2022-10-14 18:19:13 +00:00
|
|
|
-- Unexpected small udev rule entries
|
|
|
|
|
--
|
|
|
|
|
-- Typically vendor-provided udev rules are more verbose.
|
|
|
|
|
--
|
|
|
|
|
-- references:
|
|
|
|
|
-- * https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf
|
2022-10-19 20:56:32 +00:00
|
|
|
-- * https://attack.mitre.org/techniques/T1547/ (Boot or Logon Autostart Execution)
|
|
|
|
|
--
|
2022-10-14 18:19:13 +00:00
|
|
|
-- false positives:
|
|
|
|
|
-- * rules installed by 3rd party software
|
|
|
|
|
--
|
2022-10-14 18:26:49 +00:00
|
|
|
-- tags: persistent filesystem state
|
2022-10-14 18:19:13 +00:00
|
|
|
-- platform: linux
|
2022-10-07 20:19:18 +00:00
|
|
|
SELECT
|
|
|
|
|
file.path,
|
|
|
|
|
uid,
|
|
|
|
|
gid,
|
|
|
|
|
mode,
|
|
|
|
|
mtime,
|
|
|
|
|
ctime,
|
|
|
|
|
type,
|
|
|
|
|
size,
|
|
|
|
|
hash.sha256,
|
|
|
|
|
magic.data
|
|
|
|
|
FROM
|
|
|
|
|
file
|
|
|
|
|
LEFT JOIN hash ON file.path = hash.path
|
|
|
|
|
LEFT JOIN magic ON file.path = magic.path
|
|
|
|
|
WHERE
|
2022-10-13 18:59:32 +00:00
|
|
|
file.path LIKE '/usr/lib/udev/rules.d/%'
|
2022-10-12 01:53:36 +00:00
|
|
|
AND file.size < 180
|
|
|
|
|
AND file.path NOT IN (
|
2022-10-13 18:59:32 +00:00
|
|
|
'/usr/lib/udev/rules.d/50-apport.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/60-net.rules',
|
2022-10-18 00:37:44 +00:00
|
|
|
'/usr/lib/udev/rules.d/60-rfkill.rules',
|
2022-10-13 18:59:32 +00:00
|
|
|
'/usr/lib/udev/rules.d/61-mutter.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/66-saned.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/70-hypervfcopy.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/70-hypervkvp.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/70-hypervvss.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/70-spice-vdagentd.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/70-spice-webdavd.rules',
|
2022-10-18 00:37:44 +00:00
|
|
|
'/usr/lib/udev/rules.d/71-alpha_imaging_technology_co-vr.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/71-astro_gaming-controllers.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/71-betop-controllers.rules',
|
2022-10-13 18:59:32 +00:00
|
|
|
'/usr/lib/udev/rules.d/71-nacon-controllers.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/71-sony-vr.rules',
|
2022-10-18 00:37:44 +00:00
|
|
|
'/usr/lib/udev/rules.d/75-probe_mtd.rules',
|
2022-10-13 18:59:32 +00:00
|
|
|
'/usr/lib/udev/rules.d/85-hdparm.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/85-regulatory.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/90-daxctl-device.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/91-drm-modeset.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/96-e2scrub.rules',
|
2022-10-18 00:37:44 +00:00
|
|
|
'/usr/lib/udev/rules.d/99-BlackmagicDevices.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/99-DavinciPanel.rules',
|
2022-10-13 18:59:32 +00:00
|
|
|
'/usr/lib/udev/rules.d/99-fuse3.rules',
|
2022-10-18 00:37:44 +00:00
|
|
|
'/usr/lib/udev/rules.d/99-fuse.rules',
|
2022-10-13 18:59:32 +00:00
|
|
|
'/usr/lib/udev/rules.d/99-libsane1.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/99-nfs.rules',
|
|
|
|
|
'/usr/lib/udev/rules.d/99-qemu-guest-agent.rules'
|
2022-10-12 01:53:36 +00:00
|
|
|
)
|
