Suspicious Recursive File Deletion via Built-In Utilities

[rule]
description = """
Identifies suspicious use of the Linux rm command to recursively delete user home files and directories. Certain
ransomware families abuse this built-in utility to delete user files and important system files after their encryption
process is complete.
"""
id = "15019d7c-42e6-4cf7-88b0-0c3a6963e6f5"
license = "Elastic License v2"
name = "Suspicious Recursive File Deletion via Built-In Utilities"
os_list = ["linux", "macos"]
reference = [
    "https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html",
]
version = "1.0.28"

query = '''
process where event.action == "exec" and

 /* recursive file deletion and multiple directories passed for deletion */
 process.name == "rm" and process.args == "-rf" and process.args_count >= 10 and

 /* encrypting users home or docker folders */
 process.args : ("/home/*", "/var/lib/docker/*") and process.parent.name == "xargs"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"

[[threat.technique]]
id = "T1565"
name = "Data Manipulation"
reference = "https://attack.mitre.org/techniques/T1565/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"