2023-05-11 14:32:17 +00:00
|
|
|
-- Find unexpected regular files in /var/run
|
|
|
|
|
--
|
|
|
|
|
-- false positives:
|
|
|
|
|
-- * none known
|
|
|
|
|
--
|
|
|
|
|
-- references:
|
|
|
|
|
-- * https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
|
|
|
|
|
--
|
2023-05-11 14:33:51 +00:00
|
|
|
-- tags: persistent
|
2023-05-11 14:32:17 +00:00
|
|
|
-- platform: linux
|
2023-05-11 14:33:51 +00:00
|
|
|
SELECT
|
|
|
|
|
file.filename,
|
|
|
|
|
uid,
|
|
|
|
|
gid,
|
|
|
|
|
mode,
|
|
|
|
|
file.ctime,
|
|
|
|
|
file.atime,
|
|
|
|
|
file.mtime,
|
|
|
|
|
file.size,
|
|
|
|
|
hash.sha256,
|
|
|
|
|
magic.data
|
|
|
|
|
FROM
|
|
|
|
|
file
|
|
|
|
|
LEFT JOIN hash on file.path = hash.path
|
|
|
|
|
LEFT JOIN magic ON file.path = magic.path
|
|
|
|
|
WHERE
|
|
|
|
|
file.directory = "/var/run"
|
|
|
|
|
AND file.type = "regular"
|
|
|
|
|
AND file.filename NOT IN (
|
|
|
|
|
'acpid.pid',
|
|
|
|
|
'agetty.reload',
|
|
|
|
|
'alsactl.pid',
|
|
|
|
|
'apport.lock',
|
|
|
|
|
'atd.pid',
|
|
|
|
|
"auditd.pid",
|
|
|
|
|
"crond.pid",
|
|
|
|
|
'crond.reboot',
|
|
|
|
|
"cron.reboot",
|
|
|
|
|
"docker.pid",
|
|
|
|
|
'firefox-restart-required',
|
|
|
|
|
'gdm3.pid',
|
|
|
|
|
'gssproxy.pid',
|
|
|
|
|
'haproxy.pid',
|
|
|
|
|
"lightdm.pid",
|
|
|
|
|
'mcelog.pid',
|
2023-05-16 14:28:19 +00:00
|
|
|
'nvidia-powerd.pid',
|
2023-05-11 14:33:51 +00:00
|
|
|
'motd',
|
|
|
|
|
'nvidia_runtimepm_enabled',
|
|
|
|
|
'nvidia_runtimepm_supported',
|
|
|
|
|
'reboot-required',
|
|
|
|
|
'reboot-required.pkgs',
|
|
|
|
|
'rsyslogd.pid',
|
|
|
|
|
'sm-notify.pid',
|
|
|
|
|
'sshd.pid',
|
|
|
|
|
'u-d-c-nvidia-drm-was-loaded',
|
|
|
|
|
'u-d-c-nvidia-was-loaded',
|
|
|
|
|
'unattended-upgrades.lock',
|
|
|
|
|
'unattended-upgrades.progress',
|
|
|
|
|
"utmp",
|
|
|
|
|
"xtables.lock",
|
|
|
|
|
'zed.pid',
|
|
|
|
|
'zed.state',
|
|
|
|
|
'zfs_fs_name',
|
|
|
|
|
'zfs_unlock_complete'
|
|
|
|
|
)
|
|
|
|
|
AND NOT file.filename LIKE 'u-d-c-gpu-0%'
|
|
|
|
|
GROUP BY
|
|
|
|
|
file.path;
|
