2022-10-13 18:59:32 +00:00
|
|
|
-- Alert on programs running that are unusually old (poor timestomping)
|
2022-10-14 18:19:13 +00:00
|
|
|
--
|
2022-10-19 20:56:32 +00:00
|
|
|
-- false positive:
|
|
|
|
|
-- * legimitely ancient programs. For instance, printer drivers.
|
|
|
|
|
--
|
2022-10-14 18:19:13 +00:00
|
|
|
-- references:
|
2022-10-19 20:56:32 +00:00
|
|
|
-- * https://attack.mitre.org/techniques/T1070/006/ (Indicator Removal on Host: Timestomp)
|
2022-10-14 18:19:13 +00:00
|
|
|
--
|
|
|
|
|
-- tags: transient process state
|
2023-01-19 16:42:00 +00:00
|
|
|
SELECT p.path,
|
2022-09-24 15:12:23 +00:00
|
|
|
p.cmdline,
|
|
|
|
|
p.cwd,
|
2023-01-19 16:42:00 +00:00
|
|
|
p.pid,
|
|
|
|
|
p.name,
|
|
|
|
|
f.mtime,
|
|
|
|
|
f.ctime,
|
|
|
|
|
p.cgroup_path,
|
2022-09-24 15:12:23 +00:00
|
|
|
((strftime('%s', 'now') - f.ctime) / 86400) AS ctime_age_days,
|
2023-01-19 16:42:00 +00:00
|
|
|
((strftime('%s', 'now') - f.mtime) / 86400) AS mtime_age_days,
|
2022-09-24 15:12:23 +00:00
|
|
|
((strftime('%s', 'now') - f.btime) / 86400) AS btime_age_days,
|
|
|
|
|
h.sha256,
|
|
|
|
|
f.uid,
|
2023-01-19 16:42:00 +00:00
|
|
|
m.path,
|
2022-09-24 15:12:23 +00:00
|
|
|
f.gid
|
2023-01-19 16:42:00 +00:00
|
|
|
FROM processes p
|
|
|
|
|
LEFT JOIN file f ON p.path = f.path
|
|
|
|
|
LEFT JOIN hash h ON p.path = h.path
|
|
|
|
|
LEFT JOIN magic m ON p.path = m.path
|
|
|
|
|
WHERE (
|
2022-09-29 19:42:27 +00:00
|
|
|
ctime_age_days > 1050
|
|
|
|
|
OR mtime_age_days > 1050
|
2022-09-24 15:12:23 +00:00
|
|
|
)
|
2023-01-19 16:42:00 +00:00
|
|
|
AND f.mtime > 1
|
|
|
|
|
AND f.path NOT LIKE '/home/%/idea-IU-223.8214.52/%'
|
|
|
|
|
AND f.path NOT IN (
|
|
|
|
|
'/Library/Printers/Brother/Utilities/Server/LOGINserver.app/Contents/MacOS/LOGINserver',
|
|
|
|
|
'/Library/Printers/Brother/Utilities/Server/USBserver.app/Contents/MacOS/USBserver',
|
|
|
|
|
'/Library/Printers/Brother/Utilities/Server/WorkflowAppControl.app/Contents/MacOS/WorkflowAppControl',
|
|
|
|
|
'/Library/Printers/Brother/Utilities/Server/USBAppControl.app/Contents/MacOS/USBAppControl',
|
|
|
|
|
'/Library/Printers/Brother/Utilities/Server/NETserver.app/Contents/MacOS/NETserver',
|
|
|
|
|
'/Applications/Gitter.app/Contents/Library/LoginItems/GitterHelperApp.app/Contents/MacOS/GitterHelperApp',
|
|
|
|
|
'/Applications/Divvy.app/Contents/MacOS/Divvy',
|
|
|
|
|
'/opt/homebrew/Cellar/watch/3.3.16/bin/watch',
|
|
|
|
|
'/Applications/Skitch.app/Contents/Library/LoginItems/J8RPQ294UB.com.skitch.SkitchHelper.app/Contents/MacOS/J8RPQ294UB.com.skitch.SkitchHelper',
|
|
|
|
|
'/opt/homebrew/Cellar/bash/5.1.16/bin/bash',
|
|
|
|
|
'/snap/brackets/138/opt/brackets/Brackets',
|
|
|
|
|
'/snap/brackets/138/opt/brackets/Brackets-node',
|
|
|
|
|
'/Applications/Emacs.app/Contents/MacOS/Emacs-x86_64-10_14',
|
|
|
|
|
'/Library/Application Support/Logitech/com.logitech.vc.LogiVCCoreService/LogiVCCoreService.app/Contents/MacOS/LogiVCCoreService',
|
|
|
|
|
'/usr/bin/i3blocks'
|
2022-09-24 15:12:23 +00:00
|
|
|
)
|
2023-01-19 16:42:00 +00:00
|
|
|
AND p.name NOT IN (
|
|
|
|
|
'buildkitd',
|
|
|
|
|
'BluejeansHelper',
|
|
|
|
|
'J8RPQ294UB.com.skitch.SkitchHelper',
|
|
|
|
|
'Pandora',
|
|
|
|
|
'Pandora Helper'
|
|
|
|
|
)
|
|
|
|
|
GROUP BY p.pid,
|
|
|
|
|
p.path
|
