Potential Remote Code Execution via Database Server
Description
This rule detects potential remote code execution attempts via commonly used database server applications, by monitoring for unusual child processes and command line arguments.
Query · eql
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and (
process.parent.name in (
"redis-server", "mongod", "mysqld", "oracle", "tnslsnr", "postgres", "mariadbd", "sqlservr",
"beam.smp", "db2sysc", "clickhouse-server"
) or
(process.parent.name == "redis-check-rdb" and process.parent.command_line like "*redis-server*")
) and
not (
(process.parent.name == "oracle" and process.args like "/bin/grep -q kubepods /proc/self/cgroup*") or
(process.parent.name == "beam.smp" and process.name == "erl_child_setup") or
(process.parent.name == "erl_child_setup" and process.command_line like ("*rabbitmq-env.conf*echo*VARS*set", "inet_gethost 4")) or
(process.name == "epmd" and process.command_line == "epmd -daemon")
) and
(
process.name in (
"scp", "gzip", "bzip2", "xz", "tar", "getcap", "capsh", "nohup", "setsid", "timeout", "disown",
"mkfifo", "printenv", "env", "chpasswd"
) or
process.name like ".*" or
(
process.name in ("whoami", "id", "hostname", "uname", "ps", "netstat", "ss", "ip", "ifconfig") and
process.interactive == true and process.parent.interactive == false
) or
process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*", "/root/*", "./*") or
(
process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and (
process.args == "-c" or
(
process.args_count <= 2 and
process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/www/*", "/root/*", "/home/*/*", "./*.py") and
process.args like "*.py*"
)
) and
not process.args in ("--version", "app.py")
) or
(
process.executable like (
"/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
"/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
"/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
"/bin/node", "/usr/bin/node", "/usr/local/bin/node"
) and
(process.args like "-e*" or process.args_count <= 2)
) or
(
process.executable like ("/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*") and
(process.args like "-r*" or process.args_count <= 2) and
not (
process.args like "var_export*" or
process.command_line in ("php -r echo get_current_user().PHP_EOL;", "php -r echo date('T');")
)
) or
(
process.name in ("nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd", "nc.traditional") and (
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
process.command_line like "*http*"
) and
not process.args in ("localhost", "127.0.0.1", "-z", "-zv")
) or
(
process.name == "socat" and
process.command_line like~ ("*exec*", "*tty*", "*fork*", "*file*", "*open*") and
process.command_line like~ ("*tcp*", "*udp*", "*openssl*")
) or
(
process.name == "openssl" and (
process.command_line like ("*s_server*", "*s_client*") or
(process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A"))
)
) or
(
process.name in ("curl", "wget") and process.args like~ ("-o", "--output*", "-o-") and (
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" or
process.command_line like "*http*"
) and
process.command_line like ("* /tmp/*", "* /var/tmp/*", "* /dev/shm/*", "* /var/www/*", "* ~/*", "* /home/*", "* /run/*", "* /var/run/*")
) or
(
process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
process.args like~ "-*d*"
) or
(
process.name == "xxd" and process.args like~ ("-*r*", "-*p*")
) or
(process.name == "sudo" and process.args == "-l") or
(
process.executable like ("/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod") and
process.args like ("+x", "a+x", "0777", "755", "777", "+s", "u+s", "g+s")
) or
(
process.executable like ("/bin/cat", "/usr/bin/cat", "/usr/local/bin/cat") and
process.args like (
"/etc/passwd", "/etc/shadow", "/etc/hostname", "/etc/hosts", "*ssh*", "/proc/self/environ",
"*.env*", "*../../../*", "*/secrets/kubernetes.io/serviceaccount/*", "*/.docker/config.json*",
"*/.npmrc*", "*.aws/credentials*", "*/.aws/config*"
)
) or
(
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
process.command_line like (
/* Suspicious Paths */
"* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /var/www/*", "* /run/*", "* /var/run/*",
/* Interpreter Execution */
"*python* -c*", "*php* -r*", "*perl* -e*", "*ruby* -e*", "*lua* -e*", "*node * -e *",
/* Encoding, Decoding & Piping */
"*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*", "*| zsh*", "*|dash*", "*| dash*",
"*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
"*|node*", "*| node*", "*|lua*", "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
"*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
/* Reverse Shells */
"*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
/* File Access */
"*>*/etc/cron*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*", "*/etc/passwd*", "*chpasswd*",
/* Helpers */
"*nohup*", "*setsid *", "*timeout *sh -c *", "*disown*", "*env *sh *-c*",
/* Miscellaneous */
"*chattr *", "*busybox *", "*#!*", "*chmod +x *",
/* Decompression */
"*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
/* Path Traversal */
"*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*"
) or
(
process.command_line like ("*wget *", "*curl *") and
(
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*" or
process.command_line like ("*http*", "*ftp*")
) and
(
(
process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+|\-.*)?""" or
process.command_line like~ ("*curl* --output*", "*curl* --remote-name*")
) or
(
(
process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
process.command_line like~ "*wget* --output-document*"
) and
not process.command_line like """*--output-document "-"*"""
) or
process.command_line like ("*|*sh*", "*|*python*", "*|*php*", "*|*perl*", "*|*ruby*", "*|*node*", "*|*lua*", "*|*busybox*") or
(
process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") and
not process.command_line like ("*> /dev/null*", "*>/dev/null*", "*curl*/etc/cobra/*/uploads/whatsapp/*")
)
) and
not process.command_line like ("*-O /dev/null*", "*-o /dev/null*")
)
)
)
) and
not (
process.executable like ("/tmp/newroot/*", "./runc") or
process.command_line == "sh -c locale -a" or
process.args == "/usr/bin/env" and process.args in ("check_postgres.pl", "/usr/lib/pscheduler/commands/validate-configurables") or
(
process.parent.executable == "/etc/init.d/redis-server" and
process.command_line in ("chmod 755 /var/run/redis", "touch /var/run/redis/redis-server.pid")
) or
(
process.parent.name == "postgres" and
process.command_line in (
"ps -p 1", "python2 -c pass", "timeout 5 cat /proc/net/tcp /proc/net/tcp6", "runc init", "env hostname -s",
"find . -maxdepth 1 -mindepth 1 -type d", "netstat -an"
)
) or
(
process.parent.name in ("postgres", "oracle", "tnslsnr") and
process.command_line like (
"echo nagios", "gzip -c", "/usr/bin/python3 /root/bin/yaml2json.py", "sh -c /*/scripts/check/libexec/check_df*",
"timeout --signal=3 3 telnet*", "sh -c scp*pg_wal/RECOVERYHISTORY*", "sh -c scp*pg_wal/RECOVERYXLOG*",
"env LC_ALL=C /bin/bash -c [ -f /sbin/ifconfig ] && echo 1 || echo 0"
)
) or
(
process.parent.name == "tnslsnr" and (
process.command_line like (
"/usr/bin/python3 /root/bin/yaml2json.py", "/bin/echo Filesystem 1024-blocks*", "timeout 60 ls", "timeout 10 lsblk -lbSo SIZE,TYPE"
) or
process.name in ("printenv", "env", "find", "gzip")
)
) or
(
process.parent.name == "postgres" and (
process.args like "scp*pgsql*" or
(process.name == "scp" and process.command_line like "*pgsql*") or
process.name == "uname"
)
) or
(
process.parent.name == "mysqld" and
process.command_line in ("touch /var/log/mysqld.log", "touch /var/lock/subsys/mysql")
)
)