Interactive Bash Suspicious Children

Title: Interactive Bash Suspicious Children
Status: test
Description:Detects suspicious interactive bash as a parent to rather uncommon child processes
References:
  -Internal Research
Author: Florian Roth (Nextron Systems)
Date: 2022-03-14
modified:None
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.004'
• -'attack.t1036'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    ParentCommandLine: 'bash -i'
  anomaly1:
    CommandLine|contains:
      -'-c import '
      -'base64'
      -'pty.spawn'

  anomaly2:
    Image|endswith:
      -'whoami'
      -'iptables'
      -'/ncat'
      -'/nc'
      -'/netcat'

  condition:selection and 1 of anomaly*
Falsepositives:
  -Legitimate software that uses these patterns
Level: medium