Goal

Detect HTTP requests with patterns that are unusual for a cloud workload.

Strategy

This rule generates a signal when a network utility such as curl or wget makes a request for a URI with an unusual pattern. The patterns used in this rule appeared in previous compromises of cloud resources. For example, it is unusual for a production workload to download a file with a .jpg extension. Threat actors have used this extension to evade detection.

Triage and response

1. Determine the URL being requested using the process tree.
2. Identify other compromised systems by searching logs for requests to this URI or domain.
3. Attempt to contain the compromise (possibly by terminating the workload, depending on the stage of attack). Follow your organization’s internal processes for investigating and remediating compromised systems.

Requires Agent version 7.27 or greater.