Potential Remote Code Execution via URL Encoded Payload

[rule]
description = """
This rule detects the execution of shell commands via a URL encoded payload. This behavior is indicative of a potential
remote code execution attempt.
"""
id = "cf54b4c2-5618-4515-9250-26542dd4aa5f"
license = "Elastic License v2"
name = "Potential Remote Code Execution via URL Encoded Payload"
os_list = ["linux"]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
  process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") or
  process.name like (".*", "python*", "perl*", "ruby*", "lua*", "php*", "node", "java") or
  process.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/run/*", "/run/*", "/boot/*", "/home/*", "/root/*", "./*")
) and
process.command_line regex~ ".*(%[0-9a-f]{2}.*){4,}.*" and process.command_line like (
  "*/bin/sh%*", "*bash%*", "*sh%*-c%*", "*sh%*-i%*", "*nsenter%*", "*/.ssh/*", "*:10250/*", "*base64%*", "*echo%*|*",
  "*echo%*>*", "*dev%*tcp%*", "*dev%*udp%*", "*whoami*", "*/etc/passwd*", "*/dev/shm*", "*uname%*", "*curl%*", "*wget%*"
) and
not (
  process.parent.executable like (
    "/mnt/Xilinx/PetaLinux/*/python*", "/tmp/petalinux*/python*", "/home/*/.local/share/claude/versions/*", "/home/*/.aimee-code/bin/claude"
  ) or
  process.executable like "/tmp/petalinux*/usr/bin/*" or
  process.command_line like ("*/workdir/builder_client/layers/poky/scripts*", "*petalinux.xilinx.com*") or
  process.parent.args like ("/workdir/builder_client/layers/poky/bitbake/bin/bitbake-worker", "/tmp/petalinux*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"

[[threat.technique]]
id = "T1505"
name = "Server Software Component"
reference = "https://attack.mitre.org/techniques/T1505/"
[[threat.technique.subtechnique]]
id = "T1505.003"
name = "Web Shell"
reference = "https://attack.mitre.org/techniques/T1505/003/"


[[threat.technique]]
id = "T1554"
name = "Compromise Host Software Binary"
reference = "https://attack.mitre.org/techniques/T1554/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"