AppArmor - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/apparmor/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 10:00:00 +0000AppArmor Policy Interface Tamperinghttps://feed.craftedsignal.io/briefs/2024-01-apparmor-policy-tampering/Tue, 09 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-apparmor-policy-tampering/Detection of unauthorized access to AppArmor kernel policy control interfaces, specifically the `.load`, `.replace`, or `.remove` files, indicating potential defense evasion or policy tampering on Linux systems.This threat brief focuses on detecting attempts to tamper with AppArmor policies on Linux systems. AppArmor is a security module that provides mandatory access control, limiting the actions that processes can take. Attackers may try to modify or disable AppArmor policies to evade detection and execute malicious code with fewer restrictions. This is achieved by directly interacting with the AppArmor kernel policy control interfaces, specifically the .load, .replace, and .remove files located under /sys/kernel/security/apparmor/. These files are used to load, modify, or remove AppArmor profiles. The rule published on 2026-03-23 identifies abnormal access to these interfaces which could indicate unauthorized policy changes, defense evasion, or the installation of attacker-controlled profiles. This type of activity is particularly concerning in environments where AppArmor policy changes are uncommon or strictly controlled.

Attack Chain

  1. Initial Access: The attacker gains initial access to the system, potentially through exploiting a vulnerability or using compromised credentials.
  2. Privilege Escalation: The attacker escalates privileges to root or another account with sufficient permissions to modify AppArmor policies. This may involve exploiting a kernel vulnerability or misconfigured sudo permissions.
  3. Defense Evasion: The attacker attempts to modify or disable AppArmor policies to evade detection and allow the execution of malicious code.
  4. Policy Modification: The attacker writes to /sys/kernel/security/apparmor/.load, /sys/kernel/security/apparmor/.replace, or /sys/kernel/security/apparmor/.remove to load a malicious AppArmor profile, replace an existing one with a weakened version, or remove a profile entirely.
  5. Persistence: The attacker establishes persistence by creating or modifying systemd units, cron jobs, or startup scripts that execute malicious code after the AppArmor policy is altered.
  6. Malicious Code Execution: The attacker executes malicious code that was previously blocked by AppArmor policies, now allowed due to the modified policies.
  7. Lateral Movement/Data Exfiltration: The attacker moves laterally within the network, accessing sensitive data or systems, and exfiltrates data to an external location.
  8. Impact: The attacker achieves their final objective, which may include data theft, system compromise, or disruption of services.

Impact

Successful tampering with AppArmor policies can have severe consequences. Attackers can bypass security controls, install malicious software, and gain unauthorized access to sensitive data. This can lead to data breaches, financial losses, and reputational damage. The impact is amplified if the compromised system is critical to business operations or contains valuable data. The referenced Qualys advisory "CrackArmor" highlights critical AppArmor flaws enabling local privilege escalation to root, further emphasizing the potential damage.

Recommendation

  • Deploy the provided EQL rule to your SIEM to detect access to AppArmor policy interfaces and tune it for your specific environment.
  • Enable the auditd_manager integration and configure the recommended audit rules to monitor access to the AppArmor policy files: -w /sys/kernel/security/apparmor/.load -p rw -k apparmor_policy_change, -w /sys/kernel/security/apparmor/.replace -p rw -k apparmor_policy_change, -w /sys/kernel/security/apparmor/.remove -p rw -k apparmor_policy_change.
  • Regularly review AppArmor policies for unauthorized modifications and ensure that critical services are running with the expected policies.
  • Implement strict access controls to limit who can administer AppArmor policies.
  • Monitor for privilege escalation attempts and unauthorized use of sudo.
]]>mediumadvisoryapparmordefense-evasionlinuxAppArmor Profile Compilation via apparmor_parserhttps://feed.craftedsignal.io/briefs/2024-01-apparmor-profile-compilation/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-apparmor-profile-compilation/Adversaries may abuse `apparmor_parser` to compile custom AppArmor profiles, potentially weakening security controls and facilitating privilege escalation on Linux systems.The apparmor_parser tool is used to compile AppArmor profiles on Linux systems. While typically used by system administrators and package installation scripts, adversaries can abuse this tool to compile malicious AppArmor profiles. These profiles can then be loaded into the kernel, potentially weakening security controls, altering the behavior of privileged programs, or assisting in exploitation chains. Detecting the use of apparmor_parser with output redirection flags such as -o is crucial for identifying potential attempts to manipulate AppArmor policies for malicious purposes. This activity is a component of defense evasion, enabling attackers to potentially disable security tools.

Attack Chain

  1. An attacker gains initial access to a Linux system, often through methods outside the scope of this specific detection (e.g., exploiting a vulnerability, compromised credentials).
  2. The attacker escalates privileges to root, which is typically required to modify or load AppArmor profiles.
  3. The attacker creates a malicious AppArmor profile. This profile might weaken restrictions on specific processes or grant excessive permissions.
  4. The attacker executes apparmor_parser with the -o option (or similar variants) to compile the malicious AppArmor profile to a file.
  5. The attacker loads the compiled profile into the AppArmor kernel module using tools like apparmor_status or other policy management interfaces, replacing an existing policy or adding a new one.
  6. The attacker restarts the service targeted by the malicious AppArmor profile, or triggers a reload of AppArmor policies, to activate the new profile.
  7. The attacker leverages the weakened security controls to execute malicious code, escalate privileges further, or maintain persistence.
  8. The attacker achieves their final objective, such as data exfiltration, system compromise, or denial of service.

Impact

A successful attack using a maliciously compiled AppArmor profile can lead to significant compromise of a Linux system. Weakening AppArmor policies can allow attackers to bypass security restrictions, escalate privileges, and execute arbitrary code with elevated permissions. This can result in data breaches, system instability, or complete system takeover. The impact is amplified if critical services like sshd, sudo, or container runtimes are targeted.

Recommendation

  • Implement the Sigma rule AppArmor Profile Compilation via apparmor_parser to detect the execution of apparmor_parser with output options.
  • Enable process monitoring and audit logging on Linux systems to capture command-line arguments for process executions.
  • Monitor for modifications to AppArmor policy directories (e.g., /etc/apparmor.d/) and policy loading events.
  • Implement strict access controls on AppArmor policy files and restrict who can load or modify policies.
  • Investigate any unexpected executions of apparmor_parser or modifications to AppArmor policies, especially when originating from unknown or untrusted sources.
]]>mediumadvisoryapparmordefense-evasionlinux