diff --git a/custom_documentation/doc/endpoint/process/linux/linux_process_mprotect.md b/custom_documentation/doc/endpoint/process/linux/linux_process_mprotect.md new file mode 100644 index 000000000..32ce963df --- /dev/null +++ b/custom_documentation/doc/endpoint/process/linux/linux_process_mprotect.md @@ -0,0 +1,204 @@ +# Linux mprotect Events + +- OS: Linux +- Data Stream: `logs-endpoint.events.process-*` +- KQL: `event.action : "mprotect" and event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux"` + +This event is generated only for successful mprotect() calls that request executable protection (X, RX, WX, or RWX), and only when advanced.events.hidden.emit_diagnostic_fields is enabled. + +| Field | +|---| +| @timestamp | +| agent.id | +| agent.type | +| agent.version | +| cloud.account.id | +| cloud.instance.name | +| cloud.project.id | +| cloud.provider | +| cloud.region | +| container.id | +| container.image.hash.all | +| container.image.name | +| container.image.tag | +| container.name | +| data_stream.dataset | +| data_stream.namespace | +| data_stream.type | +| ecs.version | +| elastic.agent.id | +| event.action | +| event.category | +| event.created | +| event.dataset | +| event.id | +| event.kind | +| event.module | +| event.outcome | +| event.sequence | +| event.type | +| group.Ext.real.id | +| group.Ext.real.name | +| group.id | +| group.name | +| host.architecture | +| host.hostname | +| host.id | +| host.ip | +| host.mac | +| host.name | +| host.os.Ext.variant | +| host.os.family | +| host.os.full | +| host.os.kernel | +| host.os.name | +| host.os.platform | +| host.os.type | +| host.os.version | +| message | +| orchestrator.cluster.id | +| orchestrator.cluster.name | +| orchestrator.namespace | +| orchestrator.resource.ip | +| orchestrator.resource.name | +| orchestrator.resource.parent.type | +| orchestrator.resource.type | +| process.Ext.ancestry | +| process.Ext.mprotect.addr | +| process.Ext.mprotect.len | +| process.Ext.mprotect.prot | +| process.Ext.mprotect.prot_flags | +| process.Ext.trusted | +| process.Ext.trusted_descendant | +| process.args | +| process.args_count | +| process.command_line | +| process.end | +| process.entity_id | +| process.entry_leader.args | +| process.entry_leader.args_count | +| process.entry_leader.entity_id | +| process.entry_leader.entry_meta.source.ip | +| process.entry_leader.entry_meta.type | +| process.entry_leader.executable | +| process.entry_leader.group.id | +| process.entry_leader.group.name | +| process.entry_leader.interactive | +| process.entry_leader.name | +| process.entry_leader.parent.entity_id | +| process.entry_leader.parent.pid | +| process.entry_leader.parent.start | +| process.entry_leader.pid | +| process.entry_leader.real_group.id | +| process.entry_leader.real_group.name | +| process.entry_leader.real_user.id | +| process.entry_leader.real_user.name | +| process.entry_leader.same_as_process | +| process.entry_leader.start | +| process.entry_leader.supplemental_groups.id | +| process.entry_leader.supplemental_groups.name | +| process.entry_leader.tty.char_device.major | +| process.entry_leader.tty.char_device.minor | +| process.entry_leader.user.id | +| process.entry_leader.user.name | +| process.entry_leader.working_directory | +| process.env_vars | +| process.executable | +| process.exit_code | +| process.group.id | +| process.group.name | +| process.group_leader.args | +| process.group_leader.args_count | +| process.group_leader.entity_id | +| process.group_leader.executable | +| process.group_leader.group.id | +| process.group_leader.group.name | +| process.group_leader.interactive | +| process.group_leader.name | +| process.group_leader.pid | +| process.group_leader.real_group.id | +| process.group_leader.real_group.name | +| process.group_leader.real_user.id | +| process.group_leader.real_user.name | +| process.group_leader.same_as_process | +| process.group_leader.start | +| process.group_leader.supplemental_groups.id | +| process.group_leader.supplemental_groups.name | +| process.group_leader.tty.char_device.major | +| process.group_leader.tty.char_device.minor | +| process.group_leader.user.id | +| process.group_leader.user.name | +| process.group_leader.working_directory | +| process.hash.md5 | +| process.hash.sha1 | +| process.hash.sha256 | +| process.interactive | +| process.name | +| process.parent.Ext.command_line_truncated | +| process.parent.args | +| process.parent.args_count | +| process.parent.command_line | +| process.parent.entity_id | +| process.parent.executable | +| process.parent.group.id | +| process.parent.group.name | +| process.parent.interactive | +| process.parent.name | +| process.parent.pid | +| process.parent.real_group.id | +| process.parent.real_group.name | +| process.parent.real_user.id | +| process.parent.real_user.name | +| process.parent.start | +| process.parent.supplemental_groups.id | +| process.parent.supplemental_groups.name | +| process.parent.tty.char_device.major | +| process.parent.tty.char_device.minor | +| process.parent.user.id | +| process.parent.user.name | +| process.parent.working_directory | +| process.pid | +| process.previous.args | +| process.previous.args_count | +| process.previous.executable | +| process.real_group.id | +| process.real_group.name | +| process.real_user.id | +| process.real_user.name | +| process.session_leader.args | +| process.session_leader.args_count | +| process.session_leader.entity_id | +| process.session_leader.executable | +| process.session_leader.group.id | +| process.session_leader.group.name | +| process.session_leader.interactive | +| process.session_leader.name | +| process.session_leader.pid | +| process.session_leader.real_group.id | +| process.session_leader.real_group.name | +| process.session_leader.real_user.id | +| process.session_leader.real_user.name | +| process.session_leader.same_as_process | +| process.session_leader.start | +| process.session_leader.supplemental_groups.id | +| process.session_leader.supplemental_groups.name | +| process.session_leader.tty.char_device.major | +| process.session_leader.tty.char_device.minor | +| process.session_leader.user.id | +| process.session_leader.user.name | +| process.session_leader.working_directory | +| process.start | +| process.supplemental_groups.id | +| process.supplemental_groups.name | +| process.thread.capabilities.effective | +| process.thread.capabilities.permitted | +| process.tty.char_device.major | +| process.tty.char_device.minor | +| process.user.id | +| process.user.name | +| process.working_directory | +| user.Ext.real.id | +| user.Ext.real.name | +| user.id | +| user.name | + diff --git a/custom_documentation/src/endpoint/data_stream/process/linux/linux_process_mprotect.yaml b/custom_documentation/src/endpoint/data_stream/process/linux/linux_process_mprotect.yaml new file mode 100644 index 000000000..9d6b824a6 --- /dev/null +++ b/custom_documentation/src/endpoint/data_stream/process/linux/linux_process_mprotect.yaml @@ -0,0 +1,207 @@ +overview: + name: Linux mprotect Events + description: This event is generated only for successful mprotect() calls that request executable protection (X, RX, WX, or RWX), and only when advanced.events.hidden.emit_diagnostic_fields is enabled. +identification: + filter: + event.action: mprotect + event.dataset: endpoint.events.process + event.module: endpoint + host.os.type: linux + os: + - linux + data_stream: logs-endpoint.events.process-* +fields: + endpoint: + - '@timestamp' + - agent.id + - agent.type + - agent.version + - cloud.account.id + - cloud.instance.name + - cloud.project.id + - cloud.provider + - cloud.region + - container.id + - container.image.hash.all + - container.image.name + - container.image.tag + - container.name + - data_stream.dataset + - data_stream.namespace + - data_stream.type + - ecs.version + - elastic.agent.id + - event.action + - event.category + - event.created + - event.dataset + - event.id + - event.kind + - event.module + - event.outcome + - event.sequence + - event.type + - group.Ext.real.id + - group.Ext.real.name + - group.id + - group.name + - host.architecture + - host.hostname + - host.id + - host.ip + - host.mac + - host.name + - host.os.Ext.variant + - host.os.family + - host.os.full + - host.os.kernel + - host.os.name + - host.os.platform + - host.os.type + - host.os.version + - message + - orchestrator.cluster.id + - orchestrator.cluster.name + - orchestrator.namespace + - orchestrator.resource.ip + - orchestrator.resource.name + - orchestrator.resource.parent.type + - orchestrator.resource.type + - process.Ext.ancestry + - process.Ext.mprotect.addr + - process.Ext.mprotect.len + - process.Ext.mprotect.prot + - process.Ext.mprotect.prot_flags + - process.Ext.trusted + - process.Ext.trusted_descendant + - process.args + - process.args_count + - process.command_line + - process.end + - process.entity_id + - process.entry_leader.args + - process.entry_leader.args_count + - process.entry_leader.entity_id + - process.entry_leader.entry_meta.source.ip + - process.entry_leader.entry_meta.type + - process.entry_leader.executable + - process.entry_leader.group.id + - process.entry_leader.group.name + - process.entry_leader.interactive + - process.entry_leader.name + - process.entry_leader.parent.entity_id + - process.entry_leader.parent.pid + - process.entry_leader.parent.start + - process.entry_leader.pid + - process.entry_leader.real_group.id + - process.entry_leader.real_group.name + - process.entry_leader.real_user.id + - process.entry_leader.real_user.name + - process.entry_leader.same_as_process + - process.entry_leader.start + - process.entry_leader.supplemental_groups.id + - process.entry_leader.supplemental_groups.name + - process.entry_leader.tty.char_device.major + - process.entry_leader.tty.char_device.minor + - process.entry_leader.user.id + - process.entry_leader.user.name + - process.entry_leader.working_directory + - process.env_vars + - process.executable + - process.exit_code + - process.group.id + - process.group.name + - process.group_leader.args + - process.group_leader.args_count + - process.group_leader.entity_id + - process.group_leader.executable + - process.group_leader.group.id + - process.group_leader.group.name + - process.group_leader.interactive + - process.group_leader.name + - process.group_leader.pid + - process.group_leader.real_group.id + - process.group_leader.real_group.name + - process.group_leader.real_user.id + - process.group_leader.real_user.name + - process.group_leader.same_as_process + - process.group_leader.start + - process.group_leader.supplemental_groups.id + - process.group_leader.supplemental_groups.name + - process.group_leader.tty.char_device.major + - process.group_leader.tty.char_device.minor + - process.group_leader.user.id + - process.group_leader.user.name + - process.group_leader.working_directory + - process.hash.md5 + - process.hash.sha1 + - process.hash.sha256 + - process.interactive + - process.name + - process.parent.Ext.command_line_truncated + - process.parent.args + - process.parent.args_count + - process.parent.command_line + - process.parent.entity_id + - process.parent.executable + - process.parent.group.id + - process.parent.group.name + - process.parent.interactive + - process.parent.name + - process.parent.pid + - process.parent.real_group.id + - process.parent.real_group.name + - process.parent.real_user.id + - process.parent.real_user.name + - process.parent.start + - process.parent.supplemental_groups.id + - process.parent.supplemental_groups.name + - process.parent.tty.char_device.major + - process.parent.tty.char_device.minor + - process.parent.user.id + - process.parent.user.name + - process.parent.working_directory + - process.pid + - process.previous.args + - process.previous.args_count + - process.previous.executable + - process.real_group.id + - process.real_group.name + - process.real_user.id + - process.real_user.name + - process.session_leader.args + - process.session_leader.args_count + - process.session_leader.entity_id + - process.session_leader.executable + - process.session_leader.group.id + - process.session_leader.group.name + - process.session_leader.interactive + - process.session_leader.name + - process.session_leader.pid + - process.session_leader.real_group.id + - process.session_leader.real_group.name + - process.session_leader.real_user.id + - process.session_leader.real_user.name + - process.session_leader.same_as_process + - process.session_leader.start + - process.session_leader.supplemental_groups.id + - process.session_leader.supplemental_groups.name + - process.session_leader.tty.char_device.major + - process.session_leader.tty.char_device.minor + - process.session_leader.user.id + - process.session_leader.user.name + - process.session_leader.working_directory + - process.start + - process.supplemental_groups.id + - process.supplemental_groups.name + - process.thread.capabilities.effective + - process.thread.capabilities.permitted + - process.tty.char_device.major + - process.tty.char_device.minor + - process.user.id + - process.user.name + - process.working_directory + - user.Ext.real.id + - user.Ext.real.name + - user.id + - user.name diff --git a/custom_schemas/custom_process.yml b/custom_schemas/custom_process.yml index 3eb91390b..d4688be3c 100644 --- a/custom_schemas/custom_process.yml +++ b/custom_schemas/custom_process.yml @@ -230,6 +230,34 @@ example: "OE" description: Kernel taint letters for this module, e.g. O for out-of-tree and E for unsigned. Only present when the module taints the kernel. + - name: Ext.mprotect + level: custom + type: object + description: Object for successful mprotect() calls that request executable memory. + + - name: Ext.mprotect.addr + level: custom + type: long + description: Start address passed to the successful mprotect() call. + + - name: Ext.mprotect.len + level: custom + type: long + description: Length in bytes passed to the successful mprotect() call. + + - name: Ext.mprotect.prot + level: custom + type: long + description: Raw executable memory protection flags passed to the successful mprotect() call. + + - name: Ext.mprotect.prot_flags + level: custom + type: keyword + example: "RWX" + description: > + Decoded executable memory protection flags. Emitted values are X, RX, WX, and RWX, + in fixed R, W, X order. + - name: Ext.memfd level: custom type: object diff --git a/custom_subsets/elastic_endpoint/process/process.yaml b/custom_subsets/elastic_endpoint/process/process.yaml index 16c88d7a2..6fa635a0a 100644 --- a/custom_subsets/elastic_endpoint/process/process.yaml +++ b/custom_subsets/elastic_endpoint/process/process.yaml @@ -182,6 +182,12 @@ fields: src_version: {} taints: {} taint_flags: {} + mprotect: + fields: + addr: {} + len: {} + prot: {} + prot_flags: {} shmget: fields: key: {} diff --git a/package/endpoint/changelog.yml b/package/endpoint/changelog.yml index 7befc10f2..861e083af 100644 --- a/package/endpoint/changelog.yml +++ b/package/endpoint/changelog.yml @@ -23,6 +23,9 @@ - description: Add Effective_process fields to malware events type: enhancement link: https://github.com/elastic/endpoint-package/pull/751 + - description: Add Linux mprotect() syscall fields to process events + type: enhancement + link: https://github.com/elastic/endpoint-package/pull/767 - version: "9.4.0" changes: - description: automatic troubleshooting endpoint context docs diff --git a/package/endpoint/data_stream/process/fields/fields.yml b/package/endpoint/data_stream/process/fields/fields.yml index 8bc5dc1fd..0253d799d 100644 --- a/package/endpoint/data_stream/process/fields/fields.yml +++ b/package/endpoint/data_stream/process/fields/fields.yml @@ -931,7 +931,7 @@ level: custom type: long description: Bitmask of the taint flags this module sets on the kernel. Zero means the module does not taint the kernel. - example: 4096 + example: '4096' default_field: false - name: Ext.load_module.version level: custom @@ -993,6 +993,33 @@ ignore_above: 1024 description: Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled default_field: false + - name: Ext.mprotect + level: custom + type: object + description: Object for successful mprotect() calls that request executable memory. + default_field: false + - name: Ext.mprotect.addr + level: custom + type: long + description: Start address passed to the successful mprotect() call. + default_field: false + - name: Ext.mprotect.len + level: custom + type: long + description: Length in bytes passed to the successful mprotect() call. + default_field: false + - name: Ext.mprotect.prot + level: custom + type: long + description: Raw executable memory protection flags passed to the successful mprotect() call. + default_field: false + - name: Ext.mprotect.prot_flags + level: custom + type: keyword + ignore_above: 1024 + description: Decoded executable memory protection flags. Emitted values are X, RX, WX, and RWX, in fixed R, W, X order. + example: RWX + default_field: false - name: Ext.protection level: custom type: keyword diff --git a/package/endpoint/docs/README.md b/package/endpoint/docs/README.md index 81be0b269..4b272c431 100644 --- a/package/endpoint/docs/README.md +++ b/package/endpoint/docs/README.md @@ -2424,6 +2424,11 @@ sent by the endpoint. | process.Ext.memfd.flags | Flags passed to the memfd operation. | long | | process.Ext.memfd.name | Filename for the created file. Appears in /proc/self/fd. | keyword | | process.Ext.mitigation_policies | Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled | keyword | +| process.Ext.mprotect | Object for successful mprotect() calls that request executable memory. | object | +| process.Ext.mprotect.addr | Start address passed to the successful mprotect() call. | long | +| process.Ext.mprotect.len | Length in bytes passed to the successful mprotect() call. | long | +| process.Ext.mprotect.prot | Raw executable memory protection flags passed to the successful mprotect() call. | long | +| process.Ext.mprotect.prot_flags | Decoded executable memory protection flags. Emitted values are X, RX, WX, and RWX, in fixed R, W, X order. | keyword | | process.Ext.protection | Indicates the protection level of this process. Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | keyword | | process.Ext.ptrace | Object for ptrace events. | object | | process.Ext.ptrace.addr | ptrace address. | long | diff --git a/schemas/v1/process/process.yaml b/schemas/v1/process/process.yaml index f82f37d68..314a38067 100644 --- a/schemas/v1/process/process.yaml +++ b/schemas/v1/process/process.yaml @@ -1790,6 +1790,57 @@ process.Ext.mitigation_policies: normalize: [] short: Process mitigation policies. type: keyword +process.Ext.mprotect: + dashed_name: process-Ext-mprotect + description: Object for successful mprotect() calls that request executable memory. + flat_name: process.Ext.mprotect + level: custom + name: Ext.mprotect + normalize: [] + short: Object for successful mprotect() calls that request executable memory. + type: object +process.Ext.mprotect.addr: + dashed_name: process-Ext-mprotect-addr + description: Start address passed to the successful mprotect() call. + flat_name: process.Ext.mprotect.addr + level: custom + name: Ext.mprotect.addr + normalize: [] + short: Start address passed to the successful mprotect() call. + type: long +process.Ext.mprotect.len: + dashed_name: process-Ext-mprotect-len + description: Length in bytes passed to the successful mprotect() call. + flat_name: process.Ext.mprotect.len + level: custom + name: Ext.mprotect.len + normalize: [] + short: Length in bytes passed to the successful mprotect() call. + type: long +process.Ext.mprotect.prot: + dashed_name: process-Ext-mprotect-prot + description: Raw executable memory protection flags passed to the successful mprotect() + call. + flat_name: process.Ext.mprotect.prot + level: custom + name: Ext.mprotect.prot + normalize: [] + short: Raw executable memory protection flags passed to the successful mprotect() + call. + type: long +process.Ext.mprotect.prot_flags: + dashed_name: process-Ext-mprotect-prot-flags + description: Decoded executable memory protection flags. Emitted values are X, RX, + WX, and RWX, in fixed R, W, X order. + example: RWX + flat_name: process.Ext.mprotect.prot_flags + ignore_above: 1024 + level: custom + name: Ext.mprotect.prot_flags + normalize: [] + short: Decoded executable memory protection flags. Emitted values are X, RX, WX, + and RWX, in fixed R, W, X order. + type: keyword process.Ext.protection: dashed_name: process-Ext-protection description: Indicates the protection level of this process. Uses the same syntax