Unusual Command Execution via Cron

[rule]
description = """
This rule detects the execution of suspicious commands and executables by cron. Threat actors may abuse cron to execute
malicious commands or scripts to maintain persistence or escalate privileges.
"""
id = "9f587c35-8c2b-4410-b419-2eff4e0607cc"
license = "Elastic License v2"
name = "Unusual Command Execution via Cron"
os_list = ["linux"]
reference = [
    "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.8"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name in ("cron", "crond") and 
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "pwsh", "mksh") and
process.args in ("-c", "--command", "-lc", "-cl") and (
  process.command_line like~ (

    /* Encoding, Decoding & Piping */
    "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
    "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
    "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
    "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",

    /* Reverse Shell CLIs */
    "*/dev/tcp*", "*/dev/udp/*", "*import*pty*spawn*", "*import*subprocess*call*", "*TCPSocket.new*", "*TCPSocket.open*",
    "*io.popen*", "*os.execute*", "*fsockopen*", "*socat*exec:*", "*socat*tcp-connect*",

    /* Persistence */
    "*>*/home/*/.ssh/*", "*>*/root/.ssh*", "*>*~/.ssh/*", "*>*/etc/shadow*", "*>*/etc/passwd*",
    "*>*/etc/master.passwd*", "*chpasswd*", "*NOPASSWD:ALL*>*sudoers.d*", "*>*/etc/systemd/system/*[Unit]*ExecStart*",
    "*| crontab -*",

    /* Miscellaneous */
    "* setsid *", "*timeout *sh -c *", "*disown*",  "*chattr *", "busybox *", "*chmod +x *", 
    "*<?php*?>*", "*kworker*", "*stty*raw*-echo*", "*mkfifo /tmp/*", "*/dev/shm/*"
  ) or
  (
    process.command_line like ("*curl *", "*wget *") and
    not process.command_line like ("*> /dev/null*", "*>/dev/null*", "* -O /dev/null*") and
    (
      process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
      process.command_line like~ ("*curl* --output*", "*curl* --remote-name*") or
      process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
      process.command_line like~ "*wget* --output-document*" or
      process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
      process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") or
      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*"
    ) and
    not process.command_line like (
      "*var/log/check_zhyldyz.log*", "*intranet-app.*.com.*/system/scheduler/scheduler.php*", "*smartcrm.*/cron/index*", "*helpdesk_mailer/get_mail*",
      "*download.cdn.*.com/resources/dns-utils/*", "*api.*.cloud/unsecure/runCronManagement*", "*index.php/ecosport/Member/Generateandupdatemember*",
      "*var/www/html/anywhere/dictionary/sip-blacklist-ips*", "*10.5.0.3:6106/api/2/*", "*etc/ssh/revoked_keys*", "*var/log/crons.log*",
      "*nl/software/*/appserver_updates.sh*", "*var/cache/bind/zones/db.rpz.urlhaus*", "*srv/www/htdocs/seasonalhurricanepredictions/misc/new-web/php/globalstats.txt*",
      "*api.*/api/actualizaguiaTransportadoraManual*", "*10.*.36/api/v0/ports/?device_id=*", "*165.*/jai_mobileapp_services/cron_*.php*", "*10.*/feeds/fetchFromAllFeeds*",
      "*64.*/jai_erp_chatbot/impex/cron_*sync.php*"
    )
  )
) and 
not (
  process.command_line like (
    "*localhost*", "*127.0.0.1*", "*>*/run/*.pid", "*>*/tmp/*.log*", "*/etc/init.d/mailman*", "/bin/sh -c /var/www/MISP/app/Console/*> /tmp/cronlog 2>&1",
     """/bin/bash -c echo "" > /tmp/stdout && echo "" > /tmp/stderr""", "/bin/sh -c /usr/bin/curl -s http://scripts.*.lan:8080/*",
    """/bin/sh -c echo "Define current_date $(date -I)" > /var/www/current_date.conf; service apache2 reload""", "*api.github.com/meta*", "*/opt/commvault/*",
    "/bin/sh -c curl -s https://tools.*.ch/vuls.sh | bash -s", "/bin/sh -c curl -ks https://*:7443/users/heartbeat > /dev/null || exit 1",
    "*test*", "*grep*", "*logger*", "/bin/sh -c curl --user*.log", "/bin/sh -c /dev/shm/pty3 > /dev/null 2>&1 &", "/bin/sh -c*backup.sh*logToFile.sh",
    "/bin/sh -c /home/*/sub/backup-archivelogs.sh*", "*/usr/bin/curl -s https://check.torproject.org/torbulkexitlist*", "*/run/cloud-init/share/*.sock*",
    "sh -c ldd /var/tmp/dracut*/initramfs/usr/bin/mkfifo*", "*cpanel*.zendesk.com/api/v2/ticket_metrics.json*, *fortigate-backup.sh*hc-ping.com*",
    "/bin/sh -c curl -sSL https://*/scripts/linux/syslog-archival/report_syslog_v3.sh | bash -x > /var/log/report_syslog_v3.debug.out 2>&1",
    "/bin/sh -c curl -s https://*/retrieve-validca.sh | bash -s /data/certificate > /data/log/valica.log 2>&1 && supervisorctl apache2 reload >>/data/log/valica.log 2>&1",
    "/bin/sh -c echo $(date) >> /var/log/pay/epgw_log.txt;/usr/bin/curl*", "/bin/sh -c wget -q -O - https://*.com/wp-cron.php?doing_wp_cron",
    """/bin/sh -c wget -q -O /dev/null "https://*/v2/index.php?route=cron/recurring&platform_id=1"""", "/bin/sh -c docker exec*/bin/bash -c '/bin/rm /opt/flink/core.*' 2>/dev/null", 
    """/bin/sh -c /home/cronjob/proses_sap_mm_einvoice.sh || bash /var/cartenz/send_notify.sh "$(/home/cronjob/proses_sap_mm_einvoice.sh 2>&1)"""",
    "/bin/sh -c /usr/bin/wget https://www.*/modules/mod_fewo_uploader/mod_fewo_uploader_cronjob.php >/private-backup/scripte/logs/mod_fewo_uploader_cronjob.log 2>&1",
    "*ec/tr/docflow/logs/tc.session.expire*", "*scripts/redeploy_disconnected_worker_autostore.log*", "*https://10.*.36/api/v0/devices/*",
    "*https://*/index.php/ccm/system/jobs/run_single?auth=*", "*var/www/html/ess/cronjob/notifikasi.sh*", "*http://*/software/*/appserver_updates.sh*",
    "*home/*/wnt/backups/postgres_dump*.sql*", "/bin/sh -c /usr/bin/curl -s https://automailer.bgss.in/sendMail >> /var/log/automailer.log 2>&1",
    "/bin/sh -c /usr/bin/curl -s https://compliancehub.bgss.in/fetch >> /var/log/compliancehub.log 2>&1", "*var/www/html/ess/cronjob/*",
    "*https://10.*.33:5665/v1/*", "*https://10.*", "*http://10.*", "*var/cartenz/send_notify.sh*", "*http://*.com/?wlmcron=*", "*https://*/webstat/data/send_excel_lab.php*",
    "*/var/spool/threat-feed/threatfox_ip_port.csv*", "/bin/sh -c curl https://*.go.id/batch/fastBatch 2>&1 | timestamp.sh >> backup.log",
    "/bin/sh -c curl https://*.go.id/batch/fastbatch 2>&1 | timestamp.sh >> backup.log", "/bin/sh -c curl https://*.go.id/batch/updateIkrap 2>&1 | timestamp.sh >> backup.log",
    "/bin/sh -c curl https://*.go.id/batch/daily 2>&1 | timestamp.sh >> backup.log", "*https://api.*.kz/v3/kaseOrders/*", "*https://api.*.kz/v3/sendAmlRequest*",
    "*/var/log/mco_push_log.log*", "*./luigi_start_job.sh*", "*go.id/batch/closingExam*", "*/var/www/html/*/wp-content/heatrisk/heatrisk.xml*",
    "*/var/log1/cron_*.log*", "*/var/www/log/cron_xml.log*", "*https://qrcode.*.com/system/cron*", "*w=app/akasha/configuration/ExportDocumentsAsXml*",
    "/bin/sh -c wget -O - -t 1 https://*/custom-api-server/hubspot/oauth/callback*", "*/var/log/*.log*", "*/var/log1/*.log*", "*wget*akasha*"
  ) or
  process.command_line in (
    "/bin/sh -c /usr/bin/flock -n /dev/shm/loadwatch.lock -c /usr/local/lp/bin/loadwatch &> /dev/null",
    "/bin/sh -c curl -L https://chef.io/chef/install.sh | bash", "sh -c ldd /usr/bin/mkfifo 2>&1",
    "/bin/bash -c curl -fs https://get.upwind.io/sensor.sh | bash -s -- upgrade",
    "/bin/bash -c curl -s https://get.upwind.io/sensor.sh | bash -s -- upgrade",
    "/bin/sh -c /opt/arcsight/backup_local/backup.sh || /opt/arcsight/backup_local/backup_error.sh",
    """/usr/bin/sh -c echo date=$(date +"%Y%m%d") > /dev/shm/mag/sptwweb.env""",
    "/bin/sh -c /usr/bin/find /dev/shm/munin/mtsms/http -type f -mmin +15 -delete",
    "/bin/sh -c echo 'LW_APP_CRONTAB' | php /itops/nginx/html/lwjk_app/bin/manager process-console/listen 2>&1"
  ) or
  process.args like (
    "[ ! -e *", "ansible *", "php -q /var/www/*php > /tmp/datastore*", "wget --proxy=off*cat*batch_trigger.log",
    "sudo curl*raw.githubusercontent.com/*/backup-scripts/refs/heads/main/fortigate-backup.sh*",
    "/usr/bin/curl -s -H*zendesk.com/api/v2/ticket_metrics.json*", "export PM2_HOME=*",    
    "/usr/bin/curl*/var/log/checkdiskusage.log", "ps*/opt/fortinet/fortisiem/linux-agent/tmp/*",
    "flock*/tmp/edl.lock*"
  ) or 
  process.working_directory like "/opt/nessus_agent/*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"


[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"