Potential Reverse Shell Activity via Terminal

edit

Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity.

Rule type: eql

Rule indices:

  • auditbeat-*
  • logs-endpoint.events.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Linux
  • macOS
  • Threat Detection
  • Execution
  • Investigation Guide

Version: 102 (version history)

Added (Elastic Stack release): 7.12.0

Last modified (Elastic Stack release): 8.6.0

Rule authors: Elastic

Rule license: Elastic License v2

Investigation guide

edit
## Triage and analysis

### Investigating Potential Reverse Shell Activity via Terminal

A reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects
the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are
vulnerable since the connection is outgoing. This activity is typically the result of vulnerability exploitation,
malware infection, or penetration testing.

This rule identifies commands that are potentially related to reverse shell activities using shell applications.

#### Possible investigation steps

- Examine the command line and extract the target domain or IP address information.
  - Check if the domain is newly registered or unexpected.
  - Check the reputation of the domain or IP address.
  - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the
  domain or IP address.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network
connections.
- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any
spawned child processes.

### False positive analysis

- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently
malicious must be monitored by the security team.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
systems, and web services.
- Take actions to terminate processes and connections used by the attacker.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
mean time to respond (MTTR).

Rule query

edit
process where event.type in ("start", "process_started") and
process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
process.args : ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*",
"*zsh/net/udp*") and /* noisy FPs */ not (process.parent.name :
"timeout" and process.executable : "/var/lib/docker/overlay*") and
not process.command_line : ("*/dev/tcp/sirh_db/*",
"*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*",
"*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*", "*/dev/tcp/127.*",
"*/dev/udp/127.*", "*/dev/tcp/localhost/*") and not
process.parent.command_line : "runc init"

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 102 (8.6.0 release)
  • Formatting only
Version 101 (8.5.0 release)
  • Formatting only
Version 4 (8.4.0 release)
  • Updated query, changed from:

    process where event.type in ("start", "process_started") and
    process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
    process.args:("*/dev/tcp/*", "*/dev/udp/*", "zsh/net/tcp",
    "zsh/net/udp")
Version 2 (8.2.0 release)
  • Formatting only