Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation

[metadata]
creation_date = "2026/08/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/09/18"

[rule]
author = ["Elastic"]
description = """
Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not
the Azure Linux Agent certificate under /var/lib/waagent. Adversaries can scrape WireServer certificates, mint a
LinuxTransport identity, and decrypt extension protectedSettings with openssl cms -decrypt or smime -decrypt.
"""
false_positives = [
    """
    Custom configuration-management that decrypts CMS blobs with an organization key outside /var/lib/waagent. Confirm
    the key path and exclude the specific command line after review.
    """,
]
from = "now-9m"
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation"
note = """## Triage and analysis

### Investigating Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation

CyberCX-style WireServer abuse on Linux generates `openssl req -x509 -subj /CN=LinuxTransport`, posts the public
certificate to WireServer `comp=certificates`, then runs `openssl cms -decrypt` or `openssl smime -decrypt` with
`temp.key`, `wireserver.key`, or another non-waagent key to unwrap protectedSettings.

Benign Azure Linux Agent activity looks like:

`openssl cms -inform DER -decrypt -recip /var/lib/waagent/<thumbprint>.crt -inkey /var/lib/waagent/<thumbprint>.prv`

The Azure Linux Agent is excluded by certificate path in process arguments (`/var/lib/waagent/*`) and by
parent executables `/usr/sbin/waagent` and `/usr/bin/waagent`. This does not exclude Python or
`run-command-extension` as parents because attacker scripts invoked via Run Command use those parents
with a non-waagent key. The agent itself also runs `openssl req ... /CN=LinuxTransport` with output
under `/var/lib/waagent/`; that argument path exclusion covers it.

### Possible investigation steps

- Review `process.command_line` and `process.args` for `LinuxTransport`, `wireserver.key`, `temp.key`, `payload.p7m`,
  or `payload.pfx`.
- Inspect parent and grandparent: Run Command (`/var/lib/waagent/run-command/`) or an interactive shell is higher
  risk than a one-off admin session with a ticket.
- Correlate with network events from curl to `168.63.129.16` ports 80 and 32526 on the same host.
- Search StorageRead logs for anonymous or SAS GetBlob of the same storage account after the decrypt.
- Hunt for the generated key files (`temp.key`, `wireserver.key`) on disk and in `/tmp`.

### False positive analysis

- The Azure Linux Agent decrypt path under `/var/lib/waagent/` and waagent parent executables
  (`/usr/sbin/waagent`, `/usr/bin/waagent`) are excluded.
- Legitimate certificate tooling that uses `-subj /CN=LinuxTransport` is unexpected; treat as suspicious until proven
  otherwise.

### Response and remediation

- Isolate the VM, delete attacker-generated keys and decrypted payloads, and rotate secrets that were in
  protectedSettings (SAS, connection strings, CSE script contents).
- Rotate the VM managed identity and review extension configuration.
- Revoke any SAS that was replayed from the decrypted settings.
"""
references = [
    "https://cybercx.com.au/blog/azure-ssrf-metadata/",
    "https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/",
    "https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services",
    "https://gtfobins.github.io/gtfobins/openssl/",
]
risk_score = 47
rule_id = "5bb27863-2da6-4d0d-879a-1efb10479c39"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "Domain: Cloud",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Platform: Azure",
    "Platform: Linux",
    "Tactic: Credential Access",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
    "Rule Type: Event Correlation (EQL)",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start") and process.name == "openssl" and
(
  (
    process.args in ("cms", "smime") and process.args == "-decrypt"
  ) or
  (
    process.args == "req" and process.args : "*LinuxTransport*"
  )
) and
not process.args like "/var/lib/waagent/*" and
not process.parent.executable like (
  "/usr/sbin/waagent",
  "/usr/bin/waagent"
)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"