---
title: Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation
description: Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not the Azure Linux Agent certificate...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt
products:
  - Elastic Security
---

# Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation
Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not
the Azure Linux Agent certificate under /var/lib/waagent. Adversaries can scrape WireServer certificates, mint a
LinuxTransport identity, and decrypt extension protectedSettings with openssl cms -decrypt or smime -decrypt.
**Rule type**: eql
**Rule indices**:
- logs-endpoint.events.process-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://cybercx.com.au/blog/azure-ssrf-metadata/](https://cybercx.com.au/blog/azure-ssrf-metadata/)](https://cybercx.com.au/blog/azure-ssrf-metadata/)
- [[https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/](https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/)](https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/)
- [[https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services](https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services)](https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services)
- [[https://gtfobins.github.io/gtfobins/openssl/](https://gtfobins.github.io/gtfobins/openssl/)](https://gtfobins.github.io/gtfobins/openssl/)

**Tags**:
- Domain: Endpoint
- Domain: Cloud
- OS: Linux
- Use Case: Threat Detection
- Platform: Azure
- Platform: Linux
- Tactic: Credential Access
- Tactic: Defense Evasion
- Data Source: Elastic Defend
- Resources: Investigation Guide
- Rule Type: Event Correlation (EQL)

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation

CyberCX-style WireServer abuse on Linux generates `openssl req -x509 -subj /CN=LinuxTransport`, posts the public
certificate to WireServer `comp=certificates`, then runs `openssl cms -decrypt` or `openssl smime -decrypt` with
`temp.key`, `wireserver.key`, or another non-waagent key to unwrap protectedSettings.
Benign Azure Linux Agent activity looks like:
`openssl cms -inform DER -decrypt -recip /var/lib/waagent/<thumbprint>.crt -inkey /var/lib/waagent/<thumbprint>.prv`
The Azure Linux Agent is excluded by certificate path in process arguments (`/var/lib/waagent/*`) and by
parent executables `/usr/sbin/waagent` and `/usr/bin/waagent`. This does not exclude Python or
`run-command-extension` as parents because attacker scripts invoked via Run Command use those parents
with a non-waagent key. The agent itself also runs `openssl req ... /CN=LinuxTransport` with output
under `/var/lib/waagent/`; that argument path exclusion covers it.

### Possible investigation steps

- Review `process.command_line` and `process.args` for `LinuxTransport`, `wireserver.key`, `temp.key`, `payload.p7m`,
  or `payload.pfx`.
- Inspect parent and grandparent: Run Command (`/var/lib/waagent/run-command/`) or an interactive shell is higher
  risk than a one-off admin session with a ticket.
- Correlate with network events from curl to `168.63.129.16` ports 80 and 32526 on the same host.
- Search StorageRead logs for anonymous or SAS GetBlob of the same storage account after the decrypt.
- Hunt for the generated key files (`temp.key`, `wireserver.key`) on disk and in `/tmp`.


### False positive analysis

- The Azure Linux Agent decrypt path under `/var/lib/waagent/` and waagent parent executables
  (`/usr/sbin/waagent`, `/usr/bin/waagent`) are excluded.
- Legitimate certificate tooling that uses `-subj /CN=LinuxTransport` is unexpected; treat as suspicious until proven
  otherwise.


### Response and remediation

- Isolate the VM, delete attacker-generated keys and decrypted payloads, and rotate secrets that were in
  protectedSettings (SAS, connection strings, CSE script contents).
- Rotate the VM managed identity and review extension configuration.
- Revoke any SAS that was replayed from the decrypted settings.


## Rule Query

```eql
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start") and process.name == "openssl" and
(
  (
    process.args in ("cms", "smime") and process.args == "-decrypt"
  ) or
  (
    process.args == "req" and process.args : "*LinuxTransport*"
  )
) and
not process.args like "/var/lib/waagent/*" and
not process.parent.executable like (
  "/usr/sbin/waagent",
  "/usr/bin/waagent"
)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Credential Access
  - Id: TA0006
  - Reference URL: [[https://attack.mitre.org/tactics/TA0006/](https://attack.mitre.org/tactics/TA0006/)](https://attack.mitre.org/tactics/TA0006/)
- Technique:
  - Name: Unsecured Credentials
  - Id: T1552
  - Reference URL: [[https://attack.mitre.org/techniques/T1552/](https://attack.mitre.org/techniques/T1552/)](https://attack.mitre.org/techniques/T1552/)
- Sub Technique:
  - Name: Cloud Instance Metadata API
  - Id: T1552.005
  - Reference URL: [[https://attack.mitre.org/techniques/T1552/005/](https://attack.mitre.org/techniques/T1552/005/)](https://attack.mitre.org/techniques/T1552/005/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Defense Evasion
  - Id: TA0005
  - Reference URL: [[https://attack.mitre.org/tactics/TA0005/](https://attack.mitre.org/tactics/TA0005/)](https://attack.mitre.org/tactics/TA0005/)
- Technique:
  - Name: Deobfuscate/Decode Files or Information
  - Id: T1140
  - Reference URL: [[https://attack.mitre.org/techniques/T1140/](https://attack.mitre.org/techniques/T1140/)](https://attack.mitre.org/techniques/T1140/)