File Creation or Modification via (Memory) File Descriptor

[rule]
description = """
This rule detects when a process creates a (memory) file descriptor and creates, or modifies, a file. This behavior may
indicate the creation of a second stage payload, after the first fileless stage has executed.
"""
id = "8cc1c545-7cd2-42c0-964c-1e6731b26647"
license = "Elastic License v2"
name = "File Creation or Modification via (Memory) File Descriptor"
os_list = ["linux"]
reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
version = "1.0.3"

query = '''
file where event.type != "deletion" and (
  process.executable regex """/proc/(self|[0-9]{1,7})/fd/[0-9]{1,7}""" or
  process.executable like ("memfd:*", "?memfd:*")
) and
file.path like (
  "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/boot/*",
  "/lost+found/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
) and
not (
  process.executable like ("?memfd:/sophos-subprocess-*-exec*", "memfd:/sophos-subprocess-*-exec*") or
  process.executable in (
    "memfd:spawn_worker_trampoline", "memfd:buildah-chroot-runtime", "memfd:lxc-attach",
    "memfd:teleport-sessionhelper", "memfd:buildah-chroot-exec"
  ) or
  (process.executable == "/memfd: (deleted)" and file.path like "/var/tmp/etilqs_*") or
  file.path like (
    "/tmp/tmp.*", "/tmp/syft-cataloger-*/*", "/home/*/.local/state/wireplumber/*",
    "/run/user/0/systemd/units/invocation:gpg-agent.socket", "/run/user/0/systemd/units/invocation:ssh-agent.socket"
  )
)
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"