Attack Chain

1. Initial Access: An attacker gains initial access to a Linux system, potentially through exploiting a vulnerability or using compromised credentials.
2. Privilege Escalation: The attacker escalates privileges to root or another highly privileged account using techniques such as exploiting kernel vulnerabilities or misconfigured SUID/SGID binaries.
3. Cron Job Modification: The attacker modifies cron job files (e.g., /etc/crontab, /etc/cron.d/*) to schedule malicious scripts or commands to run periodically.
4. Systemd Service Modification: The attacker modifies systemd service files (e.g., /etc/systemd/system/*) to create a new service or modify an existing one to execute malicious code upon system startup.
5. Shell Profile Modification: The attacker modifies shell profile files (e.g., /etc/profile, ~/.bashrc) to execute malicious code when a user logs in.
6. SSH Configuration Modification: The attacker modifies SSH configuration files (e.g., /etc/ssh/sshd_config, ~/.ssh/authorized_keys) to enable unauthorized access to the system.
7. LD_PRELOAD Modification: The attacker modifies /etc/ld.so.preload to inject malicious code into other processes.
8. Persistence Achieved: The attacker achieves persistence by ensuring their malicious code is executed automatically at system startup or user logon, allowing them to maintain long-term access to the compromised system.

Impact

A successful persistence attack can allow attackers to maintain unauthorized access to a compromised Linux system indefinitely. This can lead to data theft, system disruption, or further exploitation of the network. The rule aims to detect these persistence attempts early, minimizing the potential damage. The rule can trigger on legitimate admin activity if not tuned properly, so careful whitelisting is needed.

Recommendation

• Enable the Elastic FIM integration and configure it to monitor the file paths specified in the rule query. Refer to the Elastic FIM documentation for detailed instructions.
• Deploy the provided Sigma rule to your SIEM and tune it for your environment.
• Investigate any alerts generated by the Sigma rule by reviewing the modified file and the user or process responsible for the modification.
• Implement appropriate whitelists to exclude legitimate administrative activities from triggering the rule. Pay special attention to temporary files.
• Ensure that access controls and permissions on critical system files are properly configured to prevent unauthorized modifications.
• Regularly review and update the FIM policy to ensure it covers all relevant file paths.