osquery-defense-kit/detection/evasion/hidden-cwd.sql

115 lines
2.8 KiB
SQL

-- Programs running with a hidden current working directory (state-based)
--
-- false positives:
-- * Users rummaging through their configuration files
--
-- references:
-- * https://attack.mitre.org/techniques/T1564/001/ (Hide Artifacts: Hidden Files and Directories)
--
-- tags: transient often
-- platform: posix
SELECT
p.pid,
p.path,
p.name,
p.cmdline,
p.cwd,
p.euid,
p.parent,
pp.path AS parent_path,
pp.name AS parent_name,
pp.cmdline AS parent_cmdline,
pp.cwd AS parent_cwd,
pp.euid AS parent_euid,
hash.sha256,
REPLACE(p.cwd, u.directory, '~') AS dir,
CONCAT (
p.name,
',',
IIF(
REGEX_MATCH (
REPLACE(p.cwd, u.directory, '~'),
'([/~].*?/.*?/.*?)/',
1
) != '',
REGEX_MATCH (
REPLACE(p.cwd, u.directory, '~'),
'([/~].*?/.*?/.*?)/',
1
),
REPLACE(p.cwd, u.directory, '~')
)
) AS exception_key
FROM
processes p
LEFT JOIN processes pp ON p.parent = pp.pid
LEFT JOIN users u ON p.uid = u.uid
LEFT JOIN hash ON p.path = hash.path
WHERE
dir LIKE '%/.%'
AND NOT (
exception_key IN (
'bash,~/.local/share',
'bash,~/go/src',
'Electron,~/.vscode/extensions',
'fish,~/.local/share',
'git,~/.local/share',
'makepkg,~/.cache/yay',
'zsh,~/.Trash',
'bash,~/.Trash',
'fish,~/.Trash',
'make,~/.cache/yay',
'java,~/.gradle/daemon',
'java,~/.local/share',
'rust-analyzer-p,~/.cargo/registry',
'as,~/.cache/yay',
'c++,~/.cache/yay',
'cc1plus,~/.cache/yay',
'npm install,~/.npm/_cacache',
'mysqld,~/.local/share'
)
OR exception_key LIKE '%sh,~/.Trash/%'
OR dir IN (
'~/.config',
'~/.local/bin',
'~/.vim',
'~/.terraform.d',
'~/.cache/yay',
'~/.local/share/chezmoi',
'~/.local/share/nvim',
'~/.gmailctl',
'~/.zsh'
)
OR p.name IN (
'bindfs',
'vim',
'nvim',
'code',
'updatedb',
'git',
'gitsign',
'Code Helper'
)
OR dir LIKE '~/.cache/yay/%'
OR dir LIKE '~/.cargo/%'
OR dir LIKE '~/code/%'
OR dir LIKE '~/.dotfiles/%'
OR dir LIKE '~/%/.github%'
OR dir LIKE '~/go/src/%'
OR dir LIKE '~/.gradle/%'
OR dir LIKE '/Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/%'
OR dir LIKE '~/.local/share/fish/%'
OR dir LIKE '~/.local/share/JetBrains/%'
OR dir LIKE '~/.local/share/kotlin/%'
OR dir LIKE '~/.local/share/nvim/%'
OR dir LIKE '~/.local/share/Steam/%'
OR dir LIKE '~/.provisio%'
OR dir LIKE '~/src/%'
OR dir LIKE '~/%/.terraform%'
OR dir LIKE '~/.vscode/extensions/%'
OR dir LIKE '~/.zsh/%'
OR dir LIKE '~/%/.git'
-- For sudo calls to other things
OR (dir LIKE '/home/.terraform.d/%' AND p.euid = 0)
)