Egress Connection by a DNF Package Manager Descendant

[rule]
description = """
Detects suspicious network events executed by the DNF package manager, potentially indicating persistence through a DNF
backdoor. In Linux, DNF (Dandified YUM) is a command-line utility used for handling packages on Fedora-based systems,
providing functions for installing, updating, upgrading, and removing software along with managing package repositories.
Attackers can backdoor DNF to gain persistence by injecting malicious code into plugins that DNF runs, thereby ensuring
continued unauthorized access or control each time DNF is used for package management.
"""
id = "3e79f8fc-26a4-4646-9a58-9f11b9c11e28"
license = "Elastic License v2"
name = "Egress Connection by a DNF Package Manager Descendant"
os_list = ["linux"]
reference = [
    "https://pwnshift.github.io/2020/10/01/persistence.html",
    "https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
]
version = "1.0.11"

query = '''
sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "exec" and (
   process.name : (
     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "python*", "php*",
     "perl", "ruby", "lua*", "openssl", "nc", "ncat", "netcat", "netcat.openbsd",
     "netcat.traditional", "nc.openbsd", "nc.traditional", "telnet", "awk"
   ) or
   process.executable : (
     "./*", "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/run/*", "/srv/*",
     "/tmp/*", "/var/tmp/*", "/var/log/*"
     )
   ) and descendant of [process where event.action == "exec" and process.name == "dnf"] and not (
     process.working_directory == "/tmp/newroot" or
     process.command_line like "*petalinux.xilinx.com*" or
     process.executable like ("/var/lib/docker/overlay2/*", "/tmp/newroot/*", "/builds/*", "/workspaces/*") or
     process.parent.executable == "/usr/lib/opt/kolide-k2/bin/launcher" or
     process.args like "/home/ansible/.ansible/*" or
     (process.name like "python*" and process.args == "azure.cli")
   )
  ]
  [network where event.action == "connection_attempted" and event.type == "start" and not (
     destination.ip == null or
     destination.ip == "0.0.0.0" or
     cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8", "172.31.0.0/16"
     ) or
     process.executable like (
      "/tmp/newroot/usr/lib64/google-cloud-sdk/platform/bundledpythonunix/bin/python*", "/usr/bin/node"
     )
   )
  ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.016"
name = "Installer Packages"
reference = "https://attack.mitre.org/techniques/T1546/016/"


[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"