Skip to content

Commit 3e2f8d5

Browse files
Murphy0801frack113nasbench
authored
Merge PR #4975 from @Murphy0801 - Add new rules related to GTFOBins
new: Capsh Shell Invocation - Linux new: Inline Python Execution - Spawn Shell Via OS System Library new: Shell Execution GCC - Linux new: Shell Execution via Find - Linux new: Shell Execution via Flock - Linux new: Shell Execution via Git - Linux new: Shell Execution via Nice - Linux new: Shell Execution via Rsync - Linux new: Shell Invocation via Env Command - Linux new: Shell Invocation Via Ssh - Linux new: Suspicious Invocation of Shell via AWK - Linux --------- Co-authored-by: frack113 <[email protected]> Co-authored-by: nasbench <[email protected]>
1 parent 839f563 commit 3e2f8d5

13 files changed

+366
-8
lines changed

‎rules/linux/process_creation/proc_creation_lnx_gtfobin_apt.yml‎ renamed to ‎rules/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
1-
title: Apt GTFOBin Abuse - Linux
1+
title: Shell Invocation via Apt - Linux
22
id: bb382fd5-b454-47ea-a264-1828e4c766d6
33
status: test
4-
description: Detects usage of "apt" and "apt-get" as a GTFOBin to execute and proxy command and binary execution
4+
description: |
5+
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
6+
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
57
references:
68
- https://gtfobins.github.io/gtfobins/apt/
79
- https://gtfobins.github.io/gtfobins/apt-get/
810
author: Nasreddine Bencherchali (Nextron Systems)
911
date: 2022-12-28
12+
modified: 2024-09-02
1013
tags:
1114
- attack.discovery
1215
- attack.t1083

‎rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
title: Suspicious Invocation of Shell via AWK - Linux
2+
id: 8c1a5675-cb85-452f-a298-b01b22a51856
3+
status: experimental
4+
description: |
5+
Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function.
6+
This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
7+
references:
8+
- https://gtfobins.github.io/gtfobins/awk/#shell
9+
- https://gtfobins.github.io/gtfobins/gawk/#shell
10+
- https://gtfobins.github.io/gtfobins/nawk/#shell
11+
- https://gtfobins.github.io/gtfobins/mawk/#shell
12+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
13+
date: 2024-09-02
14+
tags:
15+
- attack.execution
16+
- attack.t1059
17+
logsource:
18+
category: process_creation
19+
product: linux
20+
detection:
21+
selection_img:
22+
Image|endswith:
23+
- '/awk'
24+
- '/gawk'
25+
- '/mawk'
26+
- '/nawk'
27+
CommandLine|contains: 'BEGIN {system'
28+
selection_cli:
29+
CommandLine|contains:
30+
- '/bin/bash'
31+
- '/bin/dash'
32+
- '/bin/fish'
33+
- '/bin/sh'
34+
- '/bin/zsh'
35+
condition: all of selection_*
36+
falsepositives:
37+
- Unknown
38+
level: high

‎rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
title: Capsh Shell Invocation - Linux
2+
id: db1ac3be-f606-4e3a-89e0-9607cbe6b98a
3+
status: experimental
4+
description: |
5+
Detects the use of the "capsh" utility to invoke a shell.
6+
references:
7+
- https://gtfobins.github.io/gtfobins/capsh/#shell
8+
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
9+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
10+
date: 2024-09-02
11+
tags:
12+
- attack.execution
13+
- attack.t1059
14+
logsource:
15+
category: process_creation
16+
product: linux
17+
detection:
18+
selection:
19+
Image|endswith: '/capsh'
20+
CommandLine|endswith: ' --'
21+
condition: selection
22+
falsepositives:
23+
- Unknown
24+
level: high

‎rules/linux/process_creation/proc_creation_lnx_env_shell_invocation.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
title: Shell Invocation via Env Command - Linux
2+
id: bed978f8-7f3a-432b-82c5-9286a9b3031a
3+
status: experimental
4+
description: |
5+
Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.
6+
references:
7+
- https://gtfobins.github.io/gtfobins/env/#shell
8+
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
9+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
10+
date: 2024-09-02
11+
tags:
12+
- attack.execution
13+
- attack.t1059
14+
logsource:
15+
category: process_creation
16+
product: linux
17+
detection:
18+
selection:
19+
Image|endswith: '/env'
20+
CommandLine|endswith:
21+
- '/bin/bash'
22+
- '/bin/dash'
23+
- '/bin/fish'
24+
- '/bin/sh'
25+
- '/bin/zsh'
26+
condition: selection
27+
falsepositives:
28+
- Github operations such as ghe-backup
29+
level: high

‎rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
title: Shell Execution via Find - Linux
2+
id: 6adfbf8f-52be-4444-9bac-81b539624146
3+
status: experimental
4+
description: |
5+
Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.
6+
references:
7+
- https://gtfobins.github.io/gtfobins/find/#shell
8+
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
9+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
10+
date: 2024-09-02
11+
tags:
12+
- attack.discovery
13+
- attack.t1083
14+
logsource:
15+
category: process_creation
16+
product: linux
17+
detection:
18+
selection_img:
19+
Image|endswith: '/find'
20+
CommandLine|contains|all:
21+
- ' . '
22+
- '-exec'
23+
selection_cli:
24+
CommandLine|contains:
25+
- '/bin/bash'
26+
- '/bin/dash'
27+
- '/bin/fish'
28+
- '/bin/sh'
29+
- '/bin/zsh'
30+
condition: all of selection_*
31+
falsepositives:
32+
- Unknown
33+
level: high

‎rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
title: Shell Execution via Flock - Linux
2+
id: 4b09c71e-4269-4111-9cdd-107d8867f0cc
3+
status: experimental
4+
description: |
5+
Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
6+
references:
7+
- https://gtfobins.github.io/gtfobins/flock/#shell
8+
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
9+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
10+
date: 2024-09-02
11+
tags:
12+
- attack.discovery
13+
- attack.t1083
14+
logsource:
15+
category: process_creation
16+
product: linux
17+
detection:
18+
selection_img:
19+
Image|endswith: '/flock'
20+
CommandLine|contains: ' -u '
21+
selection_cli:
22+
CommandLine|contains:
23+
- '/bin/bash'
24+
- '/bin/dash'
25+
- '/bin/fish'
26+
- '/bin/sh'
27+
- '/bin/zsh'
28+
condition: all of selection_*
29+
falsepositives:
30+
- Unknown
31+
level: high

‎rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
title: Shell Execution GCC - Linux
2+
id: 9b5de532-a757-4d70-946c-1f3e44f48b4d
3+
status: experimental
4+
description: |
5+
Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
6+
references:
7+
- https://gtfobins.github.io/gtfobins/gcc/#shell
8+
- https://gtfobins.github.io/gtfobins/c89/#shell
9+
- https://gtfobins.github.io/gtfobins/c99/#shell
10+
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
11+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
12+
date: 2024-09-02
13+
tags:
14+
- attack.discovery
15+
- attack.t1083
16+
logsource:
17+
category: process_creation
18+
product: linux
19+
detection:
20+
selection_img:
21+
Image|endswith:
22+
- '/c89'
23+
- '/c99'
24+
- '/gcc'
25+
CommandLine|contains: '-wrapper'
26+
selection_cli:
27+
CommandLine|contains:
28+
- '/bin/bash,-s'
29+
- '/bin/dash,-s'
30+
- '/bin/fish,-s'
31+
- '/bin/sh,-s'
32+
- '/bin/zsh,-s'
33+
condition: all of selection_*
34+
falsepositives:
35+
- Unknown
36+
level: high

‎rules/linux/process_creation/proc_creation_lnx_git_shell_execution.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
title: Shell Execution via Git - Linux
2+
id: 47b3bbd4-1bf7-48cc-84ab-995362aaa75a
3+
status: experimental
4+
description: |
5+
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
6+
references:
7+
- https://gtfobins.github.io/gtfobins/git/#shell
8+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
9+
date: 2024-09-02
10+
tags:
11+
- attack.execution
12+
- attack.t1059
13+
logsource:
14+
category: process_creation
15+
product: linux
16+
detection:
17+
selection:
18+
ParentImage|endswith: '/git'
19+
ParentCommandLine|contains|all:
20+
- ' -p '
21+
- 'help'
22+
CommandLine|contains:
23+
- 'bash 0<&1'
24+
- 'dash 0<&1'
25+
- 'sh 0<&1'
26+
condition: selection
27+
falsepositives:
28+
- Unknown
29+
level: high

‎rules/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
title: Shell Execution via Nice - Linux
2+
id: 093d68c7-762a-42f4-9f46-95e79142571a
3+
status: experimental
4+
description: |
5+
Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
6+
references:
7+
- https://gtfobins.github.io/gtfobins/nice/#shell
8+
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
9+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
10+
date: 2024-09-02
11+
tags:
12+
- attack.discovery
13+
- attack.t1083
14+
logsource:
15+
category: process_creation
16+
product: linux
17+
detection:
18+
selection:
19+
Image|endswith: '/nice'
20+
CommandLine|endswith:
21+
- '/bin/bash'
22+
- '/bin/dash'
23+
- '/bin/fish'
24+
- '/bin/sh'
25+
- '/bin/zsh'
26+
condition: selection
27+
falsepositives:
28+
- Unknown
29+
level: high

‎rules/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
title: Inline Python Execution - Spawn Shell Via OS System Library
2+
id: 2d2f44ff-4611-4778-a8fc-323a0e9850cc
3+
status: experimental
4+
description: |
5+
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
6+
references:
7+
- https://gtfobins.github.io/gtfobins/python/#shell
8+
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
9+
date: 2024-09-02
10+
tags:
11+
- attack.execution
12+
- attack.t1059
13+
logsource:
14+
category: process_creation
15+
product: linux
16+
detection:
17+
selection_img:
18+
- Image|endswith:
19+
- '/python'
20+
- '/python2'
21+
- '/python3'
22+
- Image|contains:
23+
- '/python2.' # python image is always of the form ../python3.10; ../python is just a symlink
24+
- '/python3.'
25+
selection_cli:
26+
CommandLine|contains|all:
27+
- ' -c '
28+
- 'os.system('
29+
CommandLine|contains:
30+
- '/bin/bash'
31+
- '/bin/dash'
32+
- '/bin/fish'
33+
- '/bin/sh'
34+
- '/bin/zsh'
35+
condition: all of selection_*
36+
falsepositives:
37+
- Unknown
38+
level: high

0 commit comments

Comments
 (0)