iai-rsa
66f3c54b89
- Updated lnx_auditd_system_info_discovery.yml - Added lnx_auditd_modify_system_firewall.yml - Depracted lnx_auditd_alter_bash_profile.yml and replaced by an enhanced version in lnx_auditd_unix_shell_configuration_modification.yml
54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
title: Unix Shell Configuration Modification
|
|
id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d
|
|
related:
|
|
- id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9
|
|
type: obsoletes
|
|
status: experimental
|
|
description: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.
|
|
references:
|
|
- https://objective-see.org/blog/blog_0x68.html
|
|
- https://www.glitch-cat.com/p/green-lambert-and-attack
|
|
- https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
|
|
author: Peter Matkovski, IAI
|
|
date: 2023/03/06
|
|
modified: 2023/03/15
|
|
tags:
|
|
- attack.persistence
|
|
- attack.t1546.004
|
|
logsource:
|
|
product: linux
|
|
service: auditd
|
|
detection:
|
|
selection:
|
|
type: 'PATH'
|
|
name:
|
|
- '/etc/shells'
|
|
- '/etc/profile'
|
|
- '/etc/profile.d/*'
|
|
- '/etc/bash.bashrc'
|
|
- '/etc/bashrc'
|
|
- '/etc/zsh/zprofile'
|
|
- '/etc/zsh/zshrc'
|
|
- '/etc/zsh/zlogin'
|
|
- '/etc/zsh/zlogout'
|
|
- '/etc/csh.cshrc'
|
|
- '/etc/csh.login'
|
|
- '/root/.bashrc'
|
|
- '/root/.bash_profile'
|
|
- '/root/.profile'
|
|
- '/root/.zshrc'
|
|
- '/root/.zprofile'
|
|
- '/home/*/.bashrc'
|
|
- '/home/*/.zshrc'
|
|
- '/home/*/.bash_profile'
|
|
- '/home/*/.zprofile'
|
|
- '/home/*/.profile'
|
|
- '/home/*/.bash_login'
|
|
- '/home/*/.bash_logout'
|
|
- '/home/*/.zlogin'
|
|
- '/home/*/.zlogout'
|
|
condition: selection
|
|
falsepositives:
|
|
- Admin or User activity are expected to generate some false positives
|
|
level: medium
|