Shared Memory File Turned Executable by Suspicious Parent

[rule]
description = """
Detects when a file located in the shared memory directory is made executable using chmod via an abnormal or suspicious
parent process. Malware will often drop a second stage payload or file and will need to make it executable before
invoking it.
"""
id = "742037b3-3ef6-4a33-84ed-b26fc6ae322c"
license = "Elastic License v2"
name = "Shared Memory File Turned Executable by Suspicious Parent"
os_list = ["linux"]
version = "1.0.11"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "chmod" and
process.args in ("4755", "755", "777", "0777", "+x", "a+x") and
process.args like "/dev/shm/*" and process.parent.executable != null and
not (
  (
    process.parent.executable == "/etc/init.d/nagios" and
    process.args in ("/dev/shm/tmp", "/dev/shm/var", "/dev/shm/checkresults")
  ) or
  process.parent.executable == "./install-attachment-registration-manager.sh" or
  process.parent.command_line == "runc init" or
  (
    process.working_directory like "/tmp/selfgz*" and
    process.parent.args ==  "./install-attachment-registration-manager.sh" and
    process.command_line == "chmod 777 /dev/shm/check-point"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"
[[threat.technique.subtechnique]]
id = "T1222.002"
name = "Linux and Mac File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/002/"


[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"