Unusual Command Execution via Systemd Scheduled Task

[rule]
description = """
This rule detects the execution of suspicious commands and executables by systemd scheduled tasks. Threat actors may
abuse these scheduled tasks to execute malicious commands or scripts to maintain persistence or escalate privileges.
"""
id = "3ac60981-20ef-4dac-b7e4-aad2ac56a93e"
license = "Elastic License v2"
name = "Unusual Command Execution via Systemd Scheduled Task"
os_list = ["linux"]
reference = [
    "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.6"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name == "systemd" and 
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "pwsh", "mksh") and
process.args in ("-c", "--command", "-lc", "-cl") and (
  process.command_line like~ (

    /* Encoding, Decoding & Piping */
    "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
    "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
    "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
    "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",

    /* Reverse Shell CLIs */
    "*/dev/tcp*", "*/dev/udp/*", "*import*pty*spawn*", "*import*subprocess*call*", "*TCPSocket.new*", "*TCPSocket.open*",
    "*io.popen*", "*os.execute*", "*fsockopen*", "*socat*exec:*", "*socat*tcp-connect*",

    /* File Manipulation */
    "*/dev/shm/*",
    "*> /tmp/*", "*>> /tmp/*", "*>/tmp/*", "*>>/tmp/*",  
    "*> /var/tmp/*", "*>> /var/tmp/*", "*>/var/tmp/*", "*>>/var/tmp/*",
    "*> /run/user/*", "*>> /run/user/*", "*>/run/user/*", "*>>/run/user/*",
    "*> /var/run/user/*", "*>> /var/run/user/*", "*>/var/run/user/*", "*>>/var/run/user/*",

    /* Persistence */
    "*>*/etc/cron*", "*>*/home/*/.ssh/*", "*>*/root/.ssh*", "*>*~/.ssh/*", "*>*/etc/shadow*", "*>*/etc/passwd*",
    "*>*/etc/master.passwd*", "*chpasswd*", "*NOPASSWD:ALL*>*sudoers.d*", "*>*/etc/systemd/system/*[Unit]*ExecStart*",
    "*| crontab -*",

    /* Miscellaneous */
    "* setsid *", "*timeout *sh -c *", "*disown*",  "*chattr *", "busybox *", "*chmod +x *", "*chmod 777*", 
    "*<?php*?>*", "*kworker*", "*stty*raw*-echo*", "*mkfifo /tmp/*"
  ) or
  (
    process.command_line like ("*curl *", "*wget *") and (
      process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
      process.command_line like~ ("*curl* --output*", "*curl* --remote-name*") or
      process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
      process.command_line like~ "*wget* --output-document*" or
      process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
      process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") or
      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*"
    )
  )
) and 
not (
  process.command_line like (
    "*localhost*", "*127.0.0.1*", "*>*/run/*.pid", "*>*/tmp/*.log*", "*/etc/init.d/mailman*", "/bin/sh -c /var/www/MISP/app/Console/*> /tmp/cronlog 2>&1",
     """/bin/bash -c echo "" > /tmp/stdout && echo "" > /tmp/stderr""", "/bin/sh -c /usr/bin/curl -s http://scripts.*.lan:8080/*",
    """/bin/sh -c echo "Define current_date $(date -I)" > /var/www/current_date.conf; service apache2 reload""", "*api.github.com/meta*", "*/opt/commvault/*",
    "/bin/sh -c curl -s https://tools.*.ch/vuls.sh | bash -s", "/bin/sh -c curl -ks https://*:7443/users/heartbeat > /dev/null || exit 1",
    "*test*", "*grep*", "*logger*", "/bin/sh -c curl --user*.log", "/bin/sh -c /dev/shm/pty3 > /dev/null 2>&1 &", "/bin/sh -c*backup.sh*logToFile.sh",
    "/bin/sh -c /home/*/sub/backup-archivelogs.sh*", "*/usr/bin/curl -s https://check.torproject.org/torbulkexitlist*", "*/run/cloud-init/share/*.sock*",
    "sh -c ldd /var/tmp/dracut*/initramfs/usr/bin/mkfifo*", "*cpanel*.zendesk.com/api/v2/ticket_metrics.json*, *fortigate-backup.sh*hc-ping.com*",
    "/bin/sh -c curl -sSL https://*/scripts/linux/syslog-archival/report_syslog_v3.sh | bash -x > /var/log/report_syslog_v3.debug.out 2>&1",
    "/bin/sh -c curl -s https://*/retrieve-validca.sh | bash -s /data/certificate > /data/log/valica.log 2>&1 && supervisorctl apache2 reload >>/data/log/valica.log 2>&1",
    "bash -c chmod +x /opt/forticlientems/bin/ubuntu24_upgrade_check.sh && /opt/forticlientems/bin/ubuntu24_upgrade_check.sh", "/bin/sh -c /bin/chmod 777 /upload/cms-embossing/*",
    """/bin/sh -c /usr/bin/timeout 60 /bin/sh -c 'while ! /usr/bin/timeout 1 /usr/bin/host www.*.com >/dev/null 2>&1; do /bin/sleep 0.1; done' && /bin/echo "DNS works!"""",
    "*.gr/index.php?option=com_acymailing&ctrl=cron*", "*_sync_last_success_timestamp_seconds*10.10.20.204:9091/metrics*", "*get.upwind.io/sensor.sh*",
    "*/opt/traps/download/contents/*/km_extractor*", "/bin/sh -c /usr/bin/wget -O - -q -t 1 http://*.ultimatebeautywisdom.com/?wlmcron=1",
    "/bin/bash -c wget -O /dev/null https://*/api/cronjob_late_fee_fine >/dev/null 2>&1",
    "/bin/bash -c wget -O /dev/null https://*/system_admin/c_cron/school_package_subscription_cron >/dev/null 2>&1",
    "/bin/bash -c wget -O /dev/null https://*/system_admin/c_cron/db_backup >/dev/null 2>&1"
  ) or
  process.command_line in (
    "/bin/sh -c /usr/bin/flock -n /dev/shm/loadwatch.lock -c /usr/local/lp/bin/loadwatch &> /dev/null",
    "/bin/sh -c curl -L https://chef.io/chef/install.sh | bash", "sh -c ldd /usr/bin/mkfifo 2>&1",
    "/bin/bash -c curl -fs https://get.upwind.io/sensor.sh | bash -s -- upgrade",
    "/bin/bash -c curl -s https://get.upwind.io/sensor.sh | bash -s -- upgrade",
    "/bin/sh -c /opt/arcsight/backup_local/backup.sh || /opt/arcsight/backup_local/backup_error.sh",
    """/usr/bin/sh -c echo date=$(date +"%Y%m%d") > /dev/shm/mag/sptwweb.env""",
    "/bin/bash -c curl -fsSLO https://get.upwind.io/sensor.sh && echo \"$(curl -fsSL https://get.upwind.io/sensor.sh.sha256)  sensor.sh\" | sha256sum -c - && bash sensor.sh upgrade",
    "/bin/bash -lc timeout 45 /usr/bin/claude --model claude-haiku-4-5 -p \"reply: pong\" > /tmp/claude-quota-refresh.last 2>&1 || true",
    "/bin/sh -c echo \"$(date) $(whoami)\" >>/tmp/log"
  ) or
  process.args like (
    "[ ! -e *", "ansible *", "php -q /var/www/*php > /tmp/datastore*", "wget --proxy=off*cat*batch_trigger.log",
    "sudo curl*raw.githubusercontent.com/*/backup-scripts/refs/heads/main/fortigate-backup.sh*",
    "/usr/bin/curl -s -H*zendesk.com/api/v2/ticket_metrics.json*", "export PM2_HOME=*",    
    "/usr/bin/curl*/var/log/checkdiskusage.log", "ps*/opt/fortinet/fortisiem/linux-agent/tmp/*",
    "iostat*/tmp/iostat.cache", "/usr/local/psa/admin/sbin/modules/aast-dnssec/event*",
    "export PATH=/opt/imunify360/venv/bin*alt-php-els/install-els-alt-php-deb-repo.sh*",
    "echo BAS_SERVICE_MARKER > /tmp/bas_service_exec_marker.txt"
  ) or 
  process.working_directory like "/opt/nessus_agent/*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"

[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.002"
name = "Systemd Service"
reference = "https://attack.mitre.org/techniques/T1543/002/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"

[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.002"
name = "Systemd Service"
reference = "https://attack.mitre.org/techniques/T1543/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"