Suspicious Process Spawned from MOTD Detected

[rule]
description = """
Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or
a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" and
"/usr/lib/update-notifier/" directories. These scripts run as the root user every time a user connects over SSH or a
serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a
user connects to the system by executing a backdoor script or command. This rule detects the execution of potentially
malicious processes through the MOTD utility.
"""
id = "b9b3922a-59ee-407c-8773-31b98bf9b18d"
license = "Elastic License v2"
name = "Suspicious Process Spawned from MOTD Detected"
os_list = ["linux"]
reference = [
    "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd",
    "https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
]
version = "1.0.12"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable like "/etc/update-motd.d/*"
and (
  (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and (
    (process.args in ("-i", "-l", "-il", "-li")) or (process.parent.name == "socat" and process.parent.args like~ "*exec*"))) or
  (process.name in ("nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd", "nc.traditional") and process.args_count >= 3 and 
    not process.args like~ ("-*z*", "-*l*")) or
  (process.name like "python*" and process.args == "-c" and process.args like~ (
     "*import*pty*spawn*", "*import*subprocess*call*"
  )) or
  (process.name like "perl*" and process.args == "-e" and process.args like~ "*socket*" and process.args like~ (
     "*exec*", "*system*"
  )) or
  (process.name like "ruby*" and process.args in ("-e", "-rsocket") and process.args like~ (
     "*TCPSocket.new*", "*TCPSocket.open*"
  )) or
  (process.name like "lua*" and process.args == "-e" and process.args like~ "*socket.tcp*" and process.args like~ (
     "*io.popen*", "*os.execute*"
  )) or
  (process.name like "php*" and process.args == "-r" and process.args like~ "*fsockopen*" and process.args like~ "*/bin/*sh*") or 
  (process.name in ("awk", "gawk", "mawk", "nawk") and process.args like~ "*/inet/tcp/*") or 
  (process.name == "openssl" and process.args like~ ("*s_server*", "*s_client*") and process.args like~ (
    "*-connect*", "*:*", "*-port*"
  )) or
  (process.name == "telnet")
) and 
not (process.parent.args : "--force" or process.args : ("/usr/games/lolcat", "/usr/bin/screenfetch"))
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "7.15.0"