IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Suspicious Interactive Shell Spawned From Inside A Container SSH Connection Established Inside A Running Container »
Elastic Docs ›Elastic Security Solution [8.8] ›Downloadable rule update v8.8.2

Netcat Listener Established Inside A Container

edit

Netcat Listener Established Inside A Container

edit

This rule detects an established netcat listener running inside a container. Netcat is a utility used for reading and writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for persistence or exfiltrating data.

Rule type: eql

Rule indices:

  • logs-cloud_defend*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • Elastic
  • Host
  • Linux
  • Threat Detection
  • Execution
  • Container

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
process where container.id: "*" and event.type== "start"
and event.action in ("fork", "exec") and
(
process.name:("nc","ncat","netcat","netcat.openbsd","netcat.traditional") or
/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
process.args: ("nc","ncat","netcat","netcat.openbsd","netcat.traditional")
) and (
          /* bind shell to echo for command execution */
          (process.args:("-*l*", "--listen", "-*p*", "--source-port") and process.args:("-c", "--sh-exec", "-e", "--exec", "echo","$*"))
          /* bind shell to specific port */
          or process.args:("-*l*", "--listen", "-*p*", "--source-port")
          )

Framework: MITRE ATT&CKTM

« Suspicious Interactive Shell Spawned From Inside A Container SSH Connection Established Inside A Running Container »