Add bash rules

nursery/download-and-execute-payload.yml

@@ -0,0 +1,38 @@
+rule:
+  meta:
+    name: download and execute payload
+    namespace: host-interaction/software
+    authors:
+      - saniyafatima07
+    scopes:
+      static: function
+      dynamic: call
+    att&ck:
+      - Command and Control::Ingress Tool Transfer [T1105]
+    mbc:
+      - Lateral Movement::Ingress Tool Transfer [E1105]
+      - Execution::Remote Commands::Download File [B0011.002]
+    references:
+      - https://www.elastic.co/security-labs/teampcp-container-attack-scenario
+      - https://www.elastic.co/security-labs/outlaw-linux-malware
+    examples:
+      - 91800a2afbdc98837d6b23a6de2b5f2433fedcdae9330d0a5b2a776571a4fef6.sh_:0xA4
+  features:
+    - or:
+      - and:
+        - or:
+          - api: curl
+          - api: wget
+        - or:
+          - substring: "| bash"
+          - substring: "| sh"
+          - substring: "| zsh"
+          - substring: "| python"
+          - substring: "| perl"
+          - api: bash
+          - api: sh
+          - api: python
+          - api: perl
+          - api: exec
+          - api: source
+          - api: chmod

nursery/terminate-process-via-killall.yml

@@ -0,0 +1,21 @@
+rule:
+  meta:
+    name: terminate process via killall
+    namespace: host-interaction/process/terminate
+    authors:
+      - saniyafatima07
+    scopes:
+      static: function
+      dynamic: call
+    mbc:
+      - Process::Terminate Process [C0018]
+    references:
+      - https://www.elastic.co/security-labs/teampcp-container-attack-scenario
+      - https://www.elastic.co/security-labs/outlaw-linux-malware
+    examples:
+      - cff512dd1c9f82e79a9cc5af5f0a096b20737548f8d1bdc1aebf5744ffc78f6b.sh_:0x0
+  features:
+    - or:
+      - api: killall
+      - api: kill
+      - api: pkill