rules/linux/defense_evasion_sysctl_kernel_feature_activity.toml (81 lines of code) (raw):

[metadata] creation_date = "2025/04/29" integration = ["endpoint"] maturity = "production" updated_date = "2025/04/29" [rule] author = ["Elastic"] description = """ This rule detects the modification and reading of kernel features through built-in commands. Attackers may collect information, disable or weaken Linux kernel protections. For example, an attacker may modify ASLR protection by disabling kernel.randomize_va_space, allow ptrace by setting kernel.yama.ptrace_scope to 0, or disable the NMI watchdog by setting kernel.nmi_watchdog to 0. These changes may be used to impair defenses and evade detection. """ from = "now-9m" index = [ "logs-endpoint.events.process*", ] language = "eql" license = "Elastic License v2" name = "Suspicious Kernel Feature Activity" risk_score = 21 rule_id = "3aff6ab1-18bd-427e-9d4c-c5732110c261" severity = "low" tags = [ "Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Discovery", "Data Source: Elastic Defend", ] timestamp_override = "event.ingested" type = "eql" query = ''' process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.command_line : ( "*/etc/sysctl.conf*", "*/etc/sysctl.d/*", "*/proc/sys/kernel/nmi_watchdog*", "*/proc/sys/vm/nr_hugepages*", "*/proc/sys/kernel/yama/ptrace_scope*", "*/proc/sys/kernel/randomize_va_space*", "*/proc/sys/vm/drop_caches*", "*/proc/sys/kernel/sysrq*", "*grsecurity*", "*exec-shield*", "*kernel.randomize_va_space*", "*kernel.yama.ptrace_scope*", "*kernel.nmi_watchdog*", "*vm.nr_hugepages*", "*vm.drop_caches*", "*kernel.sysrq*" ) and process.parent.executable != null and ( (process.name == "tee" and process.args like "-*a*") or // also detects --append (process.name == "cat" and not process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) or (process.name == "grep" and process.args_count == 3 and not process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) or (process.name == "sysctl" and process.args like ("*-w*", "*--write*", "*=*")) or (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and process.args : "*echo *") ) ''' [[rule.threat]] framework = "MITRE ATT&CK" [rule.threat.tactic] name = "Defense Evasion" id = "TA0005" reference = "https://attack.mitre.org/tactics/TA0005/" [[rule.threat.technique]] name = "Impair Defenses" id = "T1562" reference = "https://attack.mitre.org/techniques/T1562/" [[rule.threat.technique.subtechnique]] name = "Indicator Blocking" id = "T1562.006" reference = "https://attack.mitre.org/techniques/T1562/006/" [[rule.threat.technique]] name = "Subvert Trust Controls" id = "T1553" reference = "https://attack.mitre.org/techniques/T1553/" [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] id = "T1082" name = "System Information Discovery" reference = "https://attack.mitre.org/techniques/T1082/" [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/"