From 2778558ae3dd270a63a1d7ab3c23864d401c0455 Mon Sep 17 00:00:00 2001 From: petermmm Date: Sun, 12 May 2019 02:07:13 +0200 Subject: [PATCH 1/4] added rule .bash_profile and .bashrc T1156 --- .../auditd/lnx_auditd_alter_bash_profile.yml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 rules/linux/auditd/lnx_auditd_alter_bash_profile.yml diff --git a/rules/linux/auditd/lnx_auditd_alter_bash_profile.yml b/rules/linux/auditd/lnx_auditd_alter_bash_profile.yml new file mode 100644 index 000000000..43f92a856 --- /dev/null +++ b/rules/linux/auditd/lnx_auditd_alter_bash_profile.yml @@ -0,0 +1,30 @@ +title: Detects Suspicious edit of .bash_profile and .bashrc on Linux systems +status: experimental +description: Detects change of user environment. Adversaries can insert code into these files to gain persistence each time a user logs in or opens a new shell. +references: + - 'MITRE Attack technique T1156; .bash_profile and .bashrc. ' +date: 2019/05/12 +tags: + - attack.s0002 + - attack.t1156 + - attack.persistence +author: Peter Matkovski +logsource: + product: linux + service: auditd +detection: + selection: + type: 'PATH' + name: + - '/home/*/.bashrc' + - '/home/*/.bash_profile' + - '/home/*/.profile' + - '/etc/profile' + - '/etc/shells' + - '/etc/bashrc' + - '/etc/csh.cshrc' + - '/etc/csh.login' + condition: selection +falsepositives: + - Admin or User activity +level: medium From b6c4e64a9be1a314c0954e4053edb2eb8439e956 Mon Sep 17 00:00:00 2001 From: petermmm Date: Sun, 12 May 2019 11:59:13 +0200 Subject: [PATCH 2/4] fixed attack category number 2->3 --- rules/linux/auditd/lnx_auditd_alter_bash_profile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/linux/auditd/lnx_auditd_alter_bash_profile.yml b/rules/linux/auditd/lnx_auditd_alter_bash_profile.yml index 43f92a856..f974b4585 100644 --- a/rules/linux/auditd/lnx_auditd_alter_bash_profile.yml +++ b/rules/linux/auditd/lnx_auditd_alter_bash_profile.yml @@ -5,7 +5,7 @@ references: - 'MITRE Attack technique T1156; .bash_profile and .bashrc. ' date: 2019/05/12 tags: - - attack.s0002 + - attack.s0003 - attack.t1156 - attack.persistence author: Peter Matkovski From e8a7c5f7b966b01644a70a8ee87c57c79d4afad4 Mon Sep 17 00:00:00 2001 From: Florian GAULTIER Date: Mon, 27 May 2019 17:22:28 +0200 Subject: [PATCH 3/4] fix missing condition when unique plus timeframe --- tools/sigma/backends/elasticsearch.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py index a723a5767..56efadf00 100644 --- a/tools/sigma/backends/elasticsearch.py +++ b/tools/sigma/backends/elasticsearch.py @@ -245,7 +245,9 @@ class ElasticsearchDSLBackend(RulenameCommentMixin, ElasticsearchWildcardHandlin dateField = self.sigmaconfig.config['dateField'] if self.interval: if 'bool' not in self.queries[-1]['query']['constant_score']['filter']: + saved_simple_query = self.queries[-1]['query']['constant_score']['filter'] self.queries[-1]['query']['constant_score']['filter'] = {'bool': {'must': []}} + self.queries[-1]['query']['constant_score']['filter']['bool']['must'].append(saved_simple_query) if 'must' not in self.queries[-1]['query']['constant_score']['filter']['bool']: self.queries[-1]['query']['constant_score']['filter']['bool']['must'] = [] @@ -748,7 +750,7 @@ class ElastalertBackend(MultiRuleOutputMixin, ElasticsearchQuerystringBackend): if idx == agg.aggfunc: funcname = name break - raise NotImplementedError("%s : The '%s' aggregation operator is not yet implemented for this backend"%(self.title, funcname)) + raise NotImplementedError("%s : The '%s' aggregation operator is not yet implemented for this backend"%(self.title, funcname)) def convertLevel(self, level): return { From d866e7575004f3d92ca5983e61993cdc0dd27d24 Mon Sep 17 00:00:00 2001 From: Florian GAULTIER Date: Mon, 27 May 2019 17:27:16 +0200 Subject: [PATCH 4/4] Be sure there is a key in the single condition --- tools/sigma/backends/elasticsearch.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py index 56efadf00..b3a993a5c 100644 --- a/tools/sigma/backends/elasticsearch.py +++ b/tools/sigma/backends/elasticsearch.py @@ -247,7 +247,8 @@ class ElasticsearchDSLBackend(RulenameCommentMixin, ElasticsearchWildcardHandlin if 'bool' not in self.queries[-1]['query']['constant_score']['filter']: saved_simple_query = self.queries[-1]['query']['constant_score']['filter'] self.queries[-1]['query']['constant_score']['filter'] = {'bool': {'must': []}} - self.queries[-1]['query']['constant_score']['filter']['bool']['must'].append(saved_simple_query) + if len(saved_simple_query.keys()) > 0: + self.queries[-1]['query']['constant_score']['filter']['bool']['must'].append(saved_simple_query) if 'must' not in self.queries[-1]['query']['constant_score']['filter']['bool']: self.queries[-1]['query']['constant_score']['filter']['bool']['must'] = []