Environment Variable Secret Collection

[rule]
description = """
Identifies the execution of the env or printenv commands followed by a grep command to collect environment variable
secrets. This is a common technique used by attackers to collect sensitive information from the environment.
"""
id = "4fab1a5b-18c4-4f7b-91dd-7ac8a08e5762"
license = "Elastic License v2"
name = "Environment Variable Secret Collection"
os_list = ["linux", "macos"]
reference = [
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("env", "printenv") and
process.parent.command_line like ("* env*|*grep*", "* printenv*|*grep*") and
process.parent.command_line like~ (
  "*azure*", "*kube*", "*k8s", "*aws*", "*database*", "*db_*", "*mysql*", "*postgres*", "*mongo*", "*redis*",
  "*vault*", "*password*", "*passwd*", "*pwd*", "*secret*", "*token*", "*apikey*", "*api.key*", "*access_key*",
  "*private_key*", "*client_secret*", "*credential*", "*auth*", "*gcp*", "*google*", "*kubernetes*", "*service_account*"
) and
not (
  /* Exclude unrelated Gen-AI command lines */
  length(process.parent.command_line) >= 100 or
  process.parent.args in ("env|grep -i \"^shell=\"", "env | grep ^PATH=", "env|grep -i '^shell='") or
  process.args == "/usr/local/bin/pm2"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"
[[threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"


[[threat.technique]]
id = "T1119"
name = "Automated Collection"
reference = "https://attack.mitre.org/techniques/T1119/"


[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "7.15.0"