_line like~ "*wave.open*" and 
    process.command_line like~ "*readframes*" and 
    process.command_line like~ ("*exec(*", "*eval(*")
  )
) and process.working_directory like (
  "/var/www/*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*", "/root/*"
) and not (
  process.parent.args in ("pip", "install", "--pgo", "/tmp/portage/bin/pid-ns-init", "/dockerstartup/custom_startup.sh") or
  process.parent.args like "/home/*/bin/join-zoom.sh" or
  process.parent.name in ("pip", "pytest", "pip3", "sudo", "sshd", "teleport") or
  process.executable like~ ("/var/lib/docker/*", "/tmp/plz_sandbox/*") or
  process.command_line like (
    "/usr/local/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
    "/usr/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
    "python -c import socket s = socket.socket(socket.AF_INET) s.bind(('127.0.0.1', 0)) _, listen_port = s.getsockname() s.close() print(listen_port)",
    "*sqlite*", "*postgres*", "python -c import sys;import base64;sys.stdout.write('@Main\n');exec(base64.b64decode(sys.stdin.readline().rstrip()))#ZeroNetworks",
    """/usr/bin/python3 -c from tkinter import Tcl; print(Tcl().eval("info*"))""",
    "python3*os.system*echo test*", "python3 -c import pymysql*",
    "python3 -c import socket; s=socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()",
    "python3 -c import socket; s=socket.socket(); s.bind(('0', 0)); print(s.getsockname()[1]); s.close()",
    "python3 -c import socket; s=socket.socket(); s.bind(('0.0.0.0', 0)); print(s.getsockname()[1]); s.close()",
    "python3 -c import socket; s=socket.socket(); s.bind(('localhost', 0)); print(s.getsockname()[1]); s.close()",
    "import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
    "*Thomas Nagy*", "*/tmp/claude-*",
    "/usr/bin/python* -c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
  ) or
  process.parent.executable like~ (
    "/var/lib/amazon/ssm/*", "/var/anaconda3/envs/*", "/tmp/plz_sandbox/test", "/usr/bin/cockpit-bridge",
    "/pro/bin/sys/dbutils/dbaValidateOsUserCredentials.sh", "/usr/sbin/lxc", "/sbin/lxc", "/data/flash/Linux_for_Tegra/flash.sh",
    "/usr/bin/ansible-playbook", "/usr/local/bin/teleport", "/usr/local/bin/odoo-helper", "/home/*/bin/join-zoom.sh",
    "/usr/lib/openssh/sshd-session", "/usr/sbin/lxd", "/usr/sbin/tailscaled", "/home/*/.local/bin/kiro-cli-chat"
  ) or
  process.args like~ """import zlib,base64; exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTb*""" or
  process.working_directory like~ (
    "/data/jenkins/.local/share/containers/storage/overlay/*", "/var/run/cloudera-scm-agent/*", "/tmp/pip-req-build*",
    "/tmp/pip-resolve-*", "/build/source", "/tmp/pip-install-*", "/opt/airflow", "/tmp/pip-wheel-*", "/tmp/pip-download-*",
    "/tmp/plz_sandbox", "/builds/*", "/scratch/*", "/tmp/cmdickens/easybuild/*", "/tmp/thangha/easybuild*",
    "/tmp/baum/easybuild/*", "/tmp/zenix-flashing/*", "/opt/ansible*", "/pro/bin/sys/monitor", "/home/jenkins/workspace/*",
    "/var/tmp/portage/*", "/tmp/build/*/ansible", "/root/thg-intelligence", "/home/*/*/*/*", "/root/airflow"
  ) or
  process.parent.command_line like~ (
    "/nix/store/*pytest*", "*/home/*/.claude/shell-snapshots/*", "*vault/core/test_hub/resources/events_checksum_monitor/bucket/verifier_test.go*",
    "*__CURSOR_SANDBOX_ENV_RESTORE*"
  ) or
  process.parent.command_line in ("/bin/bash /docker-entrypoint.sh worker", "/bin/bash /docker-entrypoint.sh") or
  (process.parent.args == "/usr/sbin/lxc" and process.parent.args in ("list", "info", "version")) or
  (process.working_directory like "/tmp/tmp.*" and process.command_line == "python3 -c import socket; s = socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()") or
  (
    process.executable in ("/bin/python2", "/usr/bin/python2") and
    process.command_line like (
      "*causixenqueuer/firefoot/config.json*", "*s3loguploader.yml*", "*MUM1_AWS_ACCESS_KEY_ID*", "*/etc/init/ahn.conf*", "*AWS_SECRET_ACCESS_KEY_SGP1*"
    )
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"