legitimate administrative scripts or automated maintenance tasks may trigger this detection when managing redis configurations or performing system operations. filter based on known administrative activity and approved management tools.

splunk

Techniques

Sample rules

Linux Suspicious Redis Activity

source: splunk
technicques:

Description

The following analytic detects Redis processes spawning a system shell command. This can indicate exploitation activity of a redis server to gain code execution.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

FROM datamodel=Endpoint.Processes WHERE

(
    Processes.parent_process_name IN (
        "redis-sentinel",
        "redis-server"
    )
    OR
    Processes.parent_process_path = "*/bin/redis*"
)

Processes.process_name IN (
    "awk", "bash", "curl", "dash", "gawk", "id", "ifconfig",
    "lua", "nc", "ncat", "netcat", "openssl", "perl", "php",
    "python", "python2", "python3", "ruby", "sh", "socat",
    "wget", "whoami", "zsh"
)

BY Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
   Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_current_directory Processes.process_exec
   Processes.process_guid Processes.process_hash Processes.process_id
   Processes.process_integrity_level Processes.process_name Processes.process_path
   Processes.user Processes.user_id Processes.vendor_product


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `linux_suspicious_redis_activity_filter`