osquery-defense-kit/detection/c2/unexpected-talkers-linux.sql

-- Programs communicating over the network in unexpected ways (state-based)
--
-- references:
--   * https://attack.mitre.org/techniques/T1071/
--
-- tags: transient state net often
-- platform: linux
SELECT
  s.family,
  protocol,
  s.local_port,
  s.remote_port,
  s.local_address,
  s.remote_address,
  p.name,
  p.path,
  p.cmdline AS child_cmd,
  p.cwd,
  s.pid,
  s.net_namespace,
  pp.path AS parent_path,
  p.parent AS parent_pid,
  pp.cmdline AS parent_cmd,
  hash.sha256,
  CONCAT (
    MIN(s.remote_port, 32768),
    ',',
    protocol,
    ',',
    MIN(p.uid, 500),
    ',',
    p.name
  ) AS exception_key
FROM
  process_open_sockets s
  LEFT JOIN processes p ON s.pid = p.pid
  LEFT JOIN processes pp ON p.parent = pp.pid
  LEFT JOIN hash ON p.path = hash.path
WHERE
  protocol > 0
  AND s.remote_port > 0
  AND s.remote_address NOT IN ('127.0.0.1', '::ffff:127.0.0.1', '::1')
  AND s.remote_address NOT LIKE 'fe80:%'
  AND s.remote_address NOT LIKE '127.%'
  AND s.remote_address NOT LIKE '192.168.%'
  AND s.remote_address NOT LIKE '172.1%'
  AND s.remote_address NOT LIKE '172.2%'
  AND s.remote_address NOT LIKE '172.30.%'
  AND s.remote_address NOT LIKE '172.31.%'
  AND s.remote_address NOT LIKE '::ffff:172.%'
  AND s.remote_address NOT LIKE '10.%'
  AND s.remote_address NOT LIKE '::ffff:10.%'
  AND s.remote_address NOT LIKE 'fc00:%'
  AND s.state != 'LISTEN' -- DNS clients
  AND NOT (
    remote_port = 53
    AND protocol IN (6, 17)
    AND p.name IN (
      '1password',
      'apt',
      'apt-get',
      'Brackets',
      'chainctl',
      'chrome',
      'chronyd',
      'cloud_sql_proxy',
      'code',
      'containerd',
      'controlplane',
      'crc',
      'curl',
      'dig',
      'dnf',
      'electron',
      'firefox',
      '.firefox-wrappe',
      'flameshot',
      'gh',
      'git-remote-http',
      'gitsign',
      'gnome-software',
      'go',
      'grafana-server',
      'grype',
      'host',
      'htop',
      'istioctl',
      'jcef_helper',
      'k6',
      'k9s',
      'ko',
      'kolide-pipeline',
      'launcher',
      'NetworkManager',
      'ngrok',
      'nix',
      'node',
      'nscd',
      'obs',
      'obs-browser-page',
      'obs-ffmpeg-mux',
      'obsidian',
      'opera',
      'pacman',
      'ping',
      'podman',
      'prometheus',
      'rootlessport',
      'signal-desktop',
      'slack',
      'slirp4netns',
      'snapd',
      'snap-store',
      'Socket Process',
      'spotify',
      'ssh',
      'steam',
      'steamwebhelper',
      'syncthing',
      'systemd-resolve',
      'tailscaled',
      '.tailscaled-wra',
      'terraform',
      'terraform-provi',
      'tkn',
      'traceroute',
      'vcluster',
      'wget',
      'whois',
      'xmobar',
      'yay',
      'zoom'
    )
  ) -- General exceptions
  AND NOT exception_key IN (
    '123,17,,',
    '123,17,500,chronyd',
    '22067,6,500,syncthing',
    '22,6,,',
    '22,6,500,ssh',
    '27024,6,500,steam',
    '3100,6,500,firefox',
    '3100,6,500,k6',
    '32768,6,0,tailscaled',
    '3307,6,500,cloud_sql_proxy',
    '4070,6,500,spotify',
    '443,17,500,chrome',
    '443,17,500,electron',
    '443,17,500,jcef_helper',
    '443,17,500,slack',
    '443,17,500,spotify',
    '443,6,0,apk',
    '443,6,0,containerd',
    '443,6,0,depmod',
    '443,6,0,dirmngr',
    '443,6,0,dnf',
    '443,6,0,dockerd',
    '443,6,0,influxd',
    '443,6,0,launcher',
    '443,6,0,nix',
    '443,6,0,nix-daemon',
    '443,6,0,packagekitd',
    '443,6,0,pacman',
    '443,6,0,snapd',
    '443,6,0,systemctl',
    '443,6,0,tailscaled',
    '443,6,0,.tailscaled-wra',
    '443,6,0,yum',
    '443,6,105,https',
    '443,6,472,grafana-server',
    '443,6,500,1password',
    '443,6,500,authentik-proxy',
    '443,6,500,aws',
    '443,6,500,Brackets',
    '443,6,500,celery',
    '443,6,500,chainctl',
    '443,6,500,chrome',
    '443,6,500,cloud_sql_proxy',
    '443,6,500,code',
    '443,6,500,containerd',
    '443,6,500,controlplane',
    '443,6,500,cosign',
    '443,6,500,crane',
    '443,6,500,CrBrowserMain',
    '443,6,500,crc',
    '443,6,500,CrUtilityMain',
    '443,6,500,curl',
    '443,6,500,Discord',
    '443,6,500,electron',
    '443,6,500,emacs',
    '443,6,500,firefox',
    '443,6,500,.firefox-wrappe',
    '443,6,500,flameshot',
    '443,6,500,geoclue',
    '443,6,500,gh',
    '443,6,500,git-remote-http',
    '443,6,500,gitsign',
    '443,6,500,gnome-shell',
    '443,6,500,gnome-software',
    '443,6,500,go',
    '443,6,500,___go_build_github_com_anchore_grype,a.out,',
    '443,6,500,grafana-server',
    '443,6,500,grype',
    '443,6,500,gunicorn',
    '443,6,500,gvfsd-http',
    '443,6,500,htop',
    '443,6,500,influxd',
    '443,6,500,istioctl',
    '443,6,500,java',
    '443,6,500,jcef_helper',
    '443,6,500,jetbrains-toolb',
    '443,6,500,k6',
    '443,6,500,k9s',
    '443,6,500,ko',
    '443,6,500,kolide-pipeline',
    '443,6,500,kubectl',
    '443,6,500,minicli',
    '443,6,500,ngrok',
    '443,6,500,nix',
    '443,6,500,node',
    '443,6,500,obs',
    '443,6,500,obs-browser-page',
    '443,6,500,obs-ffmpeg-mux',
    '443,6,500,obsidian',
    '443,6,500,pingsender',
    '443,6,500,pip',
    '443,6,500,podman',
    '443,6,500,signal-desktop',
    '443,6,500,slack',
    '443,6,500,slirp4netns',
    '443,6,500,snap-store',
    '443,6,500,Socket Process',
    '443,6,500,spotify',
    '443,6,500,steamwebhelper',
    '443,6,500,teams',
    '443,6,500,terraform',
    '443,6,500,terraform-provi',
    '443,6,500,tkn',
    '443,6,500,.tox-wrapped',
    '443,6,500,trivy',
    '443,6,500,vcluster',
    '443,6,500,vim',
    '443,6,500,WebKitNetworkPr',
    '443,6,500,wget',
    '443,6,500,wineserver',
    '443,6,500,x11-ssh-askpass',
    '443,6,500,xmobar',
    '443,6,500,yay',
    '443,6,500,zoom',
    '5228,6,500,chrome',
    '6000,6,500,ssh',
    '80,6,0,mkinitcpio',
    '67,17,0,NetworkManager',
    '7903,6,500,syncthing',
    '8006,6,500,chrome',
    '80,6,0,dnf',
    '80,6,0,gdk-pixbuf-quer',
    '80,6,0,NetworkManager',
    '80,6,0,pacman',
    '80,6,0,tailscaled',
    '80,6,0,.tailscaled-wra',
    '443,6,0,yay',
    '80,6,0,yum',
    '443,6,500,rustup',
    '443,6,500,cargo',
    '80,6,500,thunderbird',
    '80,6,105,http',
    '80,6,500,curl',
    '80,6,500,firefox',
    '80,6,500,.firefox-wrappe',
    '80,6,500,gitsign',
    '80,6,500,slack',
    '80,6,500,spotify',
    '80,6,500,steam',
    '80,6,500,steamwebhelper',
    '80,6,500,syncthing',
    '8801,17,500,zoom',
    '9090,6,500,firefox',
    '9090,6,500,k6',
    '9090,6,500,prometheus',
    '9090,6,500,rootlessport'
  ) -- These programs would normally never make an outgoing connection, but thanks to Nix, it can happen.
  AND NOT (
    (
      remote_address LIKE '151.101.%'
      OR remote_address LIKE '140.82.%'
    )
    AND remote_port = 443
    AND protocol = 6
    AND (
      parent_path LIKE '/nix/%/bin/bash'
      OR parent_path LIKE '/nix/%/bin/zsh'
      OR parent_path LIKE '%/bin/nix'
      OR p.path LIKE '/nix/store/%'
    )
  )
  AND NOT p.cmdline LIKE 'bash --rcfile /tmp/nix-shell.%' -- Other more complicated situations
  AND NOT (
    p.name = 'rootlessport'
    AND remote_port > 1024
  )
  AND NOT (
    p.name = 'syncthing'
    AND (
      remote_port IN (53, 80, 88, 110, 443, 587, 993, 3306, 7451)
      OR remote_port > 1024
    )
  )
  AND NOT (
    p.name IN (
      'chrome',
      'Google Chrome Helper',
      'Brave Browser Helper',
      'Chromium Helper',
      'Opera Helper'
    )
    AND remote_port IN (
      53,
      3100,
      443,
      80,
      8006,
      9000,
      5004,
      8009,
      8080,
      8888,
      8443,
      5228,
      32211,
      53,
      10001,
      3478,
      19305,
      19306,
      19307,
      19308,
      19309
    )
  )
  AND NOT (
    p.name IN ('thunderbird')
    AND remote_port IN (53, 143, 443, 587, 465, 585, 993)
  )
  AND NOT (
    p.name IN ('spotify', 'Spotify Helper', 'Spotify')
    AND remote_port IN (53, 443, 8009, 4070, 32211)
  )
  AND NOT (
    remote_port IN (443, 53)
    AND p.name LIKE 'terraform-provider-%'
  )
  AND NOT (
    remote_port IN (443, 53)
    AND p.name LIKE 'npm exec %'
  )
  AND NOT (
    remote_port iN (443, 53)
    AND p.name LIKE 'kubectl.%'
  )
  AND NOT (
    p.cmdline LIKE '%google-cloud-sdk/lib/gcloud.py%'
    AND remote_port IN (80, 53, 443)
  )
GROUP BY
  p.cmdline