Detect Compromise Software Dependencies and Development Tools in Elastic Security

any where
  (
    // Arm 1: Package manager spawning suspicious child processes (postinstall/preinstall hook abuse)
    event.category == "process" and event.type == "start" and
    process.parent.name in~ ("npm", "npm.cmd", "node", "node.exe", "pip", "pip3", "pip.exe", "pip3.exe", "python", "python3", "python.exe", "python3.exe", "pipx", "yarn", "pnpm", "gem", "bundle", "cargo", "go", "nuget", "dotnet") and
    (
      process.name in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe") or
      process.command_line like~ ("*/dev/tcp*", "*base64 -d*", "*base64 --decode*", "*bash -i*", "*sh -i*", "*nc -e*", "*ncat -e*", "*python -c*", "*perl -e*", "*DownloadString*", "*DownloadFile*", "*Invoke-Expression*", "*IEX(*", "*curl http*", "*wget http*", "*--registry http*", "*postinstall*", "*preinstall*")
    )
  )
  or
  (
    // Arm 1b: Lifecycle hook parent spawning suspicious process
    event.category == "process" and event.type == "start" and
    process.parent.command_line like~ ("*postinstall*", "*preinstall*", "*install.js*", "*setup.py*", "*node-pre-gyp*") and
    process.name in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe")
  )
  or
  (
    // Arm 2: Package manager processes making unexpected external network connections
    event.category == "network" and event.type == "connection" and
    network.direction == "egress" and
    process.name in~ ("npm", "node", "node.exe", "pip", "pip3", "python", "python3", "yarn", "pnpm", "gem", "bundle", "cargo", "go") and
    not destination.domain in~ ("registry.npmjs.org", "pypi.org", "files.pythonhosted.org", "rubygems.org", "crates.io", "nuget.org", "pkg.go.dev", "proxy.golang.org", "yarnpkg.com", "registry.yarnpkg.com")
  )
  or
  (
    // Arm 3: CI/CD pipeline and build file creation or modification
    event.category == "file" and event.type in ("creation", "change") and
    (
      file.path like~ ("*/.github/workflows/*", "*/.gitlab-ci*", "*/Jenkinsfile*", "*/.circleci/*", "*/.travis*", "*/azure-pipelines*") or
      file.name in~ ("Makefile", "CMakeLists.txt", "build.gradle", "pom.xml")
    )
  )