Detect RC Scripts in CrowdStrike LogScale

// T1037.004 - RC Script Persistence Detection
// Detect file writes and process-based modifications to Unix RC startup scripts

#repo=base_sensor
#event_simpleName in ("FileOpenInfo", "FileWritten", "ProcessRollup2", "SyntheticProcessRollup2")

// --- Branch 1: File write events targeting RC script paths ---
| case {
    #event_simpleName in ("FileWritten", "FileOpenInfo") AND
    (
      TargetFileName = /\/etc\/rc\.local$/ OR
      TargetFileName = /\/etc\/rc\.common$/ OR
      TargetFileName = /\/etc\/rc\.d\// OR
      TargetFileName = /\/etc\/init\.d\// OR
      TargetFileName = /\/etc\/rc\.local\.d\// OR
      TargetFileName = /\/etc\/rc[0-6]\.d\// OR
      TargetFileName = /rc\.local$/ OR
      TargetFileName = /rc\.common$/ OR
      TargetFileName = /local\.sh$/
    )
      | eval detection_branch = "FileWrite to RC Script"
      | eval risk_level = "HIGH";

    // --- Branch 2: Process writing to RC script via command line ---
    #event_simpleName in ("ProcessRollup2", "SyntheticProcessRollup2") AND
    (
      CommandLine = /\/etc\/rc\.local/ OR
      CommandLine = /\/etc\/rc\.d\// OR
      CommandLine = /\/etc\/init\.d\// OR
      CommandLine = /\/etc\/rc\.local\.d\//
    ) AND
    CommandLine = /(echo|tee|cat|sed|awk|dd|wget|curl|python3?|perl|bash|sh)/ AND
    CommandLine = />>/ AND
    FileName in (
      "bash", "sh", "dash", "zsh", "python", "python3",
      "perl", "ruby", "curl", "wget", "nc", "netcat", "ncat", "tee", "dd"
    )
      | eval detection_branch = "Process Writing to RC Script"
      | eval risk_level = case(
          CommandLine = /(\/tmp\/|\/dev\/shm\/|\/var\/tmp\/|\/run\/)/, "CRITICAL",
          true(), "HIGH"
        );

    true() | drop
  }

| eval suspicious_staging = if(
    CommandLine = /(\/tmp\/|\/dev\/shm\/|\/var\/tmp\/|\/run\/)/, "true", "false"
  )

| groupBy(
    [ComputerName, UserName, detection_branch, risk_level, suspicious_staging,
     FileName, CommandLine, TargetFileName],
    function=[
      count(aid, as=event_count),
      max(@timestamp, as=last_seen),
      min(@timestamp, as=first_seen)
    ]
  )

| sort last_seen desc