detection.wiki

Detection rules › Elastic

Payload Execution by Web Server

Source
github.com/elastic/protections-artifacts

This rule detects when a web server executes a payload. Attackers may exploit RCE or file upload vulnerabilities to execute malicious payloads on web servers to gain/maintain access and to establish a command and control channel.

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Execution
Persistence
Lateral Movement
Command & Control

Rule body

[rule]
description = """
This rule detects when a web server executes a payload. Attackers may exploit RCE or file upload vulnerabilities to
execute malicious payloads on web servers to gain/maintain access and to establish a command and control channel.
"""
id = "7d4b0dfc-d305-4761-94f4-ab2ed221b3ee"
license = "Elastic License v2"
name = "Payload Execution by Web Server"
os_list = ["linux"]
version = "1.0.11"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
  process.parent.name in (
    "nginx", "apache2", "httpd", "caddy", "mongrel_rails", "uwsgi", "daphne", "httpd.worker", "flask",
    "php-cgi", "php-fcgi", "php-cgi.cagefs", "lswsctrl", "varnishd", "uvicorn", "waitress-serve", "starman",
    "frankenphp", "zabbix_server", "asterisk", "sw-engine-fpm"
  ) or
  process.parent.name like ("php-fpm*", "gunicorn*", "*.cgi", "*.fcgi") or
  (
    process.parent.name like "ruby*" and
    process.parent.command_line like~ ("*puma*", "*rails*", "*passenger*") and
    not process.parent.command_line == "sh -c /usr/bin/lsb_release -cidvr 2>/dev/null"
  ) or
  (
    process.parent.name like "python*" and
    process.parent.command_line like~ (
      "*hypercorn*", "*flask*", "*uvicorn*", "*django*", "*app.py*", "*server.py*", "*wsgi.py*", "*asgi.py*"
    )
  ) or
  (process.parent.name like "perl*" and process.parent.command_line like~ "*plackup*") or
  (process.parent.name == "java" and process.parent.args like~ (
    /* Tomcat */
    "org.apache.catalina.startup.Bootstrap", "-Dcatalina.base=*",

    /* Jetty */
    "org.eclipse.jetty.start.Main", "-Djetty.home=*",

    /* WildFly / JBoss */
    "org.jboss.modules.Main", "-Djboss.home.dir=*",

    /* WebLogic */
    "weblogic.Server", "-Dweblogic.Name=*", "*weblogic-launcher.jar*",

    /* WebSphere traditional + Liberty */
    "com.ibm.ws.runtime.WsServer", "com.ibm.ws.kernel.boot.cmdline.Bootstrap",

    /* GlassFish */
    "com.sun.enterprise.glassfish.bootstrap.ASMain",

    /* Resin */
    "com.caucho.server.resin.Resin",

    /* Spring Boot */
    "org.springframework.boot.loader.*",

    /* Quarkus */
    "*quarkus-run.jar*", "io.quarkus.runner.GeneratedMain",

    /* Micronaut */
    "io.micronaut.runtime.Micronaut",

    /* Dropwizard */
    "io.dropwizard.cli.ServerCommand",

    /* Play */
    "play.core.server.ProdServerStart",

    /* Helidon */
    "io.helidon.microprofile.server.Main", "io.helidon.webserver*",

    /* Vert.x */
    "io.vertx.core.Launcher",

    /* Keycloak */
    "org.keycloak*",

    /* Apereo CAS */
    "org.apereo.cas*",

    /* Elasticsearch */
    "org.elasticsearch.bootstrap.Elasticsearch",

    /* Atlassian / Gerrit */
    "com.atlassian.jira.startup.Launcher", "*BitbucketServerLauncher*", "com.google.gerrit.pgm.Daemon",

    /* Solr */
    "*-Dsolr.solr.home=*",

    /* Jenkins */
    "*jenkins.war*"
    )
  )
) and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
  process.command_line like~ (

    /* Suspicious Paths */
    "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /run/*", "* /var/run/*",

    /* Encoding, Decoding & Piping */
    "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
    "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
    "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
    "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",

    /* Interpreter Execution */
    "*python -c*", "*python3 -c*", "*php -r*", "*perl -e*", "*ruby -e*", "*lua -e*", "*node -e *",

    /* Reverse Shells */
    "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
    "*mkfifo /tmp/*", 

    /* File Access */
    "*>*/etc/cron*", "*crontab*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*",
    "*/etc/passwd*", "*/etc/master.passwd*",

    /* Enumeration & Discovery */
    "*/etc/hosts*", "*/etc/resolv.conf*", "*/etc/hostname*", "*/etc/issue*", "*/etc/os-release*", "*lsb_release*",
    "*/proc/*/environ*", "*sudo -l*", "*/proc/*/cgroup*", "*dockerenv*", "*/proc/*/mountinfo*", "*printenv*",
    "*cat*.env *", "*getcap*", "*capsh*", "*find / *", "*netstat *",

    /* AWS Credentials */
    "*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
    "*.aws/credentials*", "*/.aws/config*",

    /* Azure Credentials */
    "*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
    "*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*", "*/.azure/*",
    "*/run/secrets/azure/*",

    /* GCP Credentials */
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*",
    "*client_email*", "*private_key_id*", "*/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*",

    /* Misc. Cloud */
    "*/.docker/config.json*", "*/.npmrc*", "*/secrets/kubernetes.io/serviceaccount/*",

    /* Helpers */
    "*timeout *sh -c *", "*env *sh *-c*", "*exec -a*",

    /* Miscellaneous */
    "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", "*chmod 777*", "*chpasswd*",
    "*<?php*?>*", "*kworker*",
    
    /* Decompression */
    "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
    
    /* Path Traversal */
    "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*",

    /* File Upload/Download */
    "*pastebin.com*", "*transfer.sh*", "*bashupload.com*"
  ) or
  process.args in ("id", "whoami", "hostname")
) and
not (
  (
    process.parent.name == "nginx" and
    (
      process.args like ("chmod 777 /etc/resty-*", "resty*") or
      process.command_line like ("sh -c*/tmp/lua_* 2> /tmp/lua_*", "sh -c gcc -print-multiarch 2>/dev/null > /tmp/lua_*")
    )
  ) or
  (
    process.parent.name == "apache2" and (
      process.command_line in (
        "sh -c /usr/local/bin/php -r 'echo phpversion();'", "sh -c -- /usr/local/bin/php -r 'echo phpversion();'",
        "sh -c /usr/bin/php -r 'echo phpversion();'",
        "sh -c /usr/bin/lsb_release -a 2>/dev/null",
        "sh -c /usr/bin/crontab -l;",
        "sh -c -- whoami",
        "sh -c /usr/bin/crontab  -l 2>/dev/null",
        "sh -c /usr/bin/crontab  -",
        "sh -c lsb_release --all </dev/null 2>/dev/null",
        "sh -c /usr/bin/lsb_release -ds | cut -d= -f2 | tr -d '\"'"
      ) or
      process.args like (
        """bash -c "( /home/*/apps/richdocumentscode/collabora/Collabora_Online.AppImage*""",
        "chmod 777 /etc/cobra/uploads/mysql*", "stat*"
      ) or
      process.command_line like (
        "*/usr/bin/crontab*phpupdatecrontab.txt", "*mysqldump*/var/www/html/*/writable/uploads/backup/mysql*",
        "sh -c chmod 777 -R /opt/data/www/php_upload/*/temp", "sh -c chmod 777 -R /opt/data/www/php_upload/*/sync/*"
      )
    )
  ) or
  (
    process.parent.name like "php-fpm*" and (
      process.command_line in (
        "sh -c /usr/bin/php -r 'echo phpversion();'", "sh -c -- /usr/bin/php -r 'echo phpversion();'",
        "sh -c php -r 'print_r(phpversion());'", "sh -c chattr -i -a /usr/local/virtualizor/license2.php",
        "sh -c -- netstat -ie 2>&1",
        "sh -c hostname",
        "sh -c source /etc/os-release 2>/dev/null && echo $ID $ID_LIKE",
        "sh -c netstat -ie 2>&1",
        "sh -c php -r \"echo date('T');\"",
        "sh -c php -r \"echo PHP_VERSION;\"",
        "sh -c -- php -r \"echo (int)function_exists('pcntl_signal');\"",
        "sh -c -- php -r \"echo PHP_VERSION;\"",
        "sh -c -- php -r \"echo date('T');\"",
        "sh -c /usr/bin/lsb_release -a 2>/dev/null"
      ) or
      process.command_line like (
        "*var_export*extension_loaded*", "*/tmp/tmp_resize*", "*/v1/objects/hosts/*_Infoterminal*", "*python -m json.tool*",
        "sh -c timeout 3600 ssh -o ControlMaster=auto -o ControlPath=/var/www/html/storage/app/ssh/mux/*",
        "sh -c -- chmod 777 *.XML", "sh -c /usr/bin/lsb_release -a 2>/dev/null"
      ) or
      process.args like ("ps*|*grep*", "ffmpeg*", "chmod*777*.xml")
    )
  ) or
  (
    process.parent.name == "php-cgi" and (
      process.command_line like (
        "sh -c nohup php /home/*/public_html/lockindex.php index.php >/dev/null 2>&1 &",
        "sh -c nohup php /home/*/public_html/wp-content/* >> /dev/null 2>&1 &",
        "sh -c nohup php /home/*/public_html/wp-includes/* >> /dev/null 2>&1 &",
        "sh -c nohup php /home/*/public_html/*/wp-content/* >> /dev/null 2>&1 &",
        "*-ef|grep*",
        "sh -c /usr/bin/php -r 'echo phpversion();'"
      ) or
      process.args like "ps*| grep*"
    )
  ) or
  (
    process.parent.name == "java" and process.command_line == "/usr/bin/env sh -c ldd /usr/bin/env | grep -q musl"
  ) or
  (
    process.command_line == "/bin/sh -c echo | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddate" and
    process.parent.name == "gunicorn"
  ) or
  (
    process.parent.executable == "/usr/local/bin/gunicorn" and
    process.command_line == "/bin/sh -c echo 'Q' | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddate"
  ) or
   (
    process.parent.executable like "/home/rails/.rbenv/versions/*/bin/ruby" and
    process.command_line == "sh -c crontab -l 2> /dev/null"
  ) or
  (
   process.parent.executable == "/opt/bitnami/apache/bin/httpd" and
   process.command_line == "sh -c /opt/bitnami/php/bin/php -r 'echo phpversion();'"
  ) or
  (
    process.parent.executable like "/var/lib/containers/storage/overlay/*/merged/usr/local/sbin/php-fpm" and
    process.command_line == "sh -c /usr/local/bin/php -r 'echo phpversion();'"
  ) or
  (
    process.parent.executable like "/var/lib/docker/overlay2/*/merged/usr/sbin/uwsgi" and
    process.command_line == "/bin/sh -c { touch /run/uwsgi-logrotate  }"
  ) or
  (process.parent.executable == "/var/www/cgi-bin/vtsystem.cgi" and process.command_line == "sh -c hostname") or
  (process.parent.name like "python*" and process.parent.command_line like "*hive_server.py*") or
  (process.parent.name == "sw-engine-fpm" and process.command_line like ("*/opt/psa/admin/bin/*", "*/usr/local/psa/admin/*")) or
  (
    process.parent.name == "httpd" and
    process.command_line like (
      "*/datastore/htdocs/control-states/compass*", "*/dev/shm/netmon-log*", "sh -c /usr/bin/crontab  -l 2>/dev/null",
      "sh -c /usr/bin/crontab  -"
    )
  ) or
  (process.parent.name == "asterisk" and process.args like "/bin/chmod 777 */gravacoes/*.WAV") or
  (process.parent.name == "varnishd" and process.args like "exec gcc*") or
  (process.parent.name in ("apache2", "php-cgi") and process.command_line in ("sh -c crontab -l", "sh -c -- crontab -l")) or
  (process.parent.name in ("php-fpm", "httpd") and process.command_line in (
    "sh -c whoami", "sh -c /usr/bin/php -r 'echo phpversion();'",
    "sh -c TERM=dumb cat /var/run/elasticsearch/elasticsearch.pid", "sh -c TERM=dumb cat /var/run/logstash/logstash.pid"
  )) or
  (process.parent.name == "zabbix_server" and process.command_line like "*/usr/sbin/sendmail*") or
  (process.parent.executable == "/opt/morpheus/embedded/java/jre/bin/java" and process.command_line like "*morpheus-local*") or
  (
    process.parent.name == "ruby" and
    process.command_line in (
      "sh -c cat /etc/hostname 2>/dev/null",
      "sh -c echo \"^d\" | openssl s_client -connect 127.0.0.1:443 2>&1",
      "sh -c cat /etc/hosts.allow 2>/dev/null"
    )
  ) or
  (process.parent.name == "java" and process.args like "chmod 777 *.csv") or
  process.command_line == "sh -c node -v || nodejs -v" or
  process.working_directory == "/var/lib/puppet/rack/puppetmasterd" or
  (process.working_directory == "/olympe" and process.parent.executable == "/usr/local/bin/ruby" and process.command_line == "sh -c ssh-keygen -f ~/.ssh/id_ed25519 -y") or
  (process.parent.name like "python*" and process.parent.args == "/root/.local/share/uv/tools/mini-swe-agent/bin/python") or
  (process.parent.executable == "/usr/sbin/zabbix_server" and process.command_line like "*/usr/lib/zabbix/alertscripts/sms_gw*")
)
'''

min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1505"
name = "Server Software Component"
reference = "https://attack.mitre.org/techniques/T1505/"
[[threat.technique.subtechnique]]
id = "T1505.003"
name = "Web Shell"
reference = "https://attack.mitre.org/techniques/T1505/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"


[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.2.0"

Stages and Predicates

Stage 1: process

process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
  process.parent.name in (
    "nginx", "apache2", "httpd", "caddy", "mongrel_rails", "uwsgi", "daphne", "httpd.worker", "flask",
    "php-cgi", "php-fcgi", "php-cgi.cagefs", "lswsctrl", "varnishd", "uvicorn", "waitress-serve", "starman",
    "frankenphp", "zabbix_server", "asterisk", "sw-engine-fpm"
  ) or
  process.parent.name like ("php-fpm*", "gunicorn*", "*.cgi", "*.fcgi") or
  (
    process.parent.name like "ruby*" and
    process.parent.command_line like~ ("*puma*", "*rails*", "*passenger*") and
    not process.parent.command_line == "sh -c /usr/bin/lsb_release -cidvr 2>/dev/null"
  ) or
  (
    process.parent.name like "python*" and
    process.parent.command_line like~ (
      "*hypercorn*", "*flask*", "*uvicorn*", "*django*", "*app.py*", "*server.py*", "*wsgi.py*", "*asgi.py*"
    )
  ) or
  (process.parent.name like "perl*" and process.parent.command_line like~ "*plackup*") or
  (process.parent.name == "java" and process.parent.args like~ (
    "org.apache.catalina.startup.Bootstrap", "-Dcatalina.base=*",
    "org.eclipse.jetty.start.Main", "-Djetty.home=*",
    "org.jboss.modules.Main", "-Djboss.home.dir=*",
    "weblogic.Server", "-Dweblogic.Name=*", "*weblogic-launcher.jar*",
    "com.ibm.ws.runtime.WsServer", "com.ibm.ws.kernel.boot.cmdline.Bootstrap",
    "com.sun.enterprise.glassfish.bootstrap.ASMain",
    "com.caucho.server.resin.Resin",
    "org.springframework.boot.loader.*",
    "*quarkus-run.jar*", "io.quarkus.runner.GeneratedMain",
    "io.micronaut.runtime.Micronaut",
    "io.dropwizard.cli.ServerCommand",
    "play.core.server.ProdServerStart",
    "io.helidon.microprofile.server.Main", "io.helidon.webserver*",
    "io.vertx.core.Launcher",
    "org.keycloak*",
    "org.apereo.cas*",
    "org.elasticsearch.bootstrap.Elasticsearch",
    "com.atlassian.jira.startup.Launcher", "*BitbucketServerLauncher*", "com.google.gerrit.pgm.Daemon",
    "*-Dsolr.solr.home=*",
    "*jenkins.war*"
    )
  )
) and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
  process.command_line like~ (
    "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /run/*", "* /var/run/*",
    "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
    "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
    "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
    "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
    "*python -c*", "*python3 -c*", "*php -r*", "*perl -e*", "*ruby -e*", "*lua -e*", "*node -e *",
    "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
    "*mkfifo /tmp/*",
    "*>*/etc/cron*", "*crontab*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*",
    "*/etc/passwd*", "*/etc/master.passwd*",
    "*/etc/hosts*", "*/etc/resolv.conf*", "*/etc/hostname*", "*/etc/issue*", "*/etc/os-release*", "*lsb_release*",
    "*/proc/*/environ*", "*sudo -l*", "*/proc/*/cgroup*", "*dockerenv*", "*/proc/*/mountinfo*", "*printenv*",
    "*cat*.env *", "*getcap*", "*capsh*", "*find / *", "*netstat *",
    "*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
    "*.aws/credentials*", "*/.aws/config*",
    "*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
    "*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*", "*/.azure/*",
    "*/run/secrets/azure/*",
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*",
    "*client_email*", "*private_key_id*", "*/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*",
    "*/.docker/config.json*", "*/.npmrc*", "*/secrets/kubernetes.io/serviceaccount/*",
    "*timeout *sh -c *", "*env *sh *-c*", "*exec -a*",
    "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", "*chmod 777*", "*chpasswd*",
    "*<?php*?>*", "*kworker*",
    "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
    "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*",
    "*pastebin.com*", "*transfer.sh*", "*bashupload.com*"
  ) or
  process.args in ("id", "whoami", "hostname")
) and
not (
  (
    process.parent.name == "nginx" and
    (
      process.args like ("chmod 777 /etc/resty-*", "resty*") or
      process.command_line like ("sh -c*/tmp/lua_* 2> /tmp/lua_*", "sh -c gcc -print-multiarch 2>/dev/null > /tmp/lua_*")
    )
  ) or
  (
    process.parent.name == "apache2" and (
      process.command_line in (
        "sh -c /usr/local/bin/php -r 'echo phpversion();'", "sh -c -- /usr/local/bin/php -r 'echo phpversion();'",
        "sh -c /usr/bin/php -r 'echo phpversion();'",
        "sh -c /usr/bin/lsb_release -a 2>/dev/null",
        "sh -c /usr/bin/crontab -l;",
        "sh -c -- whoami",
        "sh -c /usr/bin/crontab  -l 2>/dev/null",
        "sh -c /usr/bin/crontab  -",
        "sh -c lsb_release --all </dev/null 2>/dev/null",
        "sh -c /usr/bin/lsb_release -ds | cut -d= -f2 | tr -d '\"'"
      ) or
      process.args like (
        """bash -c "( /home/*/apps/richdocumentscode/collabora/Collabora_Online.AppImage*""",
        "chmod 777 /etc/cobra/uploads/mysql*", "stat*"
      ) or
      process.command_line like (
        "*/usr/bin/crontab*phpupdatecrontab.txt", "*mysqldump*/var/www/html/*/writable/uploads/backup/mysql*",
        "sh -c chmod 777 -R /opt/data/www/php_uploadsync/*"
      )
    )
  ) or
  (
    process.parent.name like "php-fpm*" and (
      process.command_line in (
        "sh -c /usr/bin/php -r 'echo phpversion();'", "sh -c -- /usr/bin/php -r 'echo phpversion();'",
        "sh -c php -r 'print_r(phpversion());'", "sh -c chattr -i -a /usr/local/virtualizor/license2.php",
        "sh -c -- netstat -ie 2>&1",
        "sh -c hostname",
        "sh -c source /etc/os-release 2>/dev/null && echo $ID $ID_LIKE",
        "sh -c netstat -ie 2>&1",
        "sh -c php -r \"echo date('T');\"",
        "sh -c php -r \"echo PHP_VERSION;\"",
        "sh -c -- php -r \"echo (int)function_exists('pcntl_signal');\"",
        "sh -c -- php -r \"echo PHP_VERSION;\"",
        "sh -c -- php -r \"echo date('T');\"",
        "sh -c /usr/bin/lsb_release -a 2>/dev/null"
      ) or
      process.command_line like (
        "*var_export*extension_loaded*", "*/tmp/tmp_resize*", "*/v1/objects/hosts/*_Infoterminal*", "*python -m json.tool*",
        "sh -c timeout 3600 ssh -o ControlMaster=auto -o ControlPath=/var/www/html/storage/app/ssh/mux/*",
        "sh -c -- chmod 777 *.XML", "sh -c /usr/bin/lsb_release -a 2>/dev/null"
      ) or
      process.args like ("ps*|*grep*", "ffmpeg*", "chmod*777*.xml")
    )
  ) or
  (
    process.parent.name == "php-cgi" and (
      process.command_line like (
        "sh -c nohup php /home/*/public_html/lockindex.php index.php >/dev/null 2>&1 &",
        "sh -c nohup php /home/*/public_html/wp-content/* >> /dev/null 2>&1 &",
        "sh -c nohup php /home/*/public_html/wp-includes/* >> /dev/null 2>&1 &",
        "sh -c nohup php /home/*/public_html/*/wp-content/* >> /dev/null 2>&1 &",
        "*-ef|grep*",
        "sh -c /usr/bin/php -r 'echo phpversion();'"
      ) or
      process.args like "ps*| grep*"
    )
  ) or
  (
    process.parent.name == "java" and process.command_line == "/usr/bin/env sh -c ldd /usr/bin/env | grep -q musl"
  ) or
  (
    process.command_line == "/bin/sh -c echo | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddate" and
    process.parent.name == "gunicorn"
  ) or
  (
    process.parent.executable == "/usr/local/bin/gunicorn" and
    process.command_line == "/bin/sh -c echo 'Q' | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddate"
  ) or
   (
    process.parent.executable like "/home/rails/.rbenv/versions/*/bin/ruby" and
    process.command_line == "sh -c crontab -l 2> /dev/null"
  ) or
  (
   process.parent.executable == "/opt/bitnami/apache/bin/httpd" and
   process.command_line == "sh -c /opt/bitnami/php/bin/php -r 'echo phpversion();'"
  ) or
  (
    process.parent.executable like "/var/lib/containers/storage/overlay/*/merged/usr/local/sbin/php-fpm" and
    process.command_line == "sh -c /usr/local/bin/php -r 'echo phpversion();'"
  ) or
  (
    process.parent.executable like "/var/lib/docker/overlay2/*/merged/usr/sbin/uwsgi" and
    process.command_line == "/bin/sh -c { touch /run/uwsgi-logrotate  }"
  ) or
  (process.parent.executable == "/var/www/cgi-bin/vtsystem.cgi" and process.command_line == "sh -c hostname") or
  (process.parent.name like "python*" and process.parent.command_line like "*hive_server.py*") or
  (process.parent.name == "sw-engine-fpm" and process.command_line like ("*/opt/psa/admin/bin/*", "*/usr/local/psa/admin/*")) or
  (
    process.parent.name == "httpd" and
    process.command_line like (
      "*/datastore/htdocs/control-states/compass*", "*/dev/shm/netmon-log*", "sh -c /usr/bin/crontab  -l 2>/dev/null",
      "sh -c /usr/bin/crontab  -"
    )
  ) or
  (process.parent.name == "asterisk" and process.args like "/bin/chmod 777 */gravacoes/*.WAV") or
  (process.parent.name == "varnishd" and process.args like "exec gcc*") or
  (process.parent.name in ("apache2", "php-cgi") and process.command_line in ("sh -c crontab -l", "sh -c -- crontab -l")) or
  (process.parent.name in ("php-fpm", "httpd") and process.command_line in (
    "sh -c whoami", "sh -c /usr/bin/php -r 'echo phpversion();'",
    "sh -c TERM=dumb cat /var/run/elasticsearch/elasticsearch.pid", "sh -c TERM=dumb cat /var/run/logstash/logstash.pid"
  )) or
  (process.parent.name == "zabbix_server" and process.command_line like "*/usr/sbin/sendmail*") or
  (process.parent.executable == "/opt/morpheus/embedded/java/jre/bin/java" and process.command_line like "*morpheus-local*") or
  (
    process.parent.name == "ruby" and
    process.command_line in (
      "sh -c cat /etc/hostname 2>/dev/null",
      "sh -c echo \"^d\" | openssl s_client -connect 127.0.0.1:443 2>&1",
      "sh -c cat /etc/hosts.allow 2>/dev/null"
    )
  ) or
  (process.parent.name == "java" and process.args like "chmod 777 *.csv") or
  process.command_line == "sh -c node -v || nodejs -v" or
  process.working_directory == "/var/lib/puppet/rack/puppetmasterd" or
  (process.working_directory == "/olympe" and process.parent.executable == "/usr/local/bin/ruby" and process.command_line == "sh -c ssh-keygen -f ~/.ssh/id_ed25519 -y") or
  (process.parent.name like "python*" and process.parent.args == "/root/.local/share/uv/tools/mini-swe-agent/bin/python") or
  (process.parent.executable == "/usr/sbin/zabbix_server" and process.command_line like "*/usr/lib/zabbix/alertscripts/sms_gw*")
)

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
process.argsstarts_withchmod 777 /etc/resty-, restyexcludes:process.args field:"process.args" value:"chmod 777 /etc/resty-" field:"process.args" value:"resty"
process.command_linewildcardsh -c*/tmp/lua_* 2> /tmp/lua_*, sh -c gcc -print-multiarch 2>/dev/null > /tmp/lua_*excludes:process.command_line field:"process.command_line" value:"sh -c*/tmp/lua_* 2> /tmp/lua_*" field:"process.command_line" value:"sh -c gcc -print-multiarch 2>/dev/null > /tmp/lua_*"
process.parent.nameeqnginxexcludes:process.parent.name field:"process.parent.name" value:"nginx"
process.argswildcardbash -c "( /home/*/apps/richdocumentscode/collabora/Collabora_Online.AppImage*, chmod 777 /etc/cobra/uploads/mysql*, stat*excludes:process.args
process.command_lineinsh -c -- /usr/local/bin/php -r 'echo phpversion();', sh -c -- whoami, sh -c /usr/bin/crontab -, sh -c /usr/bin/crontab -l 2>/dev/null, sh -c /usr/bin/crontab -l;, sh -c /usr/bin/lsb_release -a 2>/dev/null, sh -c /usr/bin/lsb_release -ds | cut -d= -f2 | tr -d '"', sh -c /usr/bin/php -r 'echo phpversion();', sh -c /usr/local/bin/php -r 'echo phpversion();', sh -c lsb_release --all </dev/null 2>/dev/nullexcludes:process.command_line
process.command_linewildcard*/usr/bin/crontab*phpupdatecrontab.txt, *mysqldump*/var/www/html/*/writable/uploads/backup/mysql*, sh -c chmod 777 -R /opt/data/www/php_upload/*/temp, sh -c chmod 777 -R /opt/data/www/php_upload/*/sync/*excludes:process.command_line
process.parent.nameeqapache2excludes:process.parent.name field:"process.parent.name" value:"apache2"
process.argswildcardps*| grep*excludes:process.args field:"process.args" value:"ps*| grep*"
process.command_linewildcardsh -c nohup php /home/*/public_html/lockindex.php index.php >/dev/null 2>&1 &, sh -c nohup php /home/*/public_html/wp-content/* >> /dev/null 2>&1 &, sh -c nohup php /home/*/public_html/wp-includes/* >> /dev/null 2>&1 &, sh -c nohup php /home/*/public_html/*/wp-content/* >> /dev/null 2>&1 &, *-ef|grep*, sh -c /usr/bin/php -r 'echo phpversion();'excludes:process.command_line
process.parent.nameeqphp-cgiexcludes:process.parent.name field:"process.parent.name" value:"php-cgi"
process.argswildcardps*|*grep*, ffmpeg*, chmod*777*.xmlexcludes:process.args field:"process.args" value:"ps*|*grep*" field:"process.args" value:"ffmpeg*" field:"process.args" value:"chmod*777*.xml"
process.command_lineinsh -c -- /usr/bin/php -r 'echo phpversion();', sh -c -- netstat -ie 2>&1, sh -c -- php -r "echo (int)function_exists('pcntl_signal');", sh -c -- php -r "echo PHP_VERSION;", sh -c -- php -r "echo date('T');", sh -c /usr/bin/lsb_release -a 2>/dev/null, sh -c /usr/bin/php -r 'echo phpversion();', sh -c chattr -i -a /usr/local/virtualizor/license2.php, sh -c hostname, sh -c netstat -ie 2>&1, sh -c php -r "echo PHP_VERSION;", sh -c php -r "echo date('T');", sh -c php -r 'print_r(phpversion());', sh -c source /etc/os-release 2>/dev/null && echo $ID $ID_LIKEexcludes:process.command_line
process.command_linewildcard*var_export*extension_loaded*, */tmp/tmp_resize*, */v1/objects/hosts/*_Infoterminal*, *python -m json.tool*, sh -c timeout 3600 ssh -o ControlMaster=auto -o ControlPath=/var/www/html/storage/app/ssh/mux/*, sh -c -- chmod 777 *.XML, sh -c /usr/bin/lsb_release -a 2>/dev/nullexcludes:process.command_line
process.parent.namestarts_withphp-fpmexcludes:process.parent.name field:"process.parent.name" value:"php-fpm"
process.argsstarts_withexec gccexcludes:process.args field:"process.args" value:"exec gcc"
process.parent.nameeqvarnishdexcludes:process.parent.name field:"process.parent.name" value:"varnishd"
process.argswildcard/bin/chmod 777 */gravacoes/*.WAVexcludes:process.args field:"process.args" value:"/bin/chmod 777 */gravacoes/*.WAV"
process.parent.nameeqasteriskexcludes:process.parent.name field:"process.parent.name" value:"asterisk"
process.argswildcardchmod 777 *.csvexcludes:process.args field:"process.args" value:"chmod 777 *.csv"
process.parent.nameeqjavaexcludes:process.parent.name field:"process.parent.name" value:"java"
process.command_lineeq/bin/sh -c echo 'Q' | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddateexcludes:process.command_line field:"process.command_line" value:"/bin/sh -c echo 'Q' | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddate"
process.parent.executableeq/usr/local/bin/gunicornexcludes:process.parent.executable field:"process.parent.executable" value:"/usr/local/bin/gunicorn"
process.command_lineeq/bin/sh -c echo | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddateexcludes:process.command_line field:"process.command_line" value:"/bin/sh -c echo | openssl s_client -connect localhost:61617 2>/dev/null | openssl x509 -noout -enddate"
process.parent.nameeqgunicornexcludes:process.parent.name field:"process.parent.name" value:"gunicorn"
process.command_lineeq/bin/sh -c { touch /run/uwsgi-logrotate }excludes:process.command_line field:"process.command_line" value:"/bin/sh -c { touch /run/uwsgi-logrotate }"
process.parent.executablewildcard/var/lib/docker/overlay2/*/merged/usr/sbin/uwsgiexcludes:process.parent.executable field:"process.parent.executable" value:"/var/lib/docker/overlay2/*/merged/usr/sbin/uwsgi"
process.command_lineeq/usr/bin/env sh -c ldd /usr/bin/env | grep -q muslexcludes:process.command_line field:"process.command_line" value:"/usr/bin/env sh -c ldd /usr/bin/env | grep -q musl"
process.command_lineeqsh -c /opt/bitnami/php/bin/php -r 'echo phpversion();'excludes:process.command_line field:"process.command_line" value:"sh -c /opt/bitnami/php/bin/php -r 'echo phpversion();'"
process.parent.executableeq/opt/bitnami/apache/bin/httpdexcludes:process.parent.executable field:"process.parent.executable" value:"/opt/bitnami/apache/bin/httpd"
process.command_lineeqsh -c /usr/local/bin/php -r 'echo phpversion();'excludes:process.command_line field:"process.command_line" value:"sh -c /usr/local/bin/php -r 'echo phpversion();'"
process.parent.executablewildcard/var/lib/containers/storage/overlay/*/merged/usr/local/sbin/php-fpmexcludes:process.parent.executable field:"process.parent.executable" value:"/var/lib/containers/storage/overlay/*/merged/usr/local/sbin/php-fpm"
process.command_lineeqsh -c crontab -l 2> /dev/nullexcludes:process.command_line field:"process.command_line" value:"sh -c crontab -l 2> /dev/null"
process.parent.executablewildcard/home/rails/.rbenv/versions/*/bin/rubyexcludes:process.parent.executable field:"process.parent.executable" value:"/home/rails/.rbenv/versions/*/bin/ruby"
process.command_lineeqsh -c hostnameexcludes:process.command_line field:"process.command_line" value:"sh -c hostname"
process.parent.executableeq/var/www/cgi-bin/vtsystem.cgiexcludes:process.parent.executable field:"process.parent.executable" value:"/var/www/cgi-bin/vtsystem.cgi"
process.command_lineeqsh -c ssh-keygen -f ~/.ssh/id_ed25519 -yexcludes:process.command_line field:"process.command_line" value:"sh -c ssh-keygen -f ~/.ssh/id_ed25519 -y"
process.parent.executableeq/usr/local/bin/rubyexcludes:process.parent.executable field:"process.parent.executable" value:"/usr/local/bin/ruby"
process.working_directoryeq/olympeexcludes:process.working_directory field:"process.working_directory" value:"/olympe"
process.command_lineinsh -c -- crontab -l, sh -c crontab -lexcludes:process.command_line field:"process.command_line" value:"sh -c -- crontab -l" field:"process.command_line" value:"sh -c crontab -l"
process.parent.nameinapache2, php-cgiexcludes:process.parent.name field:"process.parent.name" value:"apache2" field:"process.parent.name" value:"php-cgi"
process.command_lineinsh -c /usr/bin/php -r 'echo phpversion();', sh -c TERM=dumb cat /var/run/elasticsearch/elasticsearch.pid, sh -c TERM=dumb cat /var/run/logstash/logstash.pid, sh -c whoamiexcludes:process.command_line
process.parent.nameinhttpd, php-fpmexcludes:process.parent.name field:"process.parent.name" value:"httpd" field:"process.parent.name" value:"php-fpm"
process.command_lineinsh -c cat /etc/hostname 2>/dev/null, sh -c cat /etc/hosts.allow 2>/dev/null, sh -c echo "^d" | openssl s_client -connect 127.0.0.1:443 2>&1excludes:process.command_line
process.parent.nameeqrubyexcludes:process.parent.name field:"process.parent.name" value:"ruby"
process.command_linematch/opt/psa/admin/bin/, /usr/local/psa/admin/excludes:process.command_line field:"process.command_line" value:"/opt/psa/admin/bin/" field:"process.command_line" value:"/usr/local/psa/admin/"
process.parent.nameeqsw-engine-fpmexcludes:process.parent.name field:"process.parent.name" value:"sw-engine-fpm"
process.command_linematch/usr/lib/zabbix/alertscripts/sms_gwexcludes:process.command_line field:"process.command_line" value:"/usr/lib/zabbix/alertscripts/sms_gw"
process.parent.executableeq/usr/sbin/zabbix_serverexcludes:process.parent.executable field:"process.parent.executable" value:"/usr/sbin/zabbix_server"
process.command_linematch/usr/sbin/sendmailexcludes:process.command_line field:"process.command_line" value:"/usr/sbin/sendmail"
process.parent.nameeqzabbix_serverexcludes:process.parent.name field:"process.parent.name" value:"zabbix_server"
process.command_linematchmorpheus-localexcludes:process.command_line field:"process.command_line" value:"morpheus-local"
process.parent.executableeq/opt/morpheus/embedded/java/jre/bin/javaexcludes:process.parent.executable field:"process.parent.executable" value:"/opt/morpheus/embedded/java/jre/bin/java"
process.command_linewildcard*/datastore/htdocs/control-states/compass*, */dev/shm/netmon-log*, sh -c /usr/bin/crontab -l 2>/dev/null, sh -c /usr/bin/crontab -excludes:process.command_line
process.parent.nameeqhttpdexcludes:process.parent.name field:"process.parent.name" value:"httpd"
process.parent.argseq/root/.local/share/uv/tools/mini-swe-agent/bin/pythonexcludes:process.parent.args field:"process.parent.args" value:"/root/.local/share/uv/tools/mini-swe-agent/bin/python"
process.parent.namestarts_withpythonexcludes:process.parent.name field:"process.parent.name" value:"python"
process.parent.command_linematchhive_server.pyexcludes:process.parent.command_line field:"process.parent.command_line" value:"hive_server.py"
process.command_lineeqsh -c node -v || nodejs -vexcludes:process.command_line field:"process.command_line" value:"sh -c node -v || nodejs -v"
process.working_directoryeq/var/lib/puppet/rack/puppetmasterdexcludes:process.working_directory field:"process.working_directory" value:"/var/lib/puppet/rack/puppetmasterd"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
event.actioneq
  • exec
field:"EventType" kind:eq value:"exec"
event.typeeq
  • start
field:"event.type" kind:eq value:"start"
process.argsin
  • -c
  • -cl
  • -lc
  • hostname
  • id
  • whoami
field:"process.args" kind:in
process.command_linewildcard
  • * /dev/shm/*
  • * /run/*
  • * /tmp/*
  • * /var/run/*
  • * /var/tmp/*
  • * nc *
  • *#!*
  • *../../../*etc/*
  • *../../../*home/*/*
  • *../../../*root/*
  • *.aws/credentials*
  • */.../*
  • */.aws/config*
  • */.azure/*
  • */.config/gcloud/*
  • */.docker/config.json*
  • */.npmrc*
  • */dev/tcp*
  • */dev/udp/*
  • */etc/hostname*
  • */etc/hosts*
  • */etc/issue*
  • */etc/master.passwd*
  • */etc/os-release*
  • */etc/passwd*
  • */etc/resolv.conf*
  • */etc/shadow*
  • */etc/ssh*
  • */home/*/.ssh/*
  • */proc/*/cgroup*
  • */proc/*/environ*
  • */proc/*/mountinfo*
  • */root/.ssh*
  • */run/secrets/azure/*
  • */run/secrets/google/*
  • */secrets/kubernetes.io/serviceaccount/*
  • *<?php*?>*
  • *>*/etc/cron*
  • *AZURE_CLIENT_ID*
  • *AZURE_CLIENT_SECRET*
  • +85 more values (see full rule source)
field:"CommandLine" kind:wildcard
process.namein
  • bash
  • busybox
  • csh
  • dash
  • fish
  • ksh
  • sh
  • tcsh
  • zsh
field:"process_name" kind:in
process.parent.argswildcard
  • *-Dsolr.solr.home=*
  • *BitbucketServerLauncher*
  • *jenkins.war*
  • *quarkus-run.jar*
  • *weblogic-launcher.jar*
  • -Dcatalina.base=*
  • -Djboss.home.dir=*
  • -Djetty.home=*
  • -Dweblogic.Name=*
  • com.atlassian.jira.startup.Launcher
  • com.caucho.server.resin.Resin
  • com.google.gerrit.pgm.Daemon
  • com.ibm.ws.kernel.boot.cmdline.Bootstrap
  • com.ibm.ws.runtime.WsServer
  • com.sun.enterprise.glassfish.bootstrap.ASMain
  • io.dropwizard.cli.ServerCommand
  • io.helidon.microprofile.server.Main
  • io.helidon.webserver*
  • io.micronaut.runtime.Micronaut
  • io.quarkus.runner.GeneratedMain
  • io.vertx.core.Launcher
  • org.apache.catalina.startup.Bootstrap
  • org.apereo.cas*
  • org.eclipse.jetty.start.Main
  • org.elasticsearch.bootstrap.Elasticsearch
  • org.jboss.modules.Main
  • org.keycloak*
  • org.springframework.boot.loader.*
  • play.core.server.ProdServerStart
  • weblogic.Server
field:"process.parent.args" kind:wildcard
process.parent.command_linewildcard
  • *app.py*
  • *asgi.py*
  • *django*
  • *flask*
  • *hypercorn*
  • *passenger*
  • *plackup*
  • *puma*
  • *rails*
  • *server.py*
  • *uvicorn*
  • *wsgi.py*
field:"ParentCommandLine" kind:wildcard
process.parent.interactiveeq
  • false transforms: boolean
field:"process.parent.interactive" kind:eq value:"false"
process.parent.nameeq
  • java
field:"parent_process_name" kind:eq value:"java"
process.parent.namein
  • apache2
  • asterisk
  • caddy
  • daphne
  • flask
  • frankenphp
  • httpd
  • httpd.worker
  • lswsctrl
  • mongrel_rails
  • nginx
  • php-cgi
  • php-cgi.cagefs
  • php-fcgi
  • starman
  • sw-engine-fpm
  • uvicorn
  • uwsgi
  • varnishd
  • waitress-serve
  • zabbix_server
field:"parent_process_name" kind:in
process.parent.namewildcard
  • *.cgi
  • *.fcgi
  • gunicorn*
  • perl*
  • php-fpm*
  • python*
  • ruby*
field:"parent_process_name" kind:wildcard