[Rule Tuning] Fix Interactive Terminal Spawned via Perl bypasses

[yougharta]

hello there i am youghourta ghennai from Octodet .
i wanted to share some bypasses about this rule 'Interactive Terminal Spawned via Perl' .

##Problem :

this rule is supposed to detect shell spawning via perl .
the shell spawning could be done by using this command perl -e 'exec "/bin/sh";'
in your old rule you are only detecting the exact command like that :
event.category:process and event.type:(start or process_started) and process.name:perl and process.args:("exec \"/bin/sh\";" or "exec \"/bin/dash\";" or "exec \"/bin/bash\";")

here this could be bypassed by using one of this tricks :
perl -e 'exec "/bin/sh"'
perl -e 'exec "/bin/////sh";'

and also : perl -e 'exec "/bin/zsh";'
and this is what i present as a solution :

process where event.type in ("start" , "process_started") and process.name :("perl*") and process.args regex("exec*/*sh*")

Thanks for your time .

[cla-checker-service]

❌ Author of the following commits did not sign a Contributor Agreement:
29bb7e6, 96357a0, 87701ea

Please, read and sign the above mentioned agreement if you want to contribute to this project

[w0rk3r]

Closing this one due to limitations on rule type changes, I'll resume this one once we get alternatives.
More details on #1854