From 1e3cc411c57fd6007ee482e46627ed8531f48627 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud Date: Tue, 25 Aug 2026 13:36:57 +0200 Subject: [PATCH 1/6] [New Rules] Procfs Sycall Read & binfmt Configuration File Creation --- ...very_suspicious_proc_pid_syscall_read.toml | 77 ++++++++++++++++++ ...ce_binfmt_configuration_file_creation.toml | 78 +++++++++++++++++++ 2 files changed, 155 insertions(+) create mode 100644 rules/linux/discovery_suspicious_proc_pid_syscall_read.toml create mode 100644 rules/linux/persistence_binfmt_configuration_file_creation.toml diff --git a/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml b/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml new file mode 100644 index 00000000000..ff9fd5e572d --- /dev/null +++ b/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml @@ -0,0 +1,77 @@ +[metadata] +creation_date = "2026/08/25" +integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"] +maturity = "production" +updated_date = "2026/08/25" + +[rule] +author = ["Elastic"] +description = """ +This rule detects command lines that reference another process or thread's procfs syscall file. The +"/proc//syscall" interface exposes the current syscall arguments, stack pointer, and instruction +pointer, which can support process discovery and preparation for process injection. Self and thread-self +aliases are excluded. +""" +from = "now-9m" +index = [ + "endgame-*", + "logs-crowdstrike.fdr*", + "logs-endpoint.events.process*", + "logs-sentinel_one_cloud_funnel.*", +] +language = "eql" +license = "Elastic License v2" +name = "Suspicious Reading of procfs Syscall File" +references = [ + "https://man7.org/linux/man-pages/man5/proc_pid_syscall.5.html", + "https://www.akamai.com/blog/security-research/the-definitive-guide-to-linux-process-injection" +] +risk_score = 47 +rule_id = "6327bdae-4dc4-4e2e-b29d-3fd100af522c" +severity = "medium" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend", + "Data Source: Elastic Endgame", + "Data Source: Crowdstrike", + "Data Source: SentinelOne", +] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +process where host.os.type == "linux" and event.type == "start" and +event.action in ("exec", "exec_event", "start", "ProcessRollup2") and +( + process.name in ( + "cat", "less", "more", "head", "tail", "nano", "vi", "vim", "strings", "nvim", "vim.basic", + "vim.tiny", "od", "hexdump", "xxd", "hx", "hexedit", "pager", "tr" + ) or + ( + process.name in ( + "find", "awk", "gawk", "mawk", "nawk", "grep", "fgrep", "rgrep", "xargs", "sed", "tee" + ) and + process.args_count <= 20 + ) +) and +process.command_line like "*/proc/*/syscall*" and +not ( + process.command_line like ("*/proc/self/syscall*", "*/proc/thread-self/syscall*") or + process.args like "/proc/*/syscall/comm" +) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + + [rule.threat.tactic] + name = "Discovery" + id = "TA0007" + reference = "https://attack.mitre.org/tactics/TA0007/" + + [[rule.threat.technique]] + name = "Process Discovery" + id = "T1057" + reference = "https://attack.mitre.org/techniques/T1057/" diff --git a/rules/linux/persistence_binfmt_configuration_file_creation.toml b/rules/linux/persistence_binfmt_configuration_file_creation.toml new file mode 100644 index 00000000000..fb7bbdd7499 --- /dev/null +++ b/rules/linux/persistence_binfmt_configuration_file_creation.toml @@ -0,0 +1,78 @@ +[metadata] +creation_date = "2024/05/31" +integration = ["endpoint"] +maturity = "production" +updated_date = "2025/12/22" + +[rule] +author = ["Elastic"] +description = """ +This rule detects the creation of a binfmt configuration file. Binfmt is a utility that is used to +configure the behavior of the Linux kernel when executing binary files. By creating a malicious +binfmt configuration file, threat actors can execute a backdoor script or command on the target system. +""" +from = "now-9m" +index = ["logs-endpoint.events.file*"] +language = "eql" +license = "Elastic License v2" +name = "Binfmt Configuration File Creation" +references = ["https://dfir.ch/posts/today_i_learned_binfmt_misc/"] +risk_score = 21 +rule_id = "a3b47d21-20d6-45b0-8b75-fc27073bdef2" +setup = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +""" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Tactic: Execution", + "Data Source: Elastic Defend", +] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +file where host.os.type == "linux" and event.action != "deletion" and process.executable != null and +file.path like ( + "/etc/binfmt.d/*.conf", "/run/binfmt.d/*.conf", "/usr/local/lib/binfmt.d/*.conf", "/usr/lib/binfmt.d/*.conf" +) and +not file.path like ("/usr/lib/binfmt.d/python3.*.conf", "/usr/lib/binfmt.d/qemu-*-static.conf") +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1546" +name = "Event Triggered Execution" +reference = "https://attack.mitre.org/techniques/T1546/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" From 38260688214dbb2fedf6caa2afa6409537b2eff3 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud Date: Tue, 25 Aug 2026 13:37:21 +0200 Subject: [PATCH 2/6] date bump --- .../linux/persistence_binfmt_configuration_file_creation.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/linux/persistence_binfmt_configuration_file_creation.toml b/rules/linux/persistence_binfmt_configuration_file_creation.toml index fb7bbdd7499..4731d773108 100644 --- a/rules/linux/persistence_binfmt_configuration_file_creation.toml +++ b/rules/linux/persistence_binfmt_configuration_file_creation.toml @@ -1,8 +1,8 @@ [metadata] -creation_date = "2024/05/31" +creation_date = "2026/08/25" integration = ["endpoint"] maturity = "production" -updated_date = "2025/12/22" +updated_date = "2026/08/25" [rule] author = ["Elastic"] From b6392ed4f8caf39c13ee12fbb9540126591d5d4c Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Tue, 25 Aug 2026 13:59:22 +0200 Subject: [PATCH 3/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- rules/linux/persistence_binfmt_configuration_file_creation.toml | 2 -- 1 file changed, 2 deletions(-) diff --git a/rules/linux/persistence_binfmt_configuration_file_creation.toml b/rules/linux/persistence_binfmt_configuration_file_creation.toml index 4731d773108..9fb10b66f38 100644 --- a/rules/linux/persistence_binfmt_configuration_file_creation.toml +++ b/rules/linux/persistence_binfmt_configuration_file_creation.toml @@ -50,8 +50,6 @@ tags = [ "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", - "Tactic: Privilege Escalation", - "Tactic: Execution", "Data Source: Elastic Defend", ] timestamp_override = "event.ingested" From f6b23f91cbf8336a0d33f1615150d4f00a3cfa3e Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 26 Aug 2026 10:10:54 +0200 Subject: [PATCH 4/6] Update rules/linux/discovery_suspicious_proc_pid_syscall_read.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- rules/linux/discovery_suspicious_proc_pid_syscall_read.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml b/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml index ff9fd5e572d..ddacc5eb7a5 100644 --- a/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml +++ b/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml @@ -32,6 +32,7 @@ severity = "medium" tags = [ "Domain: Endpoint", "OS: Linux", + "Platform: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend", From f149edbff977d6d8cee391b5e8c4d1bfc561f51d Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 26 Aug 2026 10:11:03 +0200 Subject: [PATCH 5/6] Update rules/linux/persistence_binfmt_configuration_file_creation.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- rules/linux/persistence_binfmt_configuration_file_creation.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/linux/persistence_binfmt_configuration_file_creation.toml b/rules/linux/persistence_binfmt_configuration_file_creation.toml index 9fb10b66f38..42e488df68d 100644 --- a/rules/linux/persistence_binfmt_configuration_file_creation.toml +++ b/rules/linux/persistence_binfmt_configuration_file_creation.toml @@ -48,6 +48,7 @@ severity = "low" tags = [ "Domain: Endpoint", "OS: Linux", + "Platform: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend", From a6d338dab6bfeebeb135b2207124cf50d32f43a0 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 26 Aug 2026 11:01:56 +0200 Subject: [PATCH 6/6] Update binfmt configuration file creation rules --- ...ersistence_binfmt_configuration_file_creation.toml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/rules/linux/persistence_binfmt_configuration_file_creation.toml b/rules/linux/persistence_binfmt_configuration_file_creation.toml index 42e488df68d..31fb763a1f3 100644 --- a/rules/linux/persistence_binfmt_configuration_file_creation.toml +++ b/rules/linux/persistence_binfmt_configuration_file_creation.toml @@ -58,9 +58,16 @@ type = "eql" query = ''' file where host.os.type == "linux" and event.action != "deletion" and process.executable != null and file.path like ( - "/etc/binfmt.d/*.conf", "/run/binfmt.d/*.conf", "/usr/local/lib/binfmt.d/*.conf", "/usr/lib/binfmt.d/*.conf" + "/etc/binfmt.d/*.conf", "/run/binfmt.d/*.conf", "/usr/local/lib/binfmt.d/*.conf", "/usr/lib/binfmt.d/*.conf", + "/proc/sys/fs/binfmt_misc/register", "/proc/sys/fs/binfmt_misc/*" ) and -not file.path like ("/usr/lib/binfmt.d/python3.*.conf", "/usr/lib/binfmt.d/qemu-*-static.conf") +not ( + file.path like ( + "/usr/lib/binfmt.d/python3.*.conf", "/usr/lib/binfmt.d/qemu-*-static.conf", + "/proc/sys/fs/binfmt_misc/status" + ) or + process.executable == "/usr/lib/systemd/systemd-binfmt" +) ''' [[rule.threat]]