IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Executable Masquerading as Kernel Process Potential Reverse Shell via Child »
Elastic Docs ›Elastic Security Solution [8.11] ›Downloadable rule update v8.11.17

Suspicious which Enumeration

edit

Suspicious which Enumeration

edit

This rule monitors for the usage of the which command with an unusual amount of process arguments. Attackers may leverage the which command to enumerate the system for useful installed utilities that may be used after compromising a system to escalate privileges or move latteraly across the network.

Rule type: eql

Rule indices:

  • logs-endpoint.events.*
  • endgame-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • Domain: Endpoint
  • OS: Linux
  • Use Case: Threat Detection
  • Tactic: Discovery
  • Data Source: Elastic Defend
  • Data Source: Elastic Endgame

Version: 6

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and
process.name == "which" and process.args_count >= 10 and not process.parent.name == "jem" and
not process.args == "--tty-only"

/* potential tuning if rule would turn out to be noisy
and process.args in ("nmap", "nc", "ncat", "netcat", nc.traditional", "gcc", "g++", "socat") and
process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
*/

Framework: MITRE ATT&CKTM

« Executable Masquerading as Kernel Process Potential Reverse Shell via Child »