Skip to content

[Rule Tuning] File Transfer or Listener Established via Netcat #5223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

[Rule Tuning] File Transfer or Listener Established via Netcat #5223

wants to merge 6 commits into from

Conversation

@Aegrah
Copy link
Contributor

@Aegrah Aegrah commented Oct 15, 2025

Summary

Tuning this rule to ensure it is not bypassed through double command-line flag usage.

@Aegrah Aegrah self-assigned this Oct 15, 2025
@Aegrah Aegrah added OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE labels Oct 15, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Oct 15, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link

tradebot-elastic commented Oct 15, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ File Transfer or Listener Established via Netcat (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Oct 15, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ File Transfer or Listener Established via Netcat (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Samirbous
Samirbous reviewed Oct 15, 2025
View reviewed changes
rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml Outdated
not process.command_line like~ ("*127.0.0.1*", "*localhost*")]
[network where host.os.type == "linux" and (process.name == "nc" or process.name == "ncat" or process.name == "netcat" or
process.name == "netcat.openbsd" or process.name == "netcat.traditional")]
[network where host.os.type == "linux" and process.name in ("nc","ncat","netcat","netcat.openbsd","netcat.traditional")]
Copy link
Contributor

@Samirbous Samirbous Oct 15, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is the network event is really necessary here ? (the 1st event of the seq should be enough to triage and less performance req)

process where host.os.type == "linux" and event.type == "start" and 
      process.name in ("nc","ncat","netcat","netcat.openbsd","netcat.traditional") and (
          /* bind shell to specific port or listener */
          process.args:("-*l*","-*p*")
          /* reverse shell to command-line interpreter used for command execution */
          or (process.args: "-e" and process.args:("/bin/bash","/bin/sh"))
          /* file transfer via stdout */
          or process.args:(">","<")
          /* file transfer via pipe */
          or (process.args:("|") and process.args:("nc","ncat"))
      ) and
      not process.command_line like~ ("*127.0.0.1*", "*localhost*")

Copy link
Contributor Author

@Aegrah Aegrah Oct 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

++, good call; removed network piece and also tuned the rest of the rule a bit as logic did not make 100% sense. Should be good to go now.

@tradebot-elastic
Copy link

tradebot-elastic commented Oct 21, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ File Transfer or Listener Established via Netcat (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Oct 27, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ File Transfer or Listener Established via Netcat (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Aegrah Aegrah requested a review from Samirbous October 27, 2025 08:51
@tradebot-elastic
Copy link

tradebot-elastic commented Oct 27, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ File Transfer or Listener Established via Netcat (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Oct 31, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ File Transfer or Listener Established via Netcat (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

@Samirbous Samirbous Awaiting requested review from Samirbous

At least 2 approving reviews are required to merge this pull request.

Assignees

@Aegrah Aegrah

Labels

backport: auto Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@Aegrah @tradebot-elastic @Samirbous @terrancedejesus @eric-forte-elastic