Add lost files from the rename

detection/evasion/unexpected-etc-executables.sql

@@ -0,0 +1,135 @@
+-- Find unexpected executables in /etc
+--
+-- references:
+--   * https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/
+--
+-- tags: persistent
+-- platform: posix
+SELECT
+  file.path,
+  file.directory,
+  uid,
+  gid,
+  mode,
+  file.mtime,
+  file.size,
+  hash.sha256,
+  magic.data
+FROM
+  file
+  LEFT JOIN hash on file.path = hash.path
+  LEFT JOIN magic ON file.path = magic.path
+WHERE
+  (file.path LIKE '/etc/%%')
+  AND file.type = 'regular'
+  AND (
+    file.mode LIKE '%7%'
+    or file.mode LIKE '%5%'
+    or file.mode LIKE '%1%'
+  )
+  AND file.directory NOT IN (
+    '/etc/X11/xinit/xinitrc.d',
+    '/etc/apcupsd',
+    '/etc/menu-methods',
+    '/etc/avahi',
+    '/etc/chromium/native-messaging-hosts',
+    '/etc/cifs-utils',
+    '/etc/cron.hourly',
+    '/etc/flatpak/remotes.d',
+    '/etc/gdm/Init',
+    '/etc/gdm/PostLogin',
+    '/etc/gdm/PostSession',
+    '/etc/gdm/PreSession',
+    '/etc/gdm',
+    '/etc/grub.d',
+    '/etc/httpd/modules',
+    '/etc/ifplugd',
+    '/etc/init.d',
+    '/etc/lightdm',
+    '/etc/pinentry',
+    '/etc/ppp',
+    '/etc/ppp/ip-down.d',
+    '/etc/ppp/ip-up.d',
+    '/etc/ppp/ipv6-up.d',
+    '/etc/profile.d',
+    '/etc/rdnssd',
+    '/etc/security',
+    '/etc/skel',
+    '/etc/ssl/misc',
+    '/etc/systemd/system',
+    '/etc/systemd/system/graphical.target.wants',
+    '/etc/vpnc',
+    '/etc/xdg/Xwayland-session.d',
+    '/etc/NetworkManager/dispatcher.d',
+    '/etc/X11',
+    '/etc/X11/xinit',
+    '/etc/acpi',
+    '/etc/alternatives',
+    '/etc/apm/resume.d',
+    '/etc/apm/scripts.d',
+    '/etc/apm/suspend.d',
+    '/etc/brltty/Contraction',
+    '/etc/console-setup',
+    '/etc/cron.daily',
+    '/etc/cron.monthly',
+    '/etc/cron.weekly',
+    '/etc/dhcp/dhclient-enter-hooks.d',
+    '/etc/dhcp/dhclient-exit-hooks.d',
+    '/etc/dkms',
+    '/etc/gdm3/Init',
+    '/etc/gdm3/PostLogin',
+    '/etc/gdm3/PostSession',
+    '/etc/gdm3/PreSession',
+    '/etc/gdm3/Prime',
+    '/etc/gdm3/PrimeOff',
+    '/etc/gdm3',
+    '/etc/ifplugd/action.d',
+    '/etc/kernel/header_postinst.d',
+    '/etc/kernel/install.d',
+    '/etc/kernel/postinst.d',
+    '/etc/kernel/postrm.d',
+    '/etc/kernel/preinst.d',
+    '/etc/kernel/prerm.d',
+    '/etc/network/if-down.d',
+    '/etc/network/if-post-down.d',
+    '/etc/network/if-pre-up.d',
+    '/etc/network/if-up.d',
+    '/etc/openvpn',
+    '/etc/pm/sleep.d',
+    '/etc/rc0.d',
+    '/etc/rc1.d',
+    '/etc/rc2.d',
+    '/etc/rc3.d',
+    '/etc/rc4.d',
+    '/etc/rc5.d',
+    '/etc/rc6.d',
+    '/etc/rcS.d',
+    '/etc/update-motd.d',
+    '/etc/wpa_supplicant',
+    '/etc/zfs/zed.d',
+    '/etc/zfs/zpool.d',
+    '/etc/bash_completion.d',
+    '/etc/dhcp/dhclient.d',
+    '/etc/mcelog/triggers',
+    '/etc/qemu-ga',
+    '/etc/rc.d/init.d',
+    '/etc/rc.d/rc0.d',
+    '/etc/rc.d/rc1.d',
+    '/etc/rc.d/rc2.d',
+    '/etc/rc.d/rc3.d',
+    '/etc/rc.d/rc4.d',
+    '/etc/rc.d/rc5.d',
+    '/etc/rc.d/rc6.d',
+    '/etc/vmware-tools',
+    '/etc/zfs-fuse',
+    '/etc/ssl/certs',
+    '/etc/ssl/trust-source',
+    '/etc/systemd/system-shutdown'
+  )
+  AND file.path NOT IN (
+    '/etc/nftables.conf',
+    '/etc/rmt',
+    '/etc/qemu-ifdown',
+    '/etc/qemu-ifup',
+    '/etc/opt/chrome/native-messaging-hosts/com.google.endpoint_verification.api_helper.json'
+  )

detection/execution/exotic-commands.sql

@@ -0,0 +1,81 @@
+-- Pick out exotic processes based on their command-line (state-based)
+--
+-- false positives:
+--   * possible, but none known
+--
+-- tags: transient process state
+-- platform: posix
+SELECT
+  p.pid,
+  p.path,
+  p.name,
+  p.cmdline AS cmd,
+  p.cwd,
+  p.euid,
+  p.parent,
+  pp.path AS parent_path,
+  pp.name AS parent_name,
+  pp.cmdline AS parent_cmd,
+  pp.euid AS parent_euid,
+  hash.sha256 AS child_sha256,
+  phash.sha256 AS parent_sha256
+FROM
+  processes p
+  LEFT JOIN processes pp ON p.parent = pp.pid
+  LEFT JOIN hash ON p.path = hash.path
+  LEFT JOIN hash AS phash ON pp.path = hash.path
+WHERE
+  -- Known attack scripts
+  p.name IN ('nc', 'mkfifo')
+  OR p.name LIKE '%pwn%'
+  OR p.name LIKE '%xig%'
+  OR p.name LIKE '%xmr%'
+  OR cmd LIKE '%bitspin%'
+  OR cmd LIKE '%lushput%'
+  OR cmd LIKE '%incbit%'
+  OR cmd LIKE '%traitor%'
+  OR cmd LIKE '%msfvenom%'
+  OR
+  -- Unusual behaviors
+  cmd LIKE '%ufw disable%'
+  OR cmd LIKE '%iptables -P % ACCEPT%'
+  OR cmd LIKE '%iptables -F%'
+  OR cmd LIKE '%chattr -ia%'
+  OR cmd LIKE '%chmod 777 %'
+  OR cmd LIKE '%bpftool%'
+  OR cmd LIKE '%touch%acmr%'
+  OR cmd LIKE '%ld.so.preload%'
+  OR cmd LIKE '%urllib.urlopen%'
+  OR cmd LIKE '%nohup%tmp%'
+  OR cmd LIKE '%set visible of front window to false%'
+  OR cmd LIKE '%chrome%--load-extension%'
+  OR
+  -- Crypto miners
+  cmd LIKE '%c3pool%'
+  OR cmd LIKE '%cryptonight%'
+  OR cmd LIKE '%f2pool%'
+  OR cmd LIKE '%hashrate%'
+  OR cmd LIKE '%hashvault%'
+  OR cmd LIKE '%minerd%'
+  OR cmd LIKE '%monero%'
+  OR cmd LIKE '%nanopool%'
+  OR cmd LIKE '%nicehash%'
+  OR cmd LIKE '%stratum%'
+  OR
+  -- Random keywords
+  cmd LIKE '%ransom%'
+  OR cmd LIKE '%malware%'
+  OR cmd LIKE '%plant%'
+  OR
+  -- Reverse shells
+  cmd LIKE '%/dev/tcp/%'
+  OR cmd LIKE '%/dev/udp/%'
+  OR cmd LIKE '%fsockopen%'
+  OR cmd LIKE '%openssl%quiet%'
+  OR cmd LIKE '%pty.spawn%'
+  OR cmd LIKE '%sh -i'
+  OR cmd LIKE '%socat%'
+  OR cmd LIKE '%SOCK_STREAM%'
+  OR cmd LIKE '%Socket.fork%'
+  OR cmd LIKE '%Socket.new%'
+  OR cmd LIKE '%socket.socket%'

detection/execution/unexpected-execdir-linux.sql

@@ -0,0 +1,73 @@
+-- Programs running out of unexpected directories, such as /tmp
+--
+-- references:
+--   * https://blog.talosintelligence.com/2022/10/alchimist-offensive-framework.html
+--
+-- tags: transient often
+-- platform: linux
+SELECT
+  p.pid,
+  p.name,
+  p.path,
+  p.euid,
+  p.gid,
+  f.ctime,
+  f.directory AS dirname,
+  p.cmdline,
+  hash.sha256,
+  pp.path AS parent_path,
+  pp.name AS parent_name,
+  pp.cmdline AS parent_cmdline,
+  pp.euid AS parent_euid,
+  hash.sha256 AS parent_sha256
+FROM
+  processes p
+  LEFT JOIN file f ON p.path = f.path
+  LEFT JOIN hash ON hash.path = p.path
+  LEFT JOIN processes pp ON p.parent = pp.pid
+  -- NOTE: Everything after this is shared with process_events/unexpected-executable-directory-events
+WHERE
+  dirname NOT IN (
+    '/bin',
+    '/usr/share/teams/resources/app.asar.unpacked/node_modules/slimcore/bin',
+    '/sbin',
+    '/usr/bin',
+    '/usr/lib',
+    '/usr/lib/bluetooth',
+    '/usr/lib/cups/notifier',
+    '/usr/share/teams',
+    '/usr/lib/evolution-data-server',
+    '/usr/lib/firefox',
+    '/usr/lib/fwupd',
+    '/usr/lib/ibus',
+    '/usr/lib/libreoffice/program',
+    '/usr/lib/polkit-1',
+    '/usr/lib/slack',
+    '/usr/lib/snapd',
+    '/usr/lib/systemd',
+    '/usr/lib/telepathy',
+    '/usr/lib/udisks2',
+    '/usr/lib/xorg',
+    '/usr/lib64/firefox',
+    '/usr/libexec',
+    '/usr/sbin',
+    '/usr/share/code'
+  )
+  AND dirname NOT LIKE '/home/%'
+  AND dirname NOT LIKE '/nix/store/%'
+  AND dirname NOT LIKE '/opt/%'
+  AND dirname NOT LIKE '/snap/%'
+  AND dirname NOT LIKE '/tmp/%/bin'
+  AND dirname NOT LIKE '/tmp/go-build%'
+  AND dirname NOT LIKE '/usr/lib/%'
+  AND dirname NOT LIKE '/usr/lib64/%'
+  AND dirname NOT LIKE '/usr/libexec/%'
+  AND dirname NOT LIKE '/usr/local/%'
+  AND p.path NOT IN (
+    '/usr/lib/firefox/firefox',
+    '/usr/lib64/firefox/firefox'
+  )
+  AND NOT (
+    dirname = ''
+    AND p.name LIKE 'runc%'
+  )

detection/execution/unexpected-execdir-macos.sql

@@ -0,0 +1,142 @@
+-- Find programs running from strange directories on macOS
+--
+-- false positives:
+--   - Vendors who are doing weird things that are not in the signature list
+--
+-- See "execdir-events" for the version that is more likely to catch things
+--
+-- platform: darwin
+-- tags: transient seldom process filesystem state
+SELECT
+  p.pid,
+  p.name,
+  p.path,
+  p.euid,
+  p.gid,
+  f.ctime,
+  f.directory AS dirname,
+  REPLACE(f.directory, u.directory, '~') AS dirname,
+  p.cmdline,
+  hash.sha256,
+  pp.path AS parent_path,
+  pp.name AS parent_name,
+  pp.cmdline AS parent_cmdline,
+  pp.euid AS parent_euid,
+  hash.sha256 AS parent_sha256,
+  signature.identifier,
+  signature.authority
+FROM
+  processes p
+  LEFT JOIN file f ON p.path = f.path
+  LEFT JOIN hash ON hash.path = p.path
+  LEFT JOIN users u ON p.uid = u.uid
+  LEFT JOIN processes pp ON p.parent = pp.pid
+  LEFT JOIN signature ON p.path = signature.path -- NOTE: Everything after this is shared with process_events/unexpected-executable-directory-events
+WHERE
+  dirname NOT IN (
+    '/bin',
+    '/Library/DropboxHelperTools/Dropbox_u501',
+    '/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/Contents/MacOS',
+    '/Library/Printers/DYMO/Utilities',
+    '/Library/PrivilegedHelperTools',
+    '/opt/homebrew/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/bin/gke-gcloud-auth-plugin',
+    '/opt/usr/bin',
+    '/opt/X11/bin',
+    '/opt/X11/libexec',
+    '/sbin',
+    '/usr/bin',
+    '/usr/lib',
+    '/usr/lib/bluetooth',
+    '/usr/lib/cups/notifier',
+    '/usr/lib/fwupd',
+    '/usr/lib/ibus',
+    '/usr/libexec',
+    '/usr/libexec/ApplicationFirewall',
+    '/usr/libexec/AssetCache',
+    '/usr/libexec/rosetta',
+    '/usr/sbin',
+    '/usr/share/code',
+    '/usr/share/teams/resources/app.asar.unpacked/node_modules/slimcore/bin'
+  )
+  AND homedir NOT IN (
+    '~/bin',
+    '~/go/bin',
+    '~/Library/Application Support/cloud-code/installer/google-cloud-sdk/bin',
+    '~/Library/Application Support/Code/User/globalStorage/grafana.vscode-jsonnet/bin',
+    '~/Library/Application Support/com.elgato.StreamDeck/Plugins/com.lostdomain.zoom.sdPlugin'
+  )
+  AND signature.authority NOT IN (
+    'Apple Mac OS Application Signing',
+    'Developer ID Application: Adobe Inc. (JQ525L2MZD)',
+    'Developer ID Application: Corsair Memory, Inc. (Y93VXCB8Q5)',
+    'Developer ID Application: Docker Inc (9BNSXJN65R)',
+    'Developer ID Application: Dropbox, Inc. (G7HH3F8CAK)',
+    'Developer ID Application: Figma, Inc. (T8RA8NE3B7)',
+    'Developer ID Application: Google LLC (EQHXZ8M8AV)',
+    'Developer ID Application: CodeWeavers Inc. (9C6B7X7Z8E)',
+    'Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D)',
+    'Developer ID Application: Hashicorp, Inc. (D38WU7D763)',
+    'Developer ID Application: Logitech Inc. (QED4VVPZWA)',
+    'Developer ID Application: Microsoft Corporation (UBF8T346G9)',
+    'Developer ID Application: Objective Development Software GmbH (MLZF7K7B5R)',
+    'Developer ID Application: Objective-See, LLC (VBG97UB4TA)',
+    'Developer ID Application: Opal Camera Inc (97Z3HJWCRT)',
+    'Developer ID Application: Oracle America, Inc. (VB5E2TV963)',
+    'Developer ID Application: Oracle America, Inc. (VB5E2TV963)',
+    'Developer ID Application: Tenable, Inc. (4B8J598M7U)',
+    'Developer ID Application: Valve Corporation (MXGJJ98X76)',
+    'Developer ID Application: Wireshark Foundation, Inc. (7Z6EMTD2C6)',
+    'Apple iPhone OS Application Signing',
+    'Developer ID Application: Node.js Foundation (HX7739G8FX)',
+    'Software Signing'
+  )
+  AND homedir NOT LIKE '~/%/node_modules/.pnpm/esbuild-%/node_modules/esbuild-darwin-arm64/bin'
+  AND dirname NOT LIKE '/private/var/folders/%/d/Wrapper/%.app'
+  AND dirname NOT LIKE '/Applications/%.app/%'
+  AND dirname NOT LIKE '/Applications/Utilities/Adobe Creative Cloud/%'
+  AND dirname NOT LIKE '/Library/%/%.bundle/Contents/Helpers'
+  AND dirname NOT LIKE '/Library/%/Resources/%/Contents/MacOS'
+  AND dirname NOT LIKE '/Library/%/sbin' -- Nessus
+  AND dirname NOT LIKE '/Library/Apple/System/Library%'
+  AND dirname NOT LIKE '/Library/Application Support/%/Contents/MacOS'
+  AND dirname NOT LIKE '/Library/Application Support/Adobe/%'
+  AND dirname NOT LIKE '/Library/Audio/Plug-Ins/%/Contents/MacOS'
+  AND dirname NOT LIKE '/Library/CoreMediaIO/Plug-Ins/%'
+  AND dirname NOT LIKE '/Library/Developer/%'
+  AND dirname NOT LIKE '/Library/Developer/CommandLineTools/Library/%'
+  AND dirname NOT LIKE '/Library/Internet Plug-Ins/%/Contents/MacOS'
+  AND dirname NOT LIKE '/Library/Java/JavaVirtualMachines/%'
+  AND dirname NOT LIKE '/Library/Printers/%.app/Contents/MacOS'
+  AND dirname NOT LIKE '/Library/PrivilegedHelperTools/com.%'
+  AND dirname NOT LIKE '/nix/store/%'
+  AND dirname NOT LIKE '/opt/homebrew/Cellar/%/bin'
+  AND dirname NOT LIKE '/opt/homebrew/Cellar/%/libexec'
+  AND dirname NOT LIKE '/opt/homebrew/Cellar/%/libexec/%'
+  AND dirname NOT LIKE '/opt/homebrew/Cellar/%/Contents/MacOS'
+  AND dirname NOT LIKE '/opt/homebrew/Caskroom/%/bin'
+  AND dirname NOT LIKE '/private/tmp/%.app/Contents/MacOS'
+  AND dirname NOT LIKE '/private/tmp/go-build%/exe'
+  AND dirname NOT LIKE '/private/tmp/nix-build-%'
+  AND dirname NOT LIKE '/private/tmp/PKInstallSandbox.%/Scripts/com.microsoft.OneDrive.%'
+  AND dirname NOT LIKE '/private/var/db/com.apple.xpc.roleaccountd.staging/%.xpc/Contents/MacOS'
+  AND dirname NOT LIKE '/private/var/folders/%/bin'
+  AND dirname NOT LIKE '/private/var/folders/%/Contents/%'
+  AND dirname NOT LIKE '/private/var/folders/%/go-build%'
+  AND dirname NOT LIKE '/private/var/folders/%/GoLand'
+  AND dirname NOT LIKE '/System/%'
+  AND dirname NOT LIKE '/Users/%/bin/%'
+  AND dirname NOT LIKE '/Users/%/src/%'
+  AND dirname NOT LIKE '/usr/libexec/%'
+  AND dirname NOT LIKE '/usr/local/%'
+  AND NOT (
+    dirname LIKE '/private/var/%'
+    AND p.name LIKE 'pulumi-go.%'
+  ) -- Chrome executes patches from /tmp :(
+  AND NOT (
+    dirname LIKE '/private/tmp/%'
+    AND p.name = 'goobspatch'
+  )
+  AND NOT (
+    homedir = '~'
+    AND p.name = 'cloud_sql_proxy'
+  )