Potential Remote Code Execution via Database Server

[rule]
description = """
This rule detects potential remote code execution attempts via commonly used database server applications, by monitoring
for unusual child processes and command line arguments.
"""
id = "057bd963-2dce-4951-87ce-5923803158ff"
license = "Elastic License v2"
name = "Potential Remote Code Execution via Database Server"
os_list = ["linux"]
version = "1.0.11"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
  process.parent.name in (
    "redis-server", "mongod", "mysqld", "oracle", "tnslsnr", "postgres", "mariadbd", "sqlservr",
    "beam.smp", "db2sysc", "clickhouse-server"
  ) or
  (process.parent.name == "redis-check-rdb" and process.parent.command_line like "*redis-server*")
) and
not (
  (process.parent.name == "oracle" and process.args like "/bin/grep -q kubepods /proc/self/cgroup*") or
  (process.parent.name == "beam.smp" and process.name == "erl_child_setup") or
  (process.parent.name == "erl_child_setup" and process.command_line like ("*rabbitmq-env.conf*echo*VARS*set", "inet_gethost 4")) or
  (process.name == "epmd" and process.command_line == "epmd -daemon")
) and
(
  process.name in (
    "scp", "gzip", "bzip2", "xz", "tar", "getcap", "capsh", "nohup", "setsid", "timeout", "disown",
    "mkfifo", "printenv", "env", "chpasswd"
  ) or
  process.name like ".*" or
  (
    process.name in ("whoami", "id", "hostname", "uname", "ps", "netstat", "ss", "ip", "ifconfig") and
    process.interactive == true and process.parent.interactive == false
  ) or
  process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*", "/root/*", "./*") or
  (
    process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and (
      process.args == "-c" or
      (
        process.args_count <= 2 and
        process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/www/*", "/root/*", "/home/*/*", "./*.py") and
        process.args like "*.py*"
      )
    ) and
    not process.args in ("--version", "app.py")
  ) or
  (
    process.executable like (
      "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
      "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
      "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
      "/bin/node", "/usr/bin/node", "/usr/local/bin/node"
    ) and
    (process.args like "-e*" or process.args_count <= 2)
  ) or
  (
    process.executable like ("/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*") and
    (process.args like "-r*" or process.args_count <= 2) and
    not (
      process.args like "var_export*" or
      process.command_line in ("php -r echo get_current_user().PHP_EOL;", "php -r echo date('T');")
    ) 
  ) or
  (
    process.name in ("nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd", "nc.traditional") and (
      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
      process.command_line like "*http*"
    ) and
    not process.args in ("localhost", "127.0.0.1", "-z", "-zv") 
  ) or
  (
    process.name == "socat" and
    process.command_line like~ ("*exec*", "*tty*", "*fork*", "*file*", "*open*") and
    process.command_line like~ ("*tcp*", "*udp*", "*openssl*")
  ) or
  (
    process.name == "openssl" and (
      process.command_line like ("*s_server*", "*s_client*") or
      (process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A"))
    )
  ) or
  (
    process.name in ("curl", "wget") and process.args like~ ("-o", "--output*", "-o-") and (
      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
      process.command_line like "*http*"
    ) and
    process.command_line like ("* /tmp/*", "* /var/tmp/*", "* /dev/shm/*", "* /var/www/*", "* ~/*", "* /home/*", "* /run/*", "* /var/run/*")
  ) or
  (
    process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
    process.args like~ "-*d*"
  ) or
  (
    process.name == "xxd" and process.args like~ ("-*r*", "-*p*")
  ) or
  (process.name == "sudo" and process.args == "-l") or
  (
    process.executable like ("/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod") and
    process.args like ("+x", "a+x", "0777", "755", "777", "+s", "u+s", "g+s")
  ) or
  (
    process.executable like ("/bin/cat", "/usr/bin/cat", "/usr/local/bin/cat") and
    process.args like (
      "/etc/passwd", "/etc/shadow", "/etc/hostname", "/etc/hosts", "*ssh*", "/proc/self/environ",
      "*.env*", "*../../../*", "*/secrets/kubernetes.io/serviceaccount/*", "*/.docker/config.json*",
      "*/.npmrc*", "*.aws/credentials*", "*/.aws/config*"
    )
  ) or
  (
    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
    process.args in ("-c", "-cl", "-lc") and (
      process.command_line like (
        /* Suspicious Paths */
        "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /var/www/*", "* /run/*", "* /var/run/*",

        /* Interpreter Execution */
        "*python* -c*", "*php* -r*", "*perl* -e*", "*ruby* -e*", "*lua* -e*", "*node * -e *",

        /* Encoding, Decoding & Piping */
        "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
        "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
        "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
        "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",

        /* Reverse Shells */
        "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",

        /* File Access */
        "*>*/etc/cron*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*", "*/etc/passwd*", "*chpasswd*",

        /* Helpers */
        "*nohup*", "*setsid *", "*timeout *sh -c *", "*disown*", "*env *sh *-c*",

        /* Miscellaneous */
        "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", 
        
        /* Decompression */
        "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
         
         /* Path Traversal */
         "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*"
      ) or
      (
        process.command_line like ("*wget *", "*curl *") and
        (
          process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*" or
          process.command_line like ("*http*", "*ftp*")
        ) and
        (
          (
            process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
            process.command_line like~ ("*curl* --output*", "*curl* --remote-name*")
          ) or
          (
            (
              process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
              process.command_line like~ "*wget* --output-document*"
            ) and
          not process.command_line like """*--output-document "-"*"""
          ) or
          process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
          (
            process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") and
            not process.command_line like ("*> /dev/null*", "*>/dev/null*", "*curl*/etc/cobra/*/uploads/whatsapp/*")
          )
        ) and
        not process.command_line like ("*-O /dev/null*", "*-o /dev/null*")
      )
    )
  )
) and
not (
  process.executable like ("/tmp/newroot/*", "./runc") or
  process.command_line == "sh -c locale -a" or
  process.args == "/usr/bin/env" and process.args in ("check_postgres.pl", "/usr/lib/pscheduler/commands/validate-configurables") or
  (
    process.parent.executable == "/etc/init.d/redis-server" and
    process.command_line in ("chmod 755 /var/run/redis", "touch /var/run/redis/redis-server.pid")
  ) or
  (
    process.parent.name == "postgres" and
    process.command_line in (
      "ps -p 1", "python2 -c pass", "timeout 5 cat /proc/net/tcp /proc/net/tcp6", "runc init", "env hostname -s",
      "find . -maxdepth 1 -mindepth 1 -type d", "netstat -an"
    )
  ) or
  (
    process.parent.name in ("postgres", "oracle", "tnslsnr") and
    process.command_line like (
      "echo nagios", "gzip -c", "/usr/bin/python3 /root/bin/yaml2json.py", "sh -c /*/scripts/check/libexec/check_df*",
      "timeout --signal=3 3 telnet*", "sh -c scp*pg_wal/RECOVERYHISTORY*", "sh -c scp*pg_wal/RECOVERYXLOG*",
      "env LC_ALL=C /bin/bash -c [ -f /sbin/ifconfig ] && echo 1 || echo 0"
    )
  ) or
  (
    process.parent.name == "tnslsnr" and (
      process.command_line like (
        "/usr/bin/python3 /root/bin/yaml2json.py", "/bin/echo Filesystem 1024-blocks*", "timeout 60 ls", "timeout 10 lsblk -lbSo SIZE,TYPE"
      ) or
      process.name in ("printenv", "env", "find", "gzip")
    )
  ) or
  (
    process.parent.name == "postgres" and (
      process.args like "scp*pgsql*" or
      (process.name == "scp" and process.command_line like "*pgsql*") or
      process.name == "uname"
    )
  ) or
  (
    process.parent.name == "mysqld" and
    process.command_line in ("touch /var/log/mysqld.log", "touch /var/lock/subsys/mysql")
  )
)
'''

min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1505"
name = "Server Software Component"
reference = "https://attack.mitre.org/techniques/T1505/"
[[threat.technique.subtechnique]]
id = "T1505.001"
name = "SQL Stored Procedures"
reference = "https://attack.mitre.org/techniques/T1505/001/"


[[threat.technique]]
id = "T1554"
name = "Compromise Host Software Binary"
reference = "https://attack.mitre.org/techniques/T1554/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"


[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.3.0"