defense_evasion_potential_proot_exploits.toml

[metadata]
creation_date = "2023/03/07"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/03/07"

[rule]
author = ["Elastic"]
description = """
Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of
chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot
to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts.
In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution.
With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions,
such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other
architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF),
can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or
orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent
it can be easily tuned to work for one.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Defense Evasion via PRoot"
references = [
    "https://proot-me.github.io/",
]
risk_score = 47
rule_id = "5c9ec990-37fa-4d5c-abfc-8d432f3dedd0"
severity = "medium"
tags = ["Elastic", "Host", "Linux", "Threat Detection", "Defense Evasion"]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where  event.action == "exec" and process.parent.name =="proot" and host.os.type == "linux"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"