Linux Restricted Shell Breakout via the vi command

edit

Linux Restricted Shell Breakout via the vi command

edit

Identifies Linux binary abuse to break out from restricted environments by spawning an interactive system shell. The vi/vim is the standard text editor in Linux distribution. The activity of spawning a shell is not a standard use of this binary by a user or system administrator and could potentially indicate malicious actor attempting to improve the capabilities or stability of their access.

Rule type: eql

Rule indices:

  • logs-endpoint.events.*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Linux
  • Threat Detection
  • Execution
  • GTFOBins

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
process where event.type == "start" and process.parent.name in ("vi", "vim") and process.parent.args == "-c" and process.parent.args in (":!/bin/bash", ":!/bin/sh", ":!bash", ":!sh") and process.name in ("bash", "sh")

Framework: MITRE ATT&CKTM