Execution of Memory File Descriptor via Suspicious Process

[rule]
description = """
This rule detects when a process executes a file descriptor in the proc (temporary) file system. This activity indicates
an active attempt to execute a fileless payload and should be considered highly abnormal or suspicious. This activity
can occur when the memfd syscall is utilized to create a memory resident file, like a payload, and then uses it to
execute a process via a command and control channel.
"""
id = "dccab9ab-1b40-4d52-85ed-cb41310b0160"
license = "Elastic License v2"
name = "Execution of Memory File Descriptor via Suspicious Process"
os_list = ["linux"]
reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and (
  process.executable regex """/proc/(self|[0-9]{1,7})/fd/[0-9]{1,7}""" or
  (
    process.args regex """/proc/(self|[0-9]{1,7})/fd/[0-9]{1,7}""" and
    process.executable like (
      "memfd:*", "?memfd:*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/user/*", "/var/run/user/*",
      "/boot/*", "/sys/*", "/lost+found/*", "/proc/*", "/var/mail/*", "/root/*"
    )
  )
) and
not (
  process.parent.executable like (
    "/home/*/*steam*", "/usr/bin/podman", "./usr/bin/podman", "/dev/.buildkit_qemu_emulator",
    "/opt/omni/bin/drim/linux-amd64/coolie", "/usr/lib/systemd/systemd", "/usr/libexec/nordlayer/nordlayer-setcap",
    "/usr/bin/nordlayer", "/home/*/playground/general/edgeless/tools/contrast", "/bin/nvidia-cdi-hook",
    "/usr/bin/nvidia-ctk", "/sbin/apk", "/tmp/newroot/usr/bin/podman", "/usr/libexec/nordlayer/nordlayer-resolvconf",
    "/usr/sbin/docker-runc", "/usr/bin/runc", "/opt/teleport/system/bin/teleport", "/usr/local/bin/teleport",
    "/opt/sophos-spl/plugins/runtimedetections/bin/runtimedetections*", "/opt/fireeye/bin/rte-sensor", "/usr/local/sbin/thor-cloud-*",
    "/tmp/newroot/run/media/mm1/RIG_Drive_2/SteamLibrary/steamapps/common/SteamLinuxRuntime_4/pressure-vessel/bin/pressure-vessel-wrap",
    "/tmp/newroot/bin/sh", "/opt/sophos-spl/base/bin/launcher", "/usr/bin/containerd-shim-runc-v2", "/opt/sophos-spl/base/bin/sophos_watchdog.*"
  ) or
  process.executable like (
    "./home/*/.local/share/claude/versions/*", "/tmp/newroot/usr/bin/ls", "/tmp/newroot/var/lib/docker/rootfs/overlayfs/*/usr/bin/chown",
    "/tmp/newroot/*"
  ) or
  process.command_line like (
    "runc init", "/usr/local/bin/runc init", "*/home/*/.claude/shell-snapshots/snapshot*",
    "/proc/self/fd/? -config /etc/nordlayer/config.hcl", "storage-untar / /proc/self/fd/*",
    "/proc/self/exe init"
  ) or
  process.parent.command_line == "/opt/teleport/system/bin/teleport exec" or
  (
    process.parent.command_line == "/usr/local/bin/teleport exec" and
    process.command_line == "/memfd:teleport-sessionhelper checkhomedir"
  ) or
  (
    process.command_line like "/usr/lib/podman/netavark --config /run/containers/networks --rootless=false --aardvark-binary=/usr/lib/podman/aardvark-dns *" and
    process.args == "/usr/lib/podman/netavark"
  ) or
  (
    process.args == "lxc-attach" and
    process.args == "-n"
  ) or
  (
    process.parent.executable in ("/bin/php", "/usr/bin/php") and
    process.args == "datadog-ipc-helper"
  ) or
  process.args like ("/usr/lib/systemd/systemd-executor", "/nix/store/*/lib/systemd/systemd-executor") or
  (
    process.executable like (
      "/tmp/newroot/proc/self/exe", "/tmp/newroot/home/*/.local/share/containers/storage/overlay/*/merged/proc/self/exe",
      "./usr/bin/podman"
    ) and
    process.args == "storage-untar"
  ) or
  (
    process.parent.executable == "/usr/libexec/docker/docker-runc-current" and
    process.command_line == "/proc/self/exe init"
  ) or
  (
    process.parent.executable == "/opt/sentinelone/bin/addon-host" and
    process.args like "/opt/sentinelone/addons/executables/SentinelAppVulnerability/*"
  ) or
  (
    process.executable == "memfd:spawn_worker_trampoline" and
    process.parent.executable == "/usr/local/bin/php"
  ) or
  (
    process.executable like "/tmp/agy-nsjail-exe-*" and
    process.parent.executable like "/home/*/resources/app/extensions/antigravity/bin/language_server_linux_x64"
  ) or
  (
    process.working_directory like "/var/lib/docker/overlay2/*/merged" and
    process.command_line == "/proc/self/exe init"
  ) or
  (
    process.executable == "memfd:spawn_worker_trampoline" and
    process.args == "datadog-ipc-helper"
  )
)
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"