[rule]
description = """
Identifies processes that are capable of downloading files with command line arguments containing URLs to
HackersChoice's tools. These tools are often used by threat actors to gain access to systems.
"""
id = "cb351778-7329-4de9-82b5-6705f772a3af"
license = "Elastic License v2"
name = "Potential HackersChoice Tool Downloaded"
os_list = ["linux"]
reference = ["https://github.com/hackerschoice"]
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget") and
process.command_line like~ ("*github.com/hackerschoice/*", "*thc.org/*", "*nossl.segfault.net/*", "*gsocket.io/*")
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.004"
name = "SSH"
reference = "https://attack.mitre.org/techniques/T1021/004/"
[[threat.technique]]
id = "T1563"
name = "Remote Service Session Hijacking"
reference = "https://attack.mitre.org/techniques/T1563/"
[[threat.technique.subtechnique]]
id = "T1563.001"
name = "SSH Hijacking"
reference = "https://attack.mitre.org/techniques/T1563/001/"
[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[internal]
min_endpoint_version = "7.15.0"