Merge pull request #217 from tstromberg/mismatch

Rewrite name/path mismatch for lower maintenance

detection/evasion/name_path_mismatch.sql

@@ -6,18 +6,28 @@
 -- references:
 --   * https://attack.mitre.org/techniques/T1036/004/ (Masquerade Task or Service)
 --
--- tags: persistent daemon high
-SELECT
+-- tags: persistent process
+SELECT SUBSTR(
+    COALESCE(
+      -- TODO: Fix to not require filename!
+      REGEX_MATCH (f.filename, '(.*?)\W', 1),
+      f.filename
+    ),
+    0,
+    6
+  ) AS short_filename,
+  COALESCE(REGEX_MATCH (p0.path, '.*/(.*)', 1), p0.path) AS basename,
+  COALESCE(
+    REGEX_MATCH (p0.path, '.*/([a-zA-Z]+)', 1),
+    p0.path
+  ) AS base_letters,
   CONCAT (
-    'name=',
-    TRIM(SUBSTR(SPLIT (p0.name, ':./ ', 0), 0, 15)),
-    ',file=',
-    TRIM(SUBSTR(SPLIT (f.filename, ':./ ', 0), 0, 15)),
+    MIN(p0.euid, 500),
     ',',
-    MIN(p0.euid, 500)
+    COALESCE(REGEX_MATCH (p0.path, '.*/(.*)', 1), p0.path),
+    ',',
+    p0.name
   ) AS exception_key,
-  TRIM(SUBSTR(SPLIT (p0.name, ':./ ', 0), 0, 15)) AS short_name,
-  TRIM(SUBSTR(SPLIT (f.filename, ':./ ', 0), 0, 15)) AS short_filename,
   -- Child
   p0.pid AS p0_pid,
   p0.path AS p0_path,
@@ -40,111 +50,41 @@ SELECT
   p2.path AS p2_path,
   p2.cmdline AS p2_cmd,
   p2_hash.sha256 AS p2_sha256
-FROM
-  processes p0
+FROM processes p0
   LEFT JOIN file f ON p0.path = f.path
   LEFT JOIN hash p0_hash ON p0.path = p0_hash.path
   LEFT JOIN processes p1 ON p0.parent = p1.pid
   LEFT JOIN hash p1_hash ON p1.path = p1_hash.path
   LEFT JOIN processes p2 ON p1.parent = p2.pid
   LEFT JOIN hash p2_hash ON p2.path = p2_hash.path
-WHERE
-  short_filename != short_name
-  AND NOT p0_cmd LIKE '/nix/store/%/bin/bash%' -- Serial masqueraders
+WHERE p0.path != ""
+  AND NOT p0.name == basename
   AND NOT (
-    short_filename IN (
-      'bash',
-      'ruby',
-      'python',
-      'python3',
-      'perl',
-      'node'
-    )
-    -- ddexec
-    AND LENGTH(p0.cmdline) > 2
-  )
-  AND exception_key NOT IN (
-    'name=apt,file=dash,0',
-    'name=blueman-applet,file=python3,500',
-    'name=blueman-tray,file=python3,500',
-    'name=cat,file=coreutils,500',
-    'name=cc,file=gcc,0',
-    'name=chrome-gnome-s,file=python3,500',
-    'name=Chroot,file=firefox,500',
-    'name=code-oss,file=electron,500',
-    'name=com,file=docker,500',
-    'name=editor,file=nano,500',
-    'name=exe,file=Melvor,500',
-    'name=exe,file=rootlesskit,500',
-    'name=exe,file=rootlessport,500',
-    'name=file,file=firefox,500',
-    'name=firefox-wrappe,file=firefox,500',
-    'name=firewalld,file=python3,0',
-    'name=gimp,file=gimp-2,500',
-    'name=gjs,file=gjs-console,120',
-    'name=gjs,file=gjs-console,42',
-    'name=gjs,file=gjs-console,500',
-    'name=gnome-characte,file=gjs-console,500',
-    'name=gnome-character,file=gjs-console,500',
-    'name=gnome-tweak-to,file=python3,500',
-    'name=gsettings-hel,file=gsettings-help,500',
-    'name=iptables,file=xtables-nft-mu,0',
-    'name=Isolated,file=firefox,500',
-    'name=Isolated,file=thunderbird,500',
-    'name=main,file=pyrogenesis,500',
-    'name=MainThread,file=plugin-contain,500',
-    'name=mount,file=ntfs-3g,0',
-    'name=mysqld,file=mariadbd,500',
-    'name=(udev-worker),file=udevadm,0',
-    'name=networkd-dispa,file=python3,0',
-    'name=ninja,file=samu,500',
-    'name=nix-daemon,file=nix,0',
-    'name=npm,file=node,500',
-    'name=obsidian,file=obsidian-appim,500',
-    'name=org,file=gjs-console,500',
-    'name=osqueryi,file=osqueryd,0',
-    'name=osqueryi,file=osqueryd,500',
-    'name=phpstorm,file=dash,500',
-    'name=pidof,file=killall5,0',
-    'name=pipewire-pulse,file=pipewire,120',
-    'name=pipewire-pulse,file=pipewire,125',
-    'name=pipewire-pulse,file=pipewire,500',
-    'name=Privileged,file=firefox,500',
-    'name=RDD,file=firefox,500',
-    'name=restorecon,file=setfiles,0',
-    'name=sd_espeak-ng-m,file=sd_espeak-ng,500',
-    'name=sessionclean,file=dash,0',
-    'name=sh,file=busybox,0',
-    'name=sh,file=busybox,500',
-    'name=sh,file=dash,0',
-    'name=sh,file=dash,500',
-    'name=slic3r_main,file=prusa-slicer,500',
-    'name=Socket,file=firefox,500',
-    'name=streamdeck,file=python3,500',
-    'name=systemd-udevd,file=udevadm,0',
-    'name=systemd-udevd,file=udevadm,500',
-    'name=terminator,file=python3,500',
-    'name=Thunar,file=thunar,500',
-    'name=unattended-upg,file=python3,0',
-    'name=Utility,file=firefox,500',
-    'name=vi,file=nvim,500',
-    'name=vi,file=vim,500',
-    'name=WebExtensions,file=firefox,500',
-    'name=Web,file=firefox,500',
-    'name=Web,file=thunderbird,500',
-    'name=X,file=Xorg,0',
-    'name=zfs-auto-snaps,file=ruby,0',
-    'name=zoom,file=ZoomLauncher,500'
+    LENGTH(basename) > 1
+    AND basename == short_filename
   )
   AND NOT (
-    short_filename = 'systemd'
-    AND short_name LIKE '(sd%'
+    LENGTH(p0.name) > 2
+    AND INSTR(LOWER(basename), LOWER(p0.name)) > 0
   )
   AND NOT (
-    short_filename LIKE 'emacs%'
-    AND short_name = 'emacs'
+    LENGTH(short_filename) > 2
+    AND INSTR(LOWER(p0.name), LOWER(short_filename)) > 0
+  ) -- Extremely common and unpredictable process name setters
+  AND NOT base_letters IN (
+    "bash",
+    "dash",
+    "electron",
+    "firefox",
+    "node",
+    "perl",
+    "python",
+    "ruby",
+    "thunderbird"
   )
-  AND NOT (p0.path LIKE '/nix/store/%/bin/coreutils')
-GROUP by
-  short_name,
-  short_filename
+  AND NOT exception_key IN (
+    "0,udevadm,systemd-udevd",
+    "500,rootlesskit,exe",
+    "500,systemd,(sd-pam)"
+  )
+GROUP by exception_key