Detect RC Scripts in Google Chronicle

rule t1037_004_rc_script_persistence {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects RC script persistence via file modification or process-based writes to Unix startup script paths (T1037.004)"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1037.004"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1037/004/"
    created = "2026-04-16"

  events:
    (
      // File write to RC script paths
      (
        $e.metadata.event_type = "FILE_CREATION" or
        $e.metadata.event_type = "FILE_MODIFICATION"
      ) and
      (
        re.regex($e.target.file.full_path, `/etc/rc\.local`) or
        re.regex($e.target.file.full_path, `/etc/rc\.common`) or
        re.regex($e.target.file.full_path, `/etc/rc\.d/`) or
        re.regex($e.target.file.full_path, `/etc/init\.d/`) or
        re.regex($e.target.file.full_path, `/etc/rc\.local\.d/`) or
        re.regex($e.target.file.full_path, `/etc/rc[0-6]\.d/`) or
        $e.target.file.names = "rc.local" or
        $e.target.file.names = "rc.common" or
        $e.target.file.names = "local.sh"
      )
    ) or
    (
      // Process writing to RC script paths via shell redirect or tee
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      $e.principal.process.command_line != "" and
      (
        re.regex($e.principal.process.command_line, `/etc/rc\.local`) or
        re.regex($e.principal.process.command_line, `/etc/rc\.d/`) or
        re.regex($e.principal.process.command_line, `/etc/init\.d/`) or
        re.regex($e.principal.process.command_line, `/etc/rc\.local\.d/`)
      ) and
      re.regex($e.principal.process.command_line, `(echo|tee|cat|sed|awk|dd|wget|curl|python3?|perl|bash|sh)`) and
      re.regex($e.principal.process.command_line, `>>`) and
      $e.principal.process.file.names in (
        "bash", "sh", "dash", "zsh", "python", "python3",
        "perl", "ruby", "curl", "wget", "nc", "netcat", "ncat", "tee", "dd"
      )
    )

  condition:
    $e
}