Linux Operating System - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/linux-operating-system/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 15:00:00 +0000Linux Dynamic Linker Copy and Shared Object Creationhttps://feed.craftedsignal.io/briefs/2024-01-dynamic-linker-copy/Tue, 09 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-dynamic-linker-copy/This brief outlines detection strategies for Linux systems where the dynamic linker binary is copied and a shared object file is created, a technique used by malware to inject malicious shared objects by patching the dynamic linker.This brief addresses a persistence technique where attackers copy the Linux dynamic linker binary (ld-linux-x86-64.so.2) and subsequently create or modify shared object files (.so), often after modifying /etc/ld.so.preload. This activity has been observed in Linux malware campaigns, where attackers aim to inject and preload malicious shared objects. The dynamic linker is a crucial component for loading shared libraries, making it a valuable target for attackers seeking to establish persistence and execute malicious code. Recent malware, such as Orbit, has used this technique, making it critical to detect this behavior. The detection focuses on identifying processes involved in copying the dynamic linker, modifications to /etc/ld.so.preload, and the creation of suspicious shared object files.

Attack Chain

  1. An attacker gains initial access to a Linux system, possibly through exploitation of a vulnerability or compromised credentials.
  2. The attacker uses cp, rsync, or mv to create a backup copy of the dynamic linker (/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2, /lib64/ld-linux-x86-64.so.2, /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2, or /usr/lib64/ld-linux-x86-64.so.2).
  3. The attacker modifies the original dynamic linker binary to inject malicious code or alter its functionality.
  4. The attacker creates or modifies a shared object (.so) file containing malicious code.
  5. The attacker modifies the /etc/ld.so.preload file to include the path to the malicious shared object. This ensures that the malicious shared object is loaded by every program that uses the dynamic linker.
  6. The attacker executes a program that relies on the dynamic linker, triggering the loading of the malicious shared object.
  7. The malicious shared object executes its payload, potentially leading to code execution, privilege escalation, or data exfiltration.
  8. The attacker maintains persistence by ensuring the malicious shared object continues to be loaded on system startup or during regular program execution.

Impact

Successful execution of this attack allows the attacker to achieve persistence on the compromised Linux system. This can lead to long-term control over the system, allowing the attacker to steal sensitive data, install backdoors, or use the system as a launching point for further attacks within the network. The Intezer report referenced in the brief highlights the use of this technique by the Orbit malware, demonstrating its real-world impact. The targeted sectors can be broad, depending on the attacker's objectives, and can include any organization relying on Linux systems for critical infrastructure or sensitive data storage.

Recommendation

  • Deploy the "Dynamic Linker Copy and Shared Object Creation" Sigma rule to your SIEM to detect suspicious file copy operations and shared object creation activities.
  • Monitor /etc/ld.so.preload file modifications using a file integrity monitoring (FIM) system and correlate with process creation events related to cp, rsync, and mv.
  • Enable process monitoring with command-line argument logging to capture the full command executed by processes like cp, rsync, and mv. This will help identify cases where the dynamic linker is being targeted.
  • Investigate any alerts triggered by the Sigma rule and analyze the involved processes, files, and user accounts to determine if malicious activity is present. Reference the investigation steps in the rule's note field.
  • Monitor for the creation of shared objects (.so files) in unusual directories and correlate these events with modifications to /etc/ld.so.preload.
]]>highadvisorypersistencelinuxdynamic-linkershared-objectPotential Defense Evasion via Symbolic Link of Common Linux Binaries to Writable Directorieshttps://feed.craftedsignal.io/briefs/2024-01-03-symlink-defense-evasion/Wed, 03 Jan 2024 14:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-symlink-defense-evasion/An adversary may create symbolic links of legitimate system binaries in world-writable directories to potentially bypass security restrictions or execute malicious code with elevated privileges by masquerading as a trusted process.This threat brief addresses a potential defense evasion technique observed on Linux systems. An attacker may create symbolic links (symlinks) of commonly used system binaries, such as sh, bash, or vi, into world-writable directories like /tmp or /var/tmp. This allows the attacker to execute commands with the permissions of the linked binary or use them to bypass security restrictions. The goal is to execute code by masquerading as a trusted process, potentially evading detection by security tools relying on path-based whitelisting or integrity checks. This technique can be used to achieve persistence or escalate privileges. While the original source is a detection rule repository, this brief focuses on detecting the symlink creation itself.

Attack Chain

  1. The attacker gains initial access to the system via an exploit or compromised credentials (not detailed in source).
  2. The attacker identifies world-writable directories such as /tmp, /var/tmp, or /dev/shm.
  3. The attacker identifies commonly used system binaries such as /bin/sh, /bin/bash, or /usr/bin/vi.
  4. The attacker creates a symbolic link of a system binary in a world-writable directory using the ln -s command. For example: ln -s /bin/sh /tmp/sh.
  5. The attacker executes the symlink in the writable directory. For example: /tmp/sh -c "malicious_command".
  6. The command executes with the privileges of the linked binary, potentially bypassing security restrictions or whitelisting rules.
  7. The attacker uses this foothold to further compromise the system, escalate privileges, or establish persistence.

Impact

A successful attack using this technique can lead to privilege escalation, persistence, and potentially complete system compromise. By creating symbolic links to system binaries in world-writable directories, attackers can bypass security measures and execute malicious code with elevated privileges. While the number of affected systems is not specified in the source, the technique is applicable to any Linux system with world-writable directories and standard system binaries.

Recommendation

  • Deploy the "Detect Suspicious Symlink Creation in Writable Directories" Sigma rule to your SIEM and tune for your environment to detect the initial creation of malicious symlinks.
  • Enable file integrity monitoring (FIM) on system binaries and world-writable directories to detect unauthorized modifications, including the creation of symbolic links.
  • Implement access controls to restrict write access to critical system directories and binaries.
  • Investigate any alerts generated by the Sigma rules and FIM regarding symlink creation in world-writable directories.
]]>mediumadvisorydefense_evasionsymlinklinux