Unusual SSH Parent/Child Execution

[rule]
description = """
This rule detects the execution of a process from an unusual location, immediately after an SSH process is started. This
could indicate an attacker attempting to execute a malicious process in the context of an SSH session, or a successfully
planted backdoor within a user shell configuration.
"""
id = "94f548c8-cad2-4bc5-bf61-c0e42558ef65"
license = "Elastic License v2"
name = "Unusual SSH Parent/Child Execution"
os_list = ["linux"]
version = "1.0.17"

query = '''
sequence with maxspan=3s
  [process where event.type == "start" and event.action == "exec" and process.parent.name in ("sshd", "ssh") and
   not process.executable like ("/run/*/newroot/*", "/srv/snp/docker/*", "/tmp/newroot/*")
  ] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and process.executable like (
    "./*", "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/run/*", "/srv/*",
    "/tmp/*", "/var/tmp/*", "/var/log/*"
    ) and process.args_count == 1 and not (
      process.executable like~ (
        "/tmp/VeeamApp*", "/run/containerd/io.containerd.runtime.v2.task/k8s.io/*", "/tmp/.mount_nvim.*",
        "./merged/var/lib/containers/*", "/run/systemd/mount-rootfs/*", "./merged/*/containers/*",
        "/run/k3s/containerd/io.containerd.runtime.v2.task/*", "/tmp/.mount_*", "/tmp/usr/bin/groups",
        "./merged/usr/bin/clear"
      ) or
      process.parent.executable like (
        "./merged/bin/bash", "/tmp/nsjail*", "/run/user/1000/nsjail/*", "/usr/bin/run-parts", "/usr/bin/env"
      ) or
      process.parent.command_line in (
        "bash -c /bin/bash; uname -a &> /dev/null",
        "sh -c /usr/local/bin/sshd-with-logs"
      ) or
      process.parent.name == "jem" or
      process.name == "sestatus" or
      (
        process.parent.command_line == "sudo true" and
        process.command_line == "true"
      )
    )
  ] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"

[[threat.technique]]
id = "T1554"
name = "Compromise Host Software Binary"
reference = "https://attack.mitre.org/techniques/T1554/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.004"
name = "SSH"
reference = "https://attack.mitre.org/techniques/T1021/004/"


[[threat.technique]]
id = "T1563"
name = "Remote Service Session Hijacking"
reference = "https://attack.mitre.org/techniques/T1563/"
[[threat.technique.subtechnique]]
id = "T1563.001"
name = "SSH Hijacking"
reference = "https://attack.mitre.org/techniques/T1563/001/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "7.15.0"