/
linux_mknod_activity.toml
37 lines (34 loc) · 1.22 KB
/
linux_mknod_activity.toml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
[metadata]
creation_date = "2020/02/18"
deprecation_date = "2021/04/15"
maturity = "deprecated"
updated_date = "2021/04/15"
[rule]
author = ["Elastic"]
description = """
The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits.
It is used to export a command shell when the traditional version of netcat is not available to the payload.
"""
false_positives = [
"""
Mknod is a Linux system program. Some normal use of this program, at varying levels of frequency, may originate from
scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious.
""",
]
from = "now-9m"
index = ["auditbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License v2"
name = "Mknod Process Activity"
references = [
"https://web.archive.org/web/20191218024607/https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem/",
]
risk_score = 21
rule_id = "61c31c14-507f-4627-8c31-072556b89a9c"
severity = "low"
tags = ["Elastic", "Host", "Linux", "Threat Detection"]
timestamp_override = "event.ingested"
type = "query"
query = '''
event.category:process and event.type:(start or process_started) and process.name:mknod
'''