RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2024-12-16 02:54:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #108 from tstromberg/shell-parent-events

Browse Source 
new detectors: unexpected shell & fetcher events
This commit is contained in:
Thomas Strömberg 2023-01-04 15:49:36 -05:00 committed by GitHub
commit 3db3559a7f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 274 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

84
detection/execution/unexpected-fetcher-parent-events.sql Normal file
View File

@ -0,0 +1,84 @@
-- Suspicious parenting of fetch tools (event-based)
--
-- refs:
-- * https://attack.mitre.org/techniques/T1105/ (Ingress Tool Transfer)
--
-- tags: transient process state often
-- platform: posix
-- interval: 900
SELECT pe.path AS child_path,
REGEX_MATCH (pe.path, '.*/(.*)', 1) AS child_name,
TRIM(pe.cmdline) AS child_cmd,
pe.pid AS child_pid,
p.cgroup_path AS child_cgroup,
p.parent AS parent_pid,
TRIM(IIF(pp.cmdline != NULL, pp.cmdline, ppe.cmdline)) AS parent_cmd,
TRIM(IIF(pp.path != NULL, pp.path, ppe.path)) AS parent_path,
REGEX_MATCH (
IIF(pp.path != NULL, pp.path, ppe.path),
'.*/(.*)',
1
) AS parent_name,
TRIM(IIF(gp.cmdline != NULL, gp.cmdline, gpe.cmdline)) AS gparent_cmd,
TRIM(IIF(gp.path != NULL, gp.path, gpe.path)) AS gparent_path,
REGEX_MATCH (
IIF(gp.path != NULL, gp.path, gpe.path),
'.*/(.*)',
1
) AS gparent_name,
IIF(pp.parent != NULL, pp.parent, ppe.parent) AS gparent_pid,
CONCAT(
REGEX_MATCH (pe.path, '.*/(.*)', 1),
',',
MIN(pe.euid, 500),
',',
REGEX_MATCH (
IIF(pp.path != NULL, pp.path, ppe.path),
'.*/(.*)',
1
),
',',
REGEX_MATCH (
IIF(gp.path != NULL, gp.path, gpe.path),
'.*/(.*)',
1
)
) AS exception_key
FROM process_events pe
LEFT JOIN processes p ON pe.pid = p.pid
LEFT JOIN processes pp ON pe.parent = pp.pid
LEFT JOIN process_events ppe ON pe.parent = ppe.pid
LEFT JOIN processes gp ON gp.pid = pp.parent
LEFT JOIN process_events gpe ON ppe.parent = gpe.pid
WHERE child_name IN ('curl', 'wget', 'ftp', 'tftp')
AND pe.time > (strftime('%s', 'now') -900) -- Ignore partial table joins
AND NOT (
pe.euid > 500
AND parent_name IN ('sh', 'fish', 'zsh', 'bash', 'dash')
AND gparent_name IN (
'alacritty',
'gnome-terminal-',
'roxterm',
'tmux',
'tmux:server',
'wezterm-gui',
'kitty',
'zsh'
)
)
AND NOT parent_name IN ('yay')
AND NOT exception_key IN (
'curl,500,fish,gnome-terminal-',
'curl,500,bash,zsh'
)
AND NOT (
pe.euid > 500 AND
parent_name = 'env' AND
parent_cmd LIKE '/usr/bin/env -i % HOMEBREW_BREW_FILE=%'
)
AND NOT (
pe.euid > 500 AND
parent_name = 'ruby' AND
parent_cmd LIKE '%/opt/homebrew/Library/Homebrew/brew.rb%'
)
GROUP BY pe.pid

67
detection/execution/unexpected-fetcher-parents.sql Normal file
View File

@ -0,0 +1,67 @@
-- Suspicious parenting of fetch tools (state-based)
--
-- refs:
-- * https://attack.mitre.org/techniques/T1105/ (Ingress Tool Transfer)
--
-- tags: transient process state often
-- platform: posix
SELECT p.pid,
p.path,
p.name AS child_name,
p.cmdline,
p.cwd,
p.euid,
p.parent,
p.cgroup_path,
pp.path AS parent_path,
pp.name AS parent_name,
pp.cmdline AS parent_cmd,
pp.euid AS parent_euid,
gp.name AS gparent_name,
gp.cmdline AS gparent_cmd,
pp.pid AS gparent_pid,
hash.sha256 AS parent_sha256,
CONCAT(
p.name,
',',
MIN(p.euid, 500),
',',
pp.name,
',',
gp.name
) AS exception_key
FROM processes p
LEFT JOIN processes pp ON p.parent = pp.pid
LEFT JOIN processes gp ON pp.parent = gp.pid
LEFT JOIN hash ON pp.path = hash.path
WHERE child_name IN ('curl', 'wget', 'ftp', 'tftp') -- And not a regular local user
AND NOT (
p.euid > 500
AND parent_name IN ('sh', 'fish', 'zsh', 'bash', 'dash')
AND gparent_name IN (
'alacritty',
'gnome-terminal-',
'roxterm',
'tmux',
'tmux:server',
'wezterm-gui',
'kitty',
'zsh'
)
)
AND NOT parent_name IN ('yay')
AND NOT exception_key IN (
'curl,500,fish,gnome-terminal-',
'curl,500,bash,zsh'
)
AND NOT (
p.euid > 500
AND parent_name = 'env'
AND parent_cmd LIKE '/usr/bin/env -i % HOMEBREW_BREW_FILE=%'
)
AND NOT (
p.euid > 500
AND parent_name = 'ruby'
AND parent_cmd LIKE '%/opt/homebrew/Library/Homebrew/brew.rb%'
)
GROUP BY p.pid

123
detection/initial_access/unexpected-shell-parent-events.sql Normal file
View File

@ -0,0 +1,123 @@
-- Unexpected process that spawns shell processes (event-based)
--
-- false positives:
-- * IDE's
--
-- references:
-- * https://attack.mitre.org/techniques/T1059/ (Command and Scripting Interpreter)
-- * https://attack.mitre.org/techniques/T1204/002/ (User Execution: Malicious File)
--
-- tags: process events
-- interval: 300
-- platform: posix
SELECT pe.path AS child_path,
REGEX_MATCH (pe.path, '.*/(.*)', 1) AS child_name,
TRIM(pe.cmdline) AS child_cmd,
pe.pid AS child_pid,
p.cgroup_path AS child_cgroup,
p.parent AS parent_pid,
TRIM(IIF(pp.cmdline != NULL, pp.cmdline, ppe.cmdline)) AS parent_cmd,
TRIM(IIF(pp.path != NULL, pp.path, ppe.path)) AS parent_path,
REGEX_MATCH (IIF(pp.path != NULL, pp.path, ppe.path), '.*/(.*)', 1) AS parent_name,
TRIM(IIF(gp.cmdline != NULL, gp.cmdline, gpe.cmdline)) AS gparent_cmd,
TRIM(IIF(gp.path != NULL, gp.path, gpe.path)) AS gparent_path,
REGEX_MATCH (IIF(gp.path != NULL, gp.path, gpe.path), '.*/(.*)', 1) AS gparent_name,
IIF(pp.parent != NULL, pp.parent, ppe.parent) AS gparent_pid
FROM process_events pe
LEFT JOIN processes p ON pe.pid = p.pid
LEFT JOIN processes pp ON pe.parent = pp.pid
LEFT JOIN process_events ppe ON pe.parent = ppe.pid
LEFT JOIN processes gp ON gp.pid = pp.parent
LEFT JOIN process_events gpe ON ppe.parent = gpe.pid
WHERE child_name IN ('sh', 'fish', 'zsh', 'bash', 'dash', 'osascript')
AND pe.time > (strftime('%s', 'now') -300) -- Ignore partial table joins
AND NOT (
parent_name IN (
'abrt-handle-eve',
'alacritty',
'bash',
'build-script-build',
'chezmoi',
'clang-11',
'code',
'Code Helper (Renderer)',
'Code - Insiders Helper (Renderer)',
'collect2',
'conmon',
'containerd-shim',
'dash',
'demoit',
'direnv',
'doas',
'erl_child_setup',
'find',
'FinderSyncExtension',
'fish',
'go',
'git',
'goland',
'helm',
'i3bar',
'i3blocks',
'java',
'kitty',
'login',
'env',
'ko',
'kubectl',
'lightdm',
'make',
'monorail',
'ninja',
'nix',
'nix-build',
'nix-daemon',
'node',
'nvim',
'package_script_service',
'perl',
'PK-Backend',
'python',
'roxterm',
'sdk',
'sdzoomplugin',
'sh',
'snyk',
'skhd',
'sshd',
'sudo',
'swift',
'systemd',
'terminator',
'test2json',
'tmux',
'tmux:server',
'vi',
'vim',
'watch',
'wezterm-gui',
'xargs',
'xcrun',
'xfce4-terminal',
'yum',
'zellij',
'zsh'
)
OR parent_name LIKE 'terraform-provider-%'
-- Do not add shells to this list if you want your query to detect
-- bad programs that were started from a shell.
OR gparent_name IN (
'env',
'git'
)
-- Homebrew, except we don't want to allow all of ruby
OR child_cmd IN (
'sh -c /bin/stty size 2>/dev/null',
'sh -c python3.7 --version 2>&1',
'sh -c xcode-select --print-path >/dev/null 2>&1 && xcrun --sdk macosx --show-sdk-path 2>/dev/null'
)
OR child_cmd LIKE '/bin/bash /usr/local/Homebrew/Library%'
OR gparent_cmd LIKE '/bin/bash /usr/local/bin/brew%'
)
GROUP BY pe.pid