Query: detect Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unau in logs
Matching passage: Sigma rule: Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Invocation Via Ssh - Linux id: 8737b7f6-8df3-4bb7-b1da-06019b99b687 status: test description: 'Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/ssh/ - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-08-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /ssh CommandLine|contains: - ProxyCommand=; - permitlocalcommand=yes - localhost selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh - sh 0<&2 1>&2 - sh 1>&2 0<&2 condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior c. Logsource: windows / process_creation. Rule: title: Suspicious Scheduled Task Creation via Masqueraded XML File id: dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c status: test description: Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence references: - https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml- - https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml author: Swachchhanda Shrawan Poudel, Elastic (idea) date: 2023-04-20 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1036.005 - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_create: CommandLine|contains: - /create - -create selection_cli_xml: CommandLine|contains: - /xml - -xml filter_main_extension_xml: CommandLine|contains: .xml filter_main_system_process: IntegrityLevel: - System - S-1-16-16384 filter_main_rundll32: ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - :\WINDOWS\Installer\MSI - .tmp,zzzzInvokeManagedCustomActionOutOfProc filter_optional_third_party: ParentImage|endswith: - :\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe - :\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe - :\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe - :\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe - :\Program Files\Dell\SupportAssist\pcdrcui.exe condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium