Skip to content

Commit

Permalink
Sync RTA Potential Process Masquerading via Exec
Browse files Browse the repository at this point in the history
Co-authored-by: shashank-elastic <[email protected]>
  • Loading branch information
protectionsmachine and shashank-elastic authored Oct 22, 2024
1 parent 275c728 commit d1f4427
Show file tree
Hide file tree
Showing 2 changed files with 50 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,11 @@ def main() -> None:

commands = [masquerade, "netcon", "-h", "8.8.8.8", "-p", "53"]
common.execute([*commands], timeout=5, kill=True)

common.log("Cleaning...")

common.remove_file(masquerade)

common.log("Simulation successfull!")


Expand Down
47 changes: 47 additions & 0 deletions rta/linux_defense_evasion_process_masquerading_via_exec.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
# or more contributor license agreements. Licensed under the Elastic License
# 2.0; you may not use this file except in compliance with the Elastic License
# 2.0.

import sys
from . import RtaMetadata, common

metadata = RtaMetadata(
uuid="4e6ded7e-23cb-460c-8a5b-21c5e5e8d6e8",
platforms=["linux"],
endpoint=[
{
"rule_name": "Potential Process Masquerading via Exec",
"rule_id": "e6669bc3-cb75-4fb3-91e0-ddaa06dd59b2",
},
],
techniques=["T1564", "T1059"],
)


@common.requires_os(*metadata.platforms)
def main() -> None:
common.log("Creating a fake executable..")
masquerade = "[foo]"
masquerade2 = "/tmp/sh"

source = common.get_path("bin", "linux.ditto_and_spawn")
common.copy_file(source, masquerade)
common.log("Granting execute permissions...")
common.execute(["chmod", "+x", masquerade])

source = common.get_path("bin", "linux.ditto_and_spawn")
common.copy_file(source, masquerade2)
common.log("Granting execute permissions...")
common.execute(["chmod", "+x", masquerade2])

commands = [masquerade2, masquerade]
common.execute([*commands], timeout=5, kill=True)
common.log("Cleaning...")
common.remove_file(masquerade)
common.remove_file(masquerade2)
common.log("Simulation successfull!")


if __name__ == "__main__":
sys.exit(main())

0 comments on commit d1f4427

Please sign in to comment.