Query: rule covering Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse sh
Matching passage: Sigma rule: Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse sh. Logsource: linux. Rule: title: Suspicious Reverse Shell Command Line id: 738d9bcf-6999-4fdb-b4ac-3033037db8ab status: test description: Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell references: - https://alamot.github.io/reverse_shells/ author: Florian Roth (Nextron Systems) date: 2019-04-02 modified: 2021-11-27 tags: - attack.execution - attack.t1059.004 logsource: product: linux detection: keywords: - BEGIN {s = "/inet/tcp/0/ - bash -i >& /dev/tcp/ - bash -i >& /dev/udp/ - sh -i >$ /dev/udp/ - sh -i >$ /dev/tcp/ - '&& while read line 0<&5; do' - /bin/bash -c exec 5<>/dev/tcp/ - /bin/bash -c exec 5<>/dev/udp/ - 'nc -e /bin/sh ' - /bin/sh | nc - 'rm -f backpipe; mknod /tmp/backpipe p && nc ' - ;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))) - ;STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>; - /bin/sh -i <&3 >&3 2>&3 - uname -a; w; id; /bin/bash -i - $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()}; - ;os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv('HISTFILE','/dev/null'); - .to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f) - ;while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print - 'socat exec:''bash -li'',pty,stderr,setsid,sigint,sane tcp:' - rm -f /tmp/p; mknod /tmp/p p && - ' | /bin/bash | telnet ' - ',echo=0,raw tcp-listen:' - 'nc -lvvp ' - xterm -display 1 condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Microsoft Dialer id: 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1 status: test description: 'Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it''s usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys" ' references: - https://tria.ge/240301-rk34sagf5x/behavioral2 - https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/ - https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html author: CertainlyP date: 2024-04-26 tags: - attack.execution - attack.command-and-control - attack.t1071.001 logsource: category: network_connection product: windows detection: selection: Image|endswith: :\Windows\System32\dialer.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives. level: high