execution_netcat_listener_established_inside_a_container.toml

[metadata]
creation_date = "2023/04/26"
integration = ["cloud_defend"]
maturity = "production"
updated_date = "2024/05/21"

[rule]
author = ["Elastic"]
description = """
This rule detects an established netcat listener running inside a container. Netcat is a utility used for reading and
writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for
persistence or exfiltrating data.
"""
false_positives = [
    """
    There is a potential for false positives if the container is used for legitimate tasks that require the use of
    netcat, such as network troubleshooting, testing or system monitoring. It is important to investigate any alerts
    generated by this rule to determine if they are indicative of malicious activity or part of legitimate container
    activity.
    """,
]
from = "now-6m"
index = ["logs-cloud_defend*"]
interval = "5m"
language = "eql"
license = "Elastic License v2"
name = "Netcat Listener Established Inside A Container"
risk_score = 73
rule_id = "a52a9439-d52c-401c-be37-2785235c6547"
severity = "high"
tags = [
    "Data Source: Elastic Defend for Containers",
    "Domain: Container",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where container.id: "*" and event.type== "start" 
and event.action in ("fork", "exec") and 
(
process.name:("nc","ncat","netcat","netcat.openbsd","netcat.traditional") or
/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
process.args: ("nc","ncat","netcat","netcat.openbsd","netcat.traditional")
) and (
          /* bind shell to echo for command execution */
          (process.args:("-*l*", "--listen", "-*p*", "--source-port") and process.args:("-c", "--sh-exec", "-e", "--exec", "echo","$*"))
          /* bind shell to specific port */
          or process.args:("-*l*", "--listen", "-*p*", "--source-port")
          )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"