Suspicious Ruby Command Execution

[rule]
description = """
This rule monitors for suspicious Ruby command executions by detecting the start of a Ruby process with a command line
argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments
include operations to execute code, create subprocesses, and encode or decode data.
"""
id = "a3a3b49c-c135-4959-8a1b-33392bb60991"
license = "Elastic License v2"
name = "Suspicious Ruby Command Execution"
os_list = ["linux"]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.executable like~ ("/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*") and
process.args like "-e*" and process.command_line like~ (
  "*system(*", "*exec(*", "*IO.popen(*", "*Open3.popen3(*", "*spawn(*", "*eval(*", "*load(*",
  "*Marshal.load(*", "*Fiddle.dlopen(*", "*Fiddle::Function.new(*", "*base64*", "*zlib*", 
  "*net/http*", "*socket*", "*open-uri*", "*pack(*", "*unpack(*"
) and
not (
  process.working_directory like~ ("/etc/puppet/rack", "/builds/*", "/var/tmp/portage/*") or
  process.command_line like ("*rails_env*", "*pid*Process.spawn*ssh*StrictHostKeyChecking*ServerAliveInterval*ServerAliveCountMax*") or
  process.command_line == "ruby -e require \"yaml\"; YAML.safe_load(File.read(\".gitlab-ci.yml\"), aliases: true)" or
  process.parent.args like "/home/*/.vscode-server/cli/servers/Stable-*" or
  process.parent.command_line in ("emacs --daemon", "runc init") or
  process.parent.name in ("emacs-gtk", "mmonit", "make") or
  (process.name == "ruby" and process.parent.name == "ruby") or
  process.parent.executable in ("/opt/gitlab/embedded/bin/gitaly", "/usr/bin/runc") or
  (
    process.working_directory == "/workspace" and
    process.parent.executable like ("/home/*/dev/*/rollcage", "/tmp/rollcage-target/debug/rollcage")
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"