[New Rule] Modification of OpenSSH Binaries (#747)

* [New Rule] Modification of SSH Binaries * Update persistence_credential_access_modify_ssh_binaries.toml * exclude unrelated auditbeat FP events * updated TIDs and Tactics * fix order of TIDs and Tactics * relinted * added libkeyutils.so used by Ebury Backdoor loaded by all OpenSSH processes * renamed * conv to kql and added one FP * Update rules/linux/persistence_credential_access_modify_ssh_binaries.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/linux/persistence_credential_access_modify_ssh_binaries.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
2021-01-28 19:46:30 +01:00
parent d0ceb8cc4e
commit 3fc4aaec0f
1 changed files with 56 additions and 0 deletions
@@ -0,0 +1,56 @@
+[metadata]
+creation_date = "2020/12/21"
+maturity = "production"
+updated_date = "2020/12/21"
+
+[rule]
+author = ["Elastic"]
+description = """
+Adversaries may modify SSH related binaries for persistence or credential access by patching sensitive functions to
+enable unauthorized access or by logging SSH credentials for exfiltration.
+"""
+false_positives = ["Trusted OpenSSH executable updates. It's recommended to verify the integrity of OpenSSH binary changes."]
+from = "now-9m"
+index = ["auditbeat-*", "logs-endpoint.events.*"]
+language = "kuery"
+license = "Elastic License"
+name = "Modification of OpenSSH Binaries"
+references = ["https://blog.angelalonso.es/2016/09/anatomy-of-real-linux-intrusion-part-ii.html"]
+risk_score = 47
+rule_id = "0415f22a-2336-45fa-ba07-618a5942e22c"
+severity = "medium"
+tags = ["Elastic", "Host", "Linux", "Threat Detection", "Credential Access", "Persistence"]
+type = "query"
+
+query = '''
+event.category:file and event.type:change and 
+ process.name:* and
+ (file.path:(/usr/sbin/sshd or /usr/bin/ssh or /usr/bin/sftp or /usr/bin/scp) or file.name:libkeyutils.so) and
+ not process.executable:/usr/bin/dpkg
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1543"
+name = "Create or Modify System Process"
+reference = "https://attack.mitre.org/techniques/T1543/"
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1556"
+name = "Modify Authentication Process"
+reference = "https://attack.mitre.org/techniques/T1556/"
+
+
+[rule.threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"