High Command Line Entropy Detected for Privileged Commands on Linux
An Elastic machine learning job has identified unusually high median command line entropy for privileged commands executed by a user on Linux, suggesting possible privileged access activity through obfuscated or complex command lines which can be a sign of suspicious or unauthorized use of privileged access, potentially indicating privilege escalation or defense evasion.
The Elastic Privileged Access Detection integration on Linux has detected an anomaly: an unusually high median command line entropy for privileged commands executed by a user. This detection, identified by machine learning job ID pad_linux_high_median_process_command_line_entropy_by_user_ea, indicates that the commands used may be obfuscated or deliberately complex. Adversaries often leverage such techniques for defense evasion, obscuring their malicious actions during privilege escalation or lateral movement. This can make unauthorized activities, such as executing encoded payloads or intricate scripts, harder to detect with traditional signature-based methods. The rule helps defenders identify potential malicious post-exploitation activity on Linux systems by flagging these complex command structures, which could signal suspicious or unauthorized use of privileged access. The detection leverages Linux logs collected by integrations such as Elastic Defend and Sysmon Linux.
Impact
If the detected high command line entropy is indicative of malicious activity, the impact can be significant. Adversaries employing obfuscated or complex commands under privileged accounts may have successfully gained unauthorized elevated access, allowing them to perform actions such as installing persistent backdoors, exfiltrating sensitive data, or deploying further malicious payloads. The use of high entropy commands specifically aims to evade detection, potentially delaying discovery and response efforts. Successful exploitation could lead to full system compromise, data breaches, and disruption of critical services, often making forensic analysis more challenging due to the inherent complexity of the commands.
Recommendation
- Deploy the Elastic Privileged Access Detection integration, ensuring the preconfigured anomaly detection jobs are installed, as detailed in the setup instructions for rule ID
0cbbb5e0-f93a-47fe-ab72-8213366c38f1. - Ensure Linux logs are collected via Elastic Defend or Sysmon Linux integrations to provide the necessary data for the machine learning job.
- Review alerts generated by the 'High Command Line Entropy Detected for Privileged Commands' rule (ID:
0cbbb5e0-f93a-47fe-ab72-8213366c38f1) and investigate flagged command lines for obfuscation patterns and their context of execution. - Baseline legitimate administrative scripts and automated deployment tools that might exhibit high command line entropy, and create exceptions as part of false positive analysis to prevent unnecessary alerts.