Linux - CraftedSignal Threat Feed

Potential Persistence via Linux File Modification

hello@craftedsignal.io — Thu, 14 Nov 2024 12:00:00 +0000

This detection rule leverages File Integrity Monitoring (FIM) data to identify potential persistence mechanisms employed on Linux systems. Attackers often modify critical system files to ensure their malicious code persists across reboots or user logons. This rule focuses on detecting unauthorized modifications to files associated with cron jobs, systemd services, SSH configurations, shell profiles, and other persistence-related configurations. By monitoring these files for unexpected changes, defenders can identify potential compromises and prevent attackers from maintaining long-term access. The rule is designed to work with the Elastic FIM integration and requires proper configuration of the FIM policy to monitor the relevant file paths. It is crucial to tune the rule with appropriate exclusions for legitimate administrative activities to minimize false positives.

Attack Chain

Initial Access: An attacker gains initial access to a Linux system, potentially through exploiting a vulnerability or using compromised credentials.
Privilege Escalation: The attacker escalates privileges to root or another highly privileged account using techniques such as exploiting kernel vulnerabilities or misconfigured SUID/SGID binaries.
Cron Job Modification: The attacker modifies cron job files (e.g., /etc/crontab, /etc/cron.d/*) to schedule malicious scripts or commands to run periodically.
Systemd Service Modification: The attacker modifies systemd service files (e.g., /etc/systemd/system/*) to create a new service or modify an existing one to execute malicious code upon system startup.
Shell Profile Modification: The attacker modifies shell profile files (e.g., /etc/profile, ~/.bashrc) to execute malicious code when a user logs in.
SSH Configuration Modification: The attacker modifies SSH configuration files (e.g., /etc/ssh/sshd_config, ~/.ssh/authorized_keys) to enable unauthorized access to the system.
LD_PRELOAD Modification: The attacker modifies /etc/ld.so.preload to inject malicious code into other processes.
Persistence Achieved: The attacker achieves persistence by ensuring their malicious code is executed automatically at system startup or user logon, allowing them to maintain long-term access to the compromised system.

Impact

A successful persistence attack can allow attackers to maintain unauthorized access to a compromised Linux system indefinitely. This can lead to data theft, system disruption, or further exploitation of the network. The rule aims to detect these persistence attempts early, minimizing the potential damage. The rule can trigger on legitimate admin activity if not tuned properly, so careful whitelisting is needed.

Recommendation

Enable the Elastic FIM integration and configure it to monitor the file paths specified in the rule query. Refer to the Elastic FIM documentation for detailed instructions.
Deploy the provided Sigma rule to your SIEM and tune it for your environment.
Investigate any alerts generated by the Sigma rule by reviewing the modified file and the user or process responsible for the modification.
Implement appropriate whitelists to exclude legitimate administrative activities from triggering the rule. Pay special attention to temporary files.
Ensure that access controls and permissions on critical system files are properly configured to prevent unauthorized modifications.
Regularly review and update the FIM policy to ensure it covers all relevant file paths.

Potential Credential Discovery via Recursive Grep

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

This detection identifies potential credential access attempts via recursive grep commands on Linux and macOS systems. Attackers and insider threats might employ grep -r (or --recursive, -R) to search directories for sensitive information such as passwords, API keys, private keys, cloud tokens, or repository and environment files. The rule aggregates events per host, user, and parent process within a one-minute window, triggering only when at least three distinct grep command lines match, thereby reducing false positives from occasional searches. This activity is a strong indicator of potential reconnaissance before credential theft or broader system compromise. The rule targets Linux and macOS systems and relies on process execution data.

Attack Chain

An attacker gains initial access to a Linux or macOS system, possibly via SSH or other remote access methods.
The attacker executes grep or egrep with recursive options (-r, --recursive, or -R) to search within directories.
The grep command includes patterns related to sensitive information, such as "password," "secret," "token," "api_key," ".env," ".git," or ".aws."
The system processes multiple distinct grep commands within a short timeframe (one minute), all originating from the same host, user, and parent process.
The attacker identifies files containing sensitive information based on the grep output.
The attacker exfiltrates the discovered credentials or secrets for lateral movement or external use.
The attacker may use the compromised credentials to access sensitive data or systems.
The attacker achieves their objective, such as data theft or unauthorized access to critical resources.

Impact

Successful exploitation can lead to unauthorized access to sensitive data, including passwords, API keys, and other confidential information. This can result in data breaches, financial loss, and reputational damage. The scope of impact depends on the permissions associated with the compromised credentials and the sensitivity of the data exposed. Observed activity can indicate targeted attacks with a high probability of resulting in data exfiltration or system compromise.

Recommendation

Enable process monitoring with command-line argument logging on Linux and macOS systems to capture the necessary data for the rules below (logsource: process_creation).
Deploy the provided Sigma rules to detect suspicious recursive grep commands indicative of credential discovery (rules).
Investigate any alerts generated by the Sigma rules, focusing on the specific command-line arguments and parent processes involved. Review the "Possible investigation steps" in the original rule documentation (references).
Implement stricter file access controls to limit the exposure of sensitive files (references).

Potential Data Exfiltration via Wget on Linux Systems

hello@craftedsignal.io — Tue, 09 Jan 2024 10:00:00 +0000

This detection identifies the abuse of wget on Linux systems to exfiltrate data to external servers. Attackers may collect sensitive files, compress them, and then use wget with options such as --post-file, --post-data, or --body-file to transmit the data via HTTP/HTTPS. This activity, while not inherently malicious, becomes suspicious when combined with access to sensitive files or when observed in non-interactive sessions (e.g., cron jobs). The rule focuses on detecting unusual wget command-line arguments indicative of data exfiltration. This helps defenders identify potentially compromised systems where data is being stolen.

Attack Chain

Initial Access: Attacker gains access to the target Linux system through vulnerabilities, stolen credentials, or other means.
Data Collection: Attacker identifies and collects sensitive files from various locations on the system, such as /etc/passwd, /etc/shadow, user SSH keys (~/.ssh/*), environment files (*.env*), and temporary directories (/tmp/*, /var/tmp/*).
Staging: The collected files are often compressed into an archive (e.g., loot.tar.gz) and placed in a temporary directory, like /tmp.
Command Construction: The attacker crafts a wget command to upload the staged data to a remote server. This command typically includes options like --post-file, --post-data, or --body-file to send the file content via HTTP POST.
Exfiltration: The wget command is executed, sending the staged data to the attacker's command and control (C2) server.
Cleanup (Optional): The attacker may attempt to delete the staged archive and any associated scripts to cover their tracks.
Persistence (Optional): The attacker may schedule the exfiltration process via cron jobs or systemd timers to automate the data theft.

Impact

A successful attack can result in the exfiltration of sensitive data, including credentials, configuration files, source code, and customer data. The severity of the impact depends on the nature of the exfiltrated data. Compromised credentials can lead to further unauthorized access to internal systems. Leaked source code can expose vulnerabilities. Stolen customer data can result in financial losses and reputational damage.

Recommendation

Deploy the Sigma rule "Potential Data Exfiltration Through Wget" to your SIEM to detect suspicious wget commands (see rules section).
Enable process creation logging with command-line arguments on Linux systems to capture the full wget command lines (reference: logsource).
Investigate any alerts generated by the Sigma rule by examining the process tree, user context, and destination endpoint to determine legitimacy.
Implement network monitoring to detect unusual outbound HTTP/HTTPS traffic, especially POST requests to unfamiliar destinations.
Harden Linux systems by restricting the use of wget where it is not necessary and enforcing SELinux/AppArmor policies to limit its capabilities (reference: setup section).
Regularly review and audit cron jobs and systemd timers for suspicious entries that could be used for automated data exfiltration.

Linux Clipboard Activity Monitoring

hello@craftedsignal.io — Wed, 03 Jan 2024 18:30:00 +0000

This brief outlines detection methods for monitoring clipboard activity on Linux systems. While the provided source material lacks specific threat actor information or campaign details, monitoring clipboard interaction is essential. Attackers may leverage the clipboard to copy and paste sensitive data, such as credentials, API keys, or command sequences, for exfiltration or execution on compromised systems. The scope of this activity can vary, but defenders need to establish baseline clipboard usage patterns to identify anomalies that may indicate malicious intent.

Attack Chain

Initial Access: An attacker gains access to a Linux system through methods like SSH brute-forcing or exploiting a vulnerability in a network service (e.g., web application, database).
Privilege Escalation: Once inside, the attacker may attempt to elevate privileges using techniques like exploiting kernel vulnerabilities or misconfigured SUID/GUID binaries.
Information Gathering: The attacker gathers information about the system, user accounts, and network configuration using tools like uname, id, ifconfig, and netstat.
Clipboard Interaction (Copy): The attacker copies sensitive information from files, terminal output, or other applications to the clipboard using tools like xclip, xsel, or wl-copy (for Wayland). For example, cat /etc/shadow | xclip -selection clipboard.
Clipboard Interaction (Paste): The attacker pastes the copied information into a different application, potentially for exfiltration to an external server or use in subsequent attack steps. For example, pasting credentials into an SSH client.
Lateral Movement: The attacker uses the gathered credentials or session tokens to move laterally to other systems within the network.
Data Exfiltration: The attacker exfiltrates sensitive data to an external server using tools like scp, rsync, or curl via the clipboard.
Persistence: The attacker establishes persistence on the compromised system using techniques like creating cron jobs or modifying system startup scripts.

Impact

Successful exploitation could lead to sensitive data leakage, including credentials, API keys, and internal documents. This can enable unauthorized access to other systems, data breaches, and disruption of services. The number of affected systems and the extent of the damage will depend on the attacker's objectives and the security measures in place.

Recommendation

Monitor process creation events for the execution of clipboard utilities like xclip, xsel, or wl-copy to detect suspicious clipboard activity using the Sigma rules provided.
Enable audit logging on Linux systems to capture process execution events and command-line arguments, providing valuable context for investigating potential clipboard-related attacks.
Implement network monitoring to detect unusual outbound connections originating from systems where clipboard activity is detected, potentially indicating data exfiltration.
Deploy and tune the provided Sigma rules in your SIEM to detect and respond to malicious clipboard activity.

Linux SSH Persistence via Backdoored System User

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

Attackers targeting Linux systems may establish persistence by compromising existing system user accounts and adding unauthorized SSH keys. This method allows them to bypass standard authentication procedures and regain access to the system even after password resets. While the specific campaigns leveraging this technique are currently unclear, the risk is significant, as it grants persistent access and is difficult to detect without specific monitoring in place. The use of backdoored system users circumvents typical multi-factor authentication and account lockout policies, potentially granting long-term access to sensitive data and systems.

Attack Chain

Initial Access: Attacker gains initial access through an unstated vector (e.g., exploiting a web application vulnerability, or using stolen credentials).
Privilege Escalation: The attacker escalates privileges to root or a privileged user, potentially using exploits (e.g., Dirty Pipe) or misconfigurations.
Account Discovery: The attacker identifies potential system user accounts to backdoor (e.g., accounts without passwords or with weak passwords).
SSH Key Generation: The attacker generates a new SSH key pair for persistent access using ssh-keygen.
Key Installation: The attacker modifies the authorized_keys file (usually located at /home/[username]/.ssh/authorized_keys) of the targeted user to include the attacker's public key.
Persistence Check: The attacker tests the SSH login using the newly added key to ensure successful access.
Cleanup (Optional): The attacker removes traces of the key generation or modification from logs and command history, though this is not always done thoroughly.
Lateral Movement/Data Exfiltration: With persistent access, the attacker moves laterally within the network, accesses sensitive data, and exfiltrates it.

Impact

Compromised system user accounts can grant attackers long-term, stealthy access to critical systems. This can lead to data breaches, system downtime, and reputational damage. The number of victims and targeted sectors are unknown, but any organization relying on Linux systems for critical infrastructure is potentially at risk. Successful exploitation can result in complete system compromise and data exfiltration, causing significant financial and operational losses.

Recommendation

Deploy the Sigma rule "Detect SSH Key Added to Authorized Keys" to identify suspicious modifications to authorized_keys files.
Monitor system logs for unusual SSH login activity, specifically logins using SSH keys instead of passwords (reference logsource: linux auth.log).
Regularly audit system user accounts for unauthorized SSH keys (using shell commands and scripts).
Enforce strong password policies and multi-factor authentication where possible to prevent initial compromise (related to initial access vector).

Linux Shell History Clearing via Environment Variables

hello@craftedsignal.io — Wed, 03 Jan 2024 14:30:00 +0000

Attackers on Linux systems may attempt to clear shell history to hide their activities and evade detection. This is achieved by manipulating environment variables that control the shell's history logging behavior. By setting variables like HISTSIZE or HISTFILESIZE to 0, HISTCONTROL to ignorespace, or redirecting HISTFILE to /dev/null, attackers can effectively disable or erase the command history, making it difficult for defenders to track their actions. This technique is often employed after gaining initial access to a system to mask subsequent malicious activities, such as privilege escalation, lateral movement, or data exfiltration. This activity can occur on any compromised Linux host, regardless of the specific distribution or kernel version. Detecting this behavior is crucial for identifying potentially compromised systems and uncovering attacker activity.

Attack Chain

Attacker gains initial access to a Linux system, potentially through SSH or other remote access methods.
Attacker identifies the current shell and its configuration.
Attacker sets HISTSIZE or HISTFILESIZE environment variables to 0 to prevent new history entries from being saved.
Attacker sets HISTCONTROL to ignorespace to prevent commands starting with a space from being saved.
Attacker redirects the HISTFILE environment variable to /dev/null to discard the history file.
Attacker executes commands related to enumeration, privilege escalation, or lateral movement.
The executed commands are not recorded in the shell history due to the manipulated environment variables.
Attacker attempts to remove traces of their presence and maintain stealth by avoiding logging their activities.

Impact

Successful clearing of shell history hinders forensic investigations and incident response efforts. By removing command history, attackers make it difficult to reconstruct their actions on the compromised system. This can lead to delayed detection, prolonged dwell time, and increased damage. The number of victims can vary depending on the scope of the attack, but any Linux system where an attacker gains shell access and clears the history is potentially affected. Sectors targeted may include any organization relying on Linux servers for critical infrastructure or data storage.

Recommendation

Enable Elastic Defend and configure the linux.advanced.capture_env_vars setting to capture HISTSIZE, HISTFILESIZE, HISTCONTROL, and HISTFILE to enable the detection rule to function properly.
Deploy the Sigma rule "Linux Shell History Clearing via Environment Variables" to your SIEM to detect this behavior, and tune it according to your environment.
Investigate any alerts generated by the detection rule "Linux Shell History Clearing via Environment Variables" to determine the scope and impact of the potential compromise.
Monitor for suspicious processes that modify shell environment variables related to history, using the provided Sigma rules as a starting point.

Suspicious SUID Binary Execution on Linux

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection rule identifies suspicious executions of common privilege elevation tools on Linux systems. It focuses on instances where binaries like su, sudo, pkexec, passwd, chsh, and newgrp are executed with root privileges but are initiated by a non-root user. The rule further refines its focus by analyzing the parent process context, specifically looking for interpreters (Python, Perl, Ruby, etc.), commands executed from user-writable directories (/tmp, /var/tmp, /dev/shm, /home, /run/user), or short shell command invocations. The detection is designed to uncover potential privilege escalation attempts that may be indicative of malicious activity. This is important because attackers frequently use SUID binaries to elevate privileges, and detecting unusual usage patterns can help identify compromised systems or insider threats.

Attack Chain

A non-privileged user gains initial access to the system, potentially through compromised credentials or exploiting a vulnerability.
The attacker navigates to a user-writable directory such as /tmp or /home/.
The attacker crafts a malicious script or uses a one-liner command to invoke a SUID binary.
The SUID binary (e.g., sudo, pkexec, su) is executed with minimal arguments.
The system executes the command with root privileges due to the SUID bit being set on the binary.
The attacker leverages the elevated privileges to modify system files, install malicious software, or create new administrative accounts.
The attacker establishes persistence to maintain access to the compromised system.
The attacker achieves their final objective, which could include data exfiltration, system disruption, or further lateral movement within the network.

Impact

Successful exploitation of SUID binaries can lead to full system compromise. An attacker can gain complete control over the affected Linux system, potentially leading to data breaches, service disruptions, and the installation of persistent malware. This can affect critical infrastructure and sensitive data, causing significant financial and reputational damage. The severity is amplified when multiple systems are compromised, allowing for lateral movement and further exploitation within the network.

Recommendation

Enable process creation logging and ensure that process.user.id, process.real_user.id, and process.parent.user.id are being captured to activate the rules below.
Deploy the "Suspicious SUID Binary Execution" Sigma rule to your SIEM and tune for your environment.
Review authentication and sudoers policies to identify and remediate any misconfigurations.
Investigate any alerts generated by the Sigma rules to determine the legitimacy of the SUID binary execution and the parent process context.
Implement file integrity monitoring on sensitive system binaries and directories, particularly those related to privilege escalation, to detect unauthorized modifications.
Restrict the use of SUID binaries where possible and enforce strict permissions on those that are necessary.

Suspicious mkfifo Execution on Linux

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief addresses suspicious activities on Linux systems involving the mkfifo command. While mkfifo itself is a legitimate utility for creating named pipes, its use followed by command execution can indicate malicious intent. Attackers may use named pipes for inter-process communication, command and control (C2), or data exfiltration. This activity is often seen in post-exploitation scenarios. The use of mkfifo in conjunction with other commands such as nc, bash, or scripting languages like Python warrants close examination. The scope of this brief focuses on Linux-based systems and the detection of command sequences indicating potential abuse of mkfifo. Defenders should monitor for unusual process chains involving mkfifo and subsequent command executions.

Attack Chain

The attacker gains initial access to a Linux system through an exploit or compromised credentials.
The attacker uses mkfifo /tmp/named_pipe to create a named pipe in the /tmp directory.
The attacker uses netcat to listen on a port and write output to the named pipe: nc -l -p 1337 > /tmp/named_pipe.
In a separate process, the attacker executes a command and redirects the output to the named pipe: ls -la > /tmp/named_pipe.
The netcat process receives the output of the ls -la command and forwards it to the attacker's C2 server.
The attacker uses rm /tmp/named_pipe to remove the named pipe, cleaning up evidence.
The attacker may repeat steps 2-5 to execute further commands and exfiltrate data.

Impact

Successful exploitation can lead to unauthorized access, data exfiltration, and command execution on the compromised Linux system. The severity of the impact depends on the privileges of the compromised user and the sensitivity of the data accessible on the system. This technique can be used to establish covert communication channels for lateral movement and persistence within the network.

Recommendation

Deploy the provided Sigma rule to detect suspicious process executions involving mkfifo followed by network activity or command execution (see "Suspicious Mkfifo Followed by Command Execution" and "Suspicious Mkfifo and Netcat Use" rules).
Monitor process creation logs for the execution of mkfifo command, focusing on parent processes and subsequent child processes.
Investigate any instances of mkfifo usage where the created named pipe is used for network communication or data redirection.
Enable process monitoring with command line auditing to capture the full context of mkfifo executions and related commands.

Linux System Network Discovery via Multiple Utilities

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection focuses on identifying potential network reconnaissance activity on Linux systems. It monitors for the execution of multiple common network utilities within a short timeframe, specifically processes like "arp," "ifconfig," "ip," "netstat," "firewall-cmd," "ufw," "iptables," "ss," and "route." This behavior, when observed in rapid succession, is indicative of an attacker attempting to map the network, identify potential targets, and gather information for lateral movement or further exploitation. This type of activity is a common precursor to more significant attacks such as data exfiltration or ransomware deployment. The detection leverages process monitoring logs and aggregates process execution events within a 30-minute window.

Attack Chain

Initial Access: An attacker gains initial access to a Linux system, potentially through exploiting a vulnerability or using stolen credentials.
Privilege Escalation (Optional): If necessary, the attacker escalates privileges to gain root or administrator access.
Network Enumeration: The attacker executes a series of network enumeration commands using utilities like ip addr, ifconfig, and netstat to discover network interfaces, IP addresses, and routing information.
Firewall Discovery: The attacker uses firewall-cmd, iptables, or ufw to identify firewall rules and configurations, potentially seeking weaknesses or misconfigurations.
ARP Table Examination: The attacker uses the arp command to map IP addresses to MAC addresses on the local network segment.
Port Scanning (Optional): The attacker may use ss or netstat to identify open ports and services running on the local machine or other systems on the network.
Route Table Examination: The attacker uses the route command to understand network routing configurations and identify potential paths for lateral movement.
Lateral Movement/Further Exploitation: Using the gathered network information, the attacker plans and executes further exploitation, lateral movement, or data exfiltration.

Impact

Successful network discovery allows attackers to map the network, identify vulnerable systems, and plan further attacks. This can lead to data breaches, system compromise, and disruption of services. While this detection itself does not indicate a breach, it is a strong indicator of reconnaissance activity preceding a more significant attack. Compromised systems could be leveraged for lateral movement, data exfiltration, or deployment of ransomware, impacting potentially hundreds or thousands of systems, depending on the size of the network.

Recommendation

Deploy the Sigma rule Detect Multiple Network Discovery Tools to your SIEM and tune it for your environment.
Enable Sysmon for Linux Event ID 1 or equivalent process execution logging to provide the data source for the Sigma rule.
Investigate any alerts generated by the Sigma rule, focusing on the user accounts and processes involved in the network discovery activity.
Review firewall configurations and network segmentation policies to limit the potential impact of lateral movement.
Implement the provided RBA (Risk Based Alerting) configuration in your Splunk environment to prioritize and score incidents based on the involved assets and users.

Linux Privilege Escalation via LD_PRELOAD Shared Object Modification

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The LD_PRELOAD environment variable in Linux allows users to specify shared libraries that should be loaded before others when a program is executed. This functionality, while legitimate, can be abused by attackers to inject malicious code into processes, including those running with elevated privileges (e.g., setuid binaries). By crafting a malicious shared object and setting LD_PRELOAD to point to it, an attacker can hijack the execution flow of a vulnerable program. This technique is effective because the preloaded library's code will be executed before the main program's code. This can lead to complete system compromise if the hijacked process runs as root.

Attack Chain

The attacker identifies a setuid binary vulnerable to LD_PRELOAD exploitation.
The attacker creates a malicious shared object (e.g., evil.so) containing code to escalate privileges, such as creating a new setuid root shell.
The attacker sets the LD_PRELOAD environment variable to the path of the malicious shared object: export LD_PRELOAD=/tmp/evil.so.
The attacker executes the vulnerable setuid binary.
The dynamic linker (ld-linux.so) loads the malicious shared object specified by LD_PRELOAD into the process's memory space before the intended libraries.
The malicious shared object's constructor function (e.g., _init()) is executed, which performs actions like creating a new setuid root shell or modifying system files.
The original setuid binary continues execution (if the attacker hasn't completely taken over).
The attacker uses the newly created setuid root shell or modified system to gain complete control over the system.

Impact

Successful exploitation via LD_PRELOAD allows an attacker to gain root privileges on the affected Linux system. This allows them to read sensitive data, install malware, modify system configurations, and potentially use the compromised system as a staging point for lateral movement within a network. The scope of the impact depends on the attacker's objectives, but privilege escalation always leads to a severe breach of system security.

Recommendation

Monitor for the execution of setuid/setgid binaries with LD_PRELOAD set (see Sigma rule "Detect LD_PRELOAD Usage with setuid/setgid").
Implement file integrity monitoring for system binaries and libraries to detect unauthorized modifications (implement using file_event logs).
Restrict the use of LD_PRELOAD where possible, especially for privileged processes.
Audit setuid/setgid binaries for vulnerabilities that could be exploited via LD_PRELOAD.
Deploy the Sigma rule "Detect Suspicious Shared Object Loading via LD_PRELOAD" to identify potential malicious library injections.

Potential Data Exfiltration Through Curl

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

The rule "Potential Data Exfiltration Through Curl" detects the use of the curl command-line tool on Linux systems to upload files to external servers. Threat actors often use tools like curl to exfiltrate collected data to their command and control (C2) server. While curl has legitimate uses, its use for uploading data to external servers is considered abnormal and suspicious. This activity is monitored by analyzing process execution events for specific command-line arguments and patterns associated with data uploads. The rule focuses on Linux systems and triggers on curl commands using arguments such as -T, --upload-file, -F, -d, or --data* when used in conjunction with file uploads to external network destinations. The rule was last updated on March 13, 2026 and leverages data from Elastic Defend, Crowdstrike, and SentinelOne.

Attack Chain

The attacker gains initial access to the Linux system (e.g., via SSH or exploiting a vulnerability).
The attacker collects sensitive data from the compromised system (e.g., configuration files, databases, logs).
The attacker compresses the collected data into an archive (e.g., using tar, gzip, or zip).
The attacker uses the curl command to upload the compressed archive to an external server. The command includes arguments such as -T or --upload-file to specify the file to upload.
The curl command establishes a network connection to the attacker's C2 server or a controlled exfiltration point.
The compressed data is transmitted over HTTP, HTTPS, FTP, or FTPS protocols to the external server.
The attacker receives the exfiltrated data on the external server.
The attacker may attempt to remove traces of the exfiltration activity from the compromised system (e.g., deleting temporary files, clearing logs).

Impact

Successful exploitation can lead to the exfiltration of sensitive data, including confidential documents, credentials, or proprietary information. The severity depends on the type and volume of data compromised. Data exfiltration can lead to financial losses, reputational damage, legal repercussions, and loss of competitive advantage. This detection is crucial for organizations that need to protect sensitive data residing on Linux systems, and prevent unauthorized access. The rule is designed to detect suspicious curl usage that deviates from normal system behavior.

Recommendation

Deploy the Sigma rule Potential Data Exfiltration Through Curl to your SIEM and tune for your environment.
Investigate any alerts generated by the Sigma rule by examining the process command line, parent process, and network logs.
Enable Elastic Defend integration as documented in the rule Setup section to provide the necessary data source.
Review and update firewall and network security rules to block unauthorized outbound traffic, especially to suspicious or unknown external servers as mentioned in the rule's Response and remediation section.

Linux Credential Access via Sensitive File Monitoring

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection rule, sourced from Elastic's detection-rules repository on GitHub, focuses on identifying credential access attempts on Linux systems. The rule monitors access to a variety of sensitive files that commonly store credentials, configuration details, or other sensitive information that could be leveraged by attackers. While the specific attacker or campaign is not detailed in the provided source, the technique is commonly associated with post-exploitation activity where adversaries attempt to escalate privileges or move laterally within a compromised environment. The rule aims to provide defenders with visibility into unauthorized access to these critical files, allowing for rapid response and mitigation.

Attack Chain

Initial Access: An attacker gains initial access to a Linux system through an exploit, vulnerability, or compromised credentials.
Privilege Escalation (Optional): If the initial access is with limited privileges, the attacker may attempt to escalate privileges using kernel exploits, misconfigurations, or other techniques.
Discovery: The attacker performs reconnaissance to identify sensitive files containing credentials or configuration information. This might involve using commands like find, locate, or grep.
Credential Access: The attacker accesses sensitive files such as /etc/passwd, /etc/shadow, /etc/sudoers, /var/log/auth.log, configuration files in /etc related to specific services (e.g., /etc/nginx/nginx.conf, /etc/apache2/apache2.conf), .bash_history, .ssh/id_rsa, and similar files.
Credential Harvesting: The attacker parses the accessed files for usernames, passwords, API keys, or other valuable credentials. Tools like grep, awk, or custom scripts may be used.
Lateral Movement: Using the harvested credentials, the attacker attempts to move laterally to other systems within the network.
Data Exfiltration (Optional): The attacker may exfiltrate the harvested credentials and other sensitive data to an external location.
Persistence (Optional): The attacker may establish persistence using the compromised credentials or by modifying system configuration files.

Impact

Successful credential access can lead to a wide range of negative consequences, including unauthorized access to sensitive data, system compromise, lateral movement within the network, and data exfiltration. Depending on the compromised system and the accessed credentials, the impact could range from minor data breaches to complete network compromise. This type of attack can affect any organization using Linux systems, with the severity depending on the sensitivity of the data stored on the compromised systems.

Recommendation

Deploy the Sigma rules provided to your SIEM and tune them based on your environment to detect suspicious file access patterns.
Implement file integrity monitoring (FIM) on sensitive files to detect unauthorized modifications.
Enable and review audit logging on Linux systems to capture detailed information about file access events.
Regularly review and update user permissions to minimize the risk of unauthorized access.
Implement multi-factor authentication (MFA) to mitigate the impact of compromised credentials.