System V Init (init.d) Executed Binary from Unusual Location

[rule]
description = """
This rule monitors for the execution of a binary in an unusual location through an init.d script. This could be an
indicator of persistence or a malicious actor attempting to hide their activity.
"""
id = "879c083c-e2d9-4f75-84f2-0f1471d915a8"
license = "Elastic License v2"
name = "System V Init (init.d) Executed Binary from Unusual Location"
os_list = ["linux"]
reference = [
    "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    "https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
]
version = "1.0.8"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable like "/etc/init.d/*" and
process.executable like (
  "./.*", "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/update-motd.d/*", "/run/*", "/srv/*", "/tmp/*", "/var/tmp/*",
  "/var/log/*", "/opt/.*"
) and
not (
  (
    process.executable == "/srv/bin/cnmaestro-ha" and process.parent.args == "/etc/init.d/cnmaestro-ha" and
    process.parent.args == "start"
  ) or
  process.executable like "/srv/rsyslog_exporter/rsyslog_exporter*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "7.15.0"