Suspicious Redis Server Process Execution

This threat brief focuses on the detection of malicious activity involving Redis server and sentinel processes. Attackers target Redis to gain remote code execution, often leveraging vulnerabilities such as the Lua sandbox escape identified in CVE-2022-0543 or through misconfigured instances. Once initial access is achieved, attackers use the Redis process to spawn shell environments or external utility binaries to facilitate further post-exploitation actions. These actions include persistence, privilege escalation, and establishing command-and-control communication. This behavior is highly irregular for legitimate Redis operations and indicates a compromised Linux host requiring immediate investigation.

Attack Chain

1. Attacker identifies an internet-facing Redis server with weak authentication or targets a vulnerable version (e.g., CVE-2022-0543).
2. Attacker interacts with the Redis instance, often through a malicious Lua script or by leveraging the Redis replication feature to write arbitrary files.
3. The Redis process context executes the injected payload, leading to an initial foothold on the Linux host.
4. The Redis parent process invokes a system shell (e.g., bash, sh, zsh) or system utility (e.g., curl, wget, python, socat).
5. The spawned shell or utility executes commands to download secondary stages or malicious scripts from remote infrastructure.
6. Attacker establishes persistence by modifying system configuration files or creating cron jobs.
7. Attacker performs privilege escalation or initiates exfiltration, utilizing the hijacked Redis process as a launch point.
8. Final objective is achieved, such as ransomware deployment, credential theft, or full system compromise.

Impact

Successful exploitation of Redis servers leads to unauthorized remote code execution, enabling attackers to gain full control over the underlying Linux host. This can result in data exfiltration, service disruption, and the use of the compromised server as a pivot point for lateral movement within the network. In the case of botnet malware like P2PInfect, these compromises facilitate the wide-scale propagation of malicious payloads across Linux environments.

Recommendation

• Enable Sysmon for Linux (Event ID 1) and ensure process lineage (parent-child relationship) and command-line arguments are ingested into your security monitoring platform.
• Deploy the Sigma rule provided in this brief to detect instances where redis-server or redis-sentinel spawn unauthorized shell or utility processes.
• Restrict network access to Redis server ports (default 6379) to authorized internal networks only; do not expose Redis directly to the internet.
• Patch all Redis instances to resolve CVE-2022-0543 and maintain updated versions to mitigate known exploitation vectors.