Potential Linux Tunneling or Port Forwarding via SSH

[rule]
description = """
This rule monitors for the use of SSH to potentially tunnel network traffic. Attackers can leverage SSH to establish
hidden communication channels and gain unauthorized access to internal resources, facilitating data exfiltration,
lateral movement, and remote control.
"""
id = "260c06cf-5ad8-4809-bca3-94828796e241"
license = "Elastic License v2"
name = "Potential Linux Tunneling or Port Forwarding via SSH"
os_list = ["linux"]
reference = ["https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding"]
version = "1.0.7"

query = '''
process where event.type == "start" and event.action == "exec" and
process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*", "/root/*", "/boot/*", "./*") and
(
  (
    process.name == "sshuttle" and
    process.args in ("-r", "--remote", "-l", "--listen")
  ) or
  (
    (
      process.name == "ssh" or
      (
        process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
        process.args like "ssh*"
      )
    ) and
    (
      (
        process.args == "-J" or
        (
          (
            process.args in ("-R", "-L", "-D", "-w") or
            process.args regex """\-[A-NP-Za-np-z][A-Za-z]*[RLDwW][A-Za-z]*"""
          ) and
          process.args_count >= 4
        )
      ) or
      (
        process.args like "-o*" and
        process.command_line like~ (
          "*ProxyCommand*", "*LocalForward*", "*RemoteForward*", "*DynamicForward*", "*Tunnel*", "*GatewayPorts*",
          "*ExitOnForwardFailure*", "*ProxyJump*"
        )
      )
    )
  )
) and
not (
  process.parent.executable like (
    "/home/*/.local/bin/ansible-playbook", "/tmp/newroot/*", "/home/*/.local/share/JetBrains/Toolbox/bin/jetbrains-toolbox",
    "/home/*/sp/bin/forwards", "/home/*globusconnectpersonal*/bin/relaytool", "/home/*/bin/minikube/minikube-linux-amd64",
    "/home/*/google-cloud-sdk/platform/bundledpythonunix/bin/python3", "/home/*/.local/share/uv/python/cpython-*-linux-x86_64-gnu/bin/python3.*",
    "/home/*/.ssh/evolutixtunnelaws.sh", "/home/*/core3/dh/plz-out/bin/security/woodhouse/authenticator/authenticator",
    "/home/*/.local/vscode-insiders/usr/share/code-insiders/code-insiders", "/tmp/*/globusconnectpersonal-*/gt_amd64/bin/relaytool",
    "/home/*/.local/share/antigravity-ide/antigravity-ide", "/home/*/bin/minikube/minikube", "/home/*/.local/bin/codex",
    "/home/*/.nvm/versions/node/*/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex",
    "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl"
  ) or
  process.parent.command_line like (
    "/home/*/repositories/synthetic-datasets/.venv/bin/python3 -c from multiprocessing.spawn import spawn_main; spawn_main(*) --multiprocessing-fork",
    "SkyPilot:executor:*"
  ) or
  (process.parent.args == "./deployment.sh" and process.working_directory like "/tmp/builds/*/metis/minerva/minerva-api") or
  (process.parent.executable like "/home/*/.pyenv/versions/*/bin/python*" and process.working_directory like "/home/*/Projects/backport/ansible-*") or
  (
    process.parent.executable like ("/home/*/software/crux/bin/reverse_tunnel.sh", "/home/*/software/crux/bin/ssh") and
    process.executable like ("/home/*/software/crux/bin/ssh", "/usr/bin/ssh")
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"