Unusual Process For a Linux Host Detection

This threat brief describes a machine learning rule developed by Elastic designed to identify unusual process execution on Linux systems. The rule, titled "Unusual Process For a Linux Host," leverages Entity Analytics (EA) fields and historical data to detect processes that are rare or do not typically run on individual hosts in an environment. This behavioral detection is crucial for uncovering potential unauthorized services, the execution of unknown malware, or the establishment of persistence mechanisms by threat actors. The rule is integrated with Elastic Defend and Auditd Manager, providing comprehensive event monitoring. The detection of such anomalies can signal early stages of an attack or the presence of hidden malicious activity, prompting security teams to investigate further. The rule is set to a low severity due to the nature of anomaly detection, which requires contextual investigation to confirm malicious intent.

Attack Chain

(This brief describes a detection rule for anomalous behavior rather than a specific attack chain. A detailed step-by-step attack chain cannot be provided from the source material.)

Impact

If an unusual process detected by this rule is indeed malicious, the impact can range from unauthorized system access and data exfiltration to complete system compromise and ransomware deployment. Persistence mechanisms can allow threat actors to maintain access over extended periods, facilitating further malicious activities. Unauthorized services can consume system resources, expose sensitive data, or serve as command and control channels. The success of such attacks can lead to significant financial loss, reputational damage, and operational disruption for affected organizations.

Recommendation

• Deploy the "Unusual Process For a Linux Host" machine learning rule to your Elastic SIEM.
• Ensure that log data from Elastic Defend and Auditd Manager is properly ingested and configured for the associated machine learning job, v3_rare_process_by_host_linux_ea.
• Investigate alerts generated by the rule by examining the process execution chain (parent process tree) for unknown processes and verifying their location and prevalence.
• Validate whether detected activity is related to legitimate, albeit infrequent, operations such as newly installed software or scheduled maintenance tasks, as outlined in the rule's false_positives section.
• Review the arguments and working directory of any flagged processes to gain insight into their purpose and origin.
• Use the incident response and remediation guidance provided in the rule's note section if malicious activity is confirmed.