osquery-defense-kit/detection/evasion/hidden-cwd-events-linux.sql

-- Programs running with a hidden current working directory (event-based)
--
-- false positives:
--   * Users rummaging through their configuration files
--
-- NOTES:
--   * Disabled on macOS, as the cwd field as NULL there
--
-- references:
--   * https://attack.mitre.org/techniques/T1564/001/ (Hide Artifacts: Hidden Files and Directories)
--
-- tags: transient extra events
-- platform: linux
-- interval: 600
SELECT
  COALESCE(
    REGEX_MATCH (TRIM(pe.cwd, '"'), "/(\..*?)\/", 1),
    REGEX_MATCH (TRIM(pe.cwd, '"'), "/(\..*)", 1)
  ) AS hidden_base,
  REGEX_MATCH (TRIM(pe.cwd, '"'), "/(\..*)", 1) AS hidden_part,
  COALESCE(
    REGEX_MATCH (TRIM(pe.cwd, '"'), '.*/(.*)', 1),
    pe.cwd
  ) AS basename,
  CONCAT (
    COALESCE(
      REGEX_MATCH (TRIM(pe.path, '"'), '.*/(.*)', 1),
      pe.path
    ),
    ',',
    REGEX_MATCH (TRIM(pe.cwd, '"'), "/(\..*?)\/", 1),
    REGEX_MATCH (TRIM(pe.cwd, '"'), "/(\..*)", 1)
  ) AS exception_key,
  -- Child
  pe.path AS p0_path,
  COALESCE(REGEX_MATCH (pe.path, '.*/(.*)', 1), pe.path) AS p0_name,
  TRIM(pe.cmdline) AS p0_cmd,
  TRIM(pe.cwd, '"') AS p0_cwd,
  pe.status AS p0_status,
  pe.time AS p0_time,
  pe.pid AS p0_pid,
  pe.euid AS p0_euid,
  -- Parent
  pe.parent AS p1_pid,
  TRIM(COALESCE(p1.cmdline, pe1.cmdline)) AS p1_cmd,
  p1.cwd AS p1_cwd,
  COALESCE(p1.path, pe1.path) AS p1_path,
  COALESCE(p_hash1.sha256, pe_hash1.sha256) AS p1_hash,
  REGEX_MATCH (COALESCE(p1.path, pe1.path), '.*/(.*)', 1) AS p1_name
FROM
  process_events pe
  LEFT JOIN users u ON pe.uid = u.uid
  LEFT JOIN processes p ON pe.pid = p.pid -- Parents (via two paths)
  LEFT JOIN processes p1 ON pe.parent = p1.pid
  LEFT JOIN hash p_hash1 ON p1.path = p_hash1.path
  LEFT JOIN process_events pe1 ON pe.parent = pe1.pid
  AND pe1.time > (strftime('%s', 'now') -60660)
  AND pe1.cmdline != ''
  LEFT JOIN hash pe_hash1 ON pe1.path = pe_hash1.path
WHERE
  pe.time > (strftime('%s', 'now') -60600)
  AND pe.cwd LIKE '%/.%'
  AND NOT (
    hidden_base IN (
      '.cache',
      '.cargo',
      '.gradle',
      '.kotlin',
      '.npm',
      '.git',
      '.linuxbrew',
      '.gimme',
      '.vscode',
      '.vim',
      '.docker',
      '.config',
      '.vscode-oss',
      '.local',
      '.github',
      '.provisio',
      '.terraform.d',
      '.emacs.d',
      '.gmailctl',
      '.oh-my-zsh',
      '.zsh'
    )
    OR exception_key LIKE '%sh,~/.Trash'
    OR exception_key IN ('git,.test')
  )
  AND NOT pe.cwd LIKE '%/build/%'
  AND NOT pe.cwd LIKE '%/out/%'
GROUP BY
  p.cmdline,
  p.cwd;