Merge pull request #442 from TcM1911/linux-rules

A set of rules for Linux ELFs

c2/shell/create-unix-reverse-shell.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: create unix reverse shell
+    namespace: c2/shell
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Execution::Command and Scripting Interpreter::Unix Shell [T1059.004]
+    mbc:
+      - Impact::Remote Access::Reverse Shell [B0022.001]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x40231E
+  features:
+    - or:
+      - and:
+        - match: duplicate stdin and stdout
+        - match: create process

c2/shell/execute-shell-command-received-from-socket.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: execute shell command received from socket
+    namespace: c2/shell
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Execution::Command and Scripting Interpreter::Unix Shell [T1059.004]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x406549
+  features:
+    - and:
+      - match: receive data on socket
+      - api: system

collection/get-current-user.yml

@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: get current user
+    namespace: collection
+    author: [email protected]
+    scope: function
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x405438
+  features:
+    - or:
+      - and:
+        - api: geteuid
+        - api: getpwuid
+      - api: getlogin
+      - api: getlogin_r
+      - api: cuserid

collection/network/get-mac-address.yml

@@ -2,21 +2,27 @@ rule:
   meta:
     name: get MAC address
     namespace: collection/network
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     att&ck:
       - Discovery::System Information Discovery [T1082]
     examples:
       - al-khaser_x64.exe_:0x14001A1BC
   features:
-    - and:
-      - api: iphlpapi.GetAdaptersInfo
-      - or:
-        - offset: 0x194 = IP_ADAPTER_INFO.Address
-        - offset: 0x195 = IP_ADAPTER_INFO.Address+1
-        - offset: 0x196 = IP_ADAPTER_INFO.Address+2
-        - offset: 0x197 = IP_ADAPTER_INFO.Address+3
-        - offset: 0x198 = IP_ADAPTER_INFO.Address+4
-        - offset: 0x199 = IP_ADAPTER_INFO.Address+5
-      - optional:
-        - string: "%02X-%02X-%02X-%02X-%02X-%02X"
+    - or:
+      - and:
+        - api: iphlpapi.GetAdaptersInfo
+        - or:
+          - offset: 0x194 = IP_ADAPTER_INFO.Address
+          - offset: 0x195 = IP_ADAPTER_INFO.Address+1
+          - offset: 0x196 = IP_ADAPTER_INFO.Address+2
+          - offset: 0x197 = IP_ADAPTER_INFO.Address+3
+          - offset: 0x198 = IP_ADAPTER_INFO.Address+4
+          - offset: 0x199 = IP_ADAPTER_INFO.Address+5
+        - optional:
+          - string: "%02X-%02X-%02X-%02X-%02X-%02X"
+      - and:
+        - match: read file
+        - string: /\/sys\/class\/net\/\S+\/address/

communication/socket/receive/receive-data-on-socket.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: receive data on socket
     namespace: communication/socket/receive
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     mbc:
       - Communication::Socket Communication::Receive Data [C0001.006]
@@ -17,3 +19,4 @@ rule:
       - api: ws2_32.WSARecvEx
       - api: ws2_32.WSARecvFrom
       - api: ws2_32.WSARecvMsg
+      - api: recv

communication/socket/send/send-data-on-socket.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: send data on socket
     namespace: communication/socket/send
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     mbc:
       - Communication::Socket Communication::Send Data [C0001.007]
@@ -15,3 +17,4 @@ rule:
       - api: ws2_32.WSASend
       - api: ws2_32.WSASendMsg
       - api: ws2_32.WSASendTo
+      - api: send

communication/socket/tcp/connect-tcp-socket.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: connect TCP socket
     namespace: communication/socket/tcp
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     mbc:
       - Communication::Socket Communication::Connect Socket [C0001.004]
@@ -12,6 +14,7 @@ rule:
     - and:
       - match: create TCP socket
       - or:
+        - api: connect
         - api: ws2_32.connect
         - api: ws2_32.WSAConnect
         - api: ConnectEx

communication/socket/tcp/create-tcp-socket.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: create TCP socket
     namespace: communication/socket/tcp
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: basic block
     mbc:
       - Communication::Socket Communication::Create TCP Socket [C0001.011]
@@ -16,3 +18,4 @@ rule:
       - or:
         - api: ws2_32.socket
         - api: ws2_32.WSASocket
+        - api: socket

communication/socket/udp/send/create-udp-socket.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: create UDP socket
     namespace: communication/socket/udp/send
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: basic block
     mbc:
       - Communication::Socket Communication::Create UDP Socket [C0001.010]
@@ -14,3 +16,4 @@ rule:
       - or:
         - api: ws2_32.socket
         - api: ws2_32.WSASocket
+        - api: socket

host-interaction/file-system/change-file-permission.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: change file permission
+    namespace: host-interaction/file-system
+    author: [email protected]
+    scope: basic block
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x407C68
+  features:
+    - or:
+      - api: chown
+      - api: fchown
+      - api: lchown
+      - api: fchownat

host-interaction/file-system/read/read-file.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: read file
     namespace: host-interaction/file-system/read
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     mbc:
       - File System::Read File [C0051]
@@ -23,3 +25,19 @@ rule:
           - api: ZwReadFile
           - api: _read
           - api: fread
+      - and:
+        - optional:
+          - match: create or open file
+        - or:
+          - api: fgetc
+          - api: fgets
+          - api: getc
+          - api: getchar
+          - api: read
+          - api: getline
+          - api: getdelim
+          - api: fgetwc
+          - api: getwc
+          - api: fscanf
+          - api: vfscanf
+          - api: fread

host-interaction/file-system/write/write-file.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: write file
     namespace: host-interaction/file-system/write
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     mbc:
       - File System::Writes File [C0052]
@@ -11,22 +13,37 @@ rule:
       # ntdll
       - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4
   features:
-    - and:
-      - optional:
+    - or:
+      - and:
+        - optional:
+          - or:
+            - and:
+              - number: 0x40000000 = GENERIC_WRITE
+              - or:
+                - api: kernel32.CreateFile
+            - and:
+              - number: 0x2 = FILE_WRITE_DATA
+              - or:
+                - api: NtCreateFile
+                - api: ZwCreateFile
         - or:
-          - and:
-            - number: 0x40000000 = GENERIC_WRITE
-            - or:
-              - api: kernel32.CreateFile
-          - and:
-            - number: 0x2 = FILE_WRITE_DATA
-            - or:
-              - api: NtCreateFile
-              - api: ZwCreateFile
-      - or:
-        - api: kernel32.WriteFile
-        - api: kernel32.WriteFileEx
-        - api: NtWriteFile
-        - api: ZwWriteFile
-        - api: _fwrite
-        - api: fwrite
+          - api: kernel32.WriteFile
+          - api: kernel32.WriteFileEx
+          - api: NtWriteFile
+          - api: ZwWriteFile
+          - api: _fwrite
+          - api: fwrite
+      - and:
+        - optional:
+          - match: create or open file
+        - or:
+          - api: fputc
+          - api: fputs
+          - api: putc
+          - api: write
+          - api: fputwc
+          - api: putwc
+          - api: fputws
+          - api: write
+          - api: fwrite
+          - api: putwchar

host-interaction/hardware/cpu/get-cpu-information.yml

@@ -2,13 +2,22 @@ rule:
   meta:
     name: get CPU information
     namespace: host-interaction/hardware/cpu
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     att&ck:
       - Discovery::System Information Discovery [T1082]
     examples:
       - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A
   features:
-    - and:
-      - match: query or enumerate registry value
-      - string: /Hardware\\Description\\System\\CentralProcessor/i
+    - or:
+      - and:
+        - match: query or enumerate registry value
+        - string: /Hardware\\Description\\System\\CentralProcessor/i
+      - and:
+        - match: read file
+        - string: "/proc/cpuinfo"
+      - and:
+        - api: system
+        - string: /\/proc\/cpuinfo/

host-interaction/hardware/memory/get-memory-information.yml

@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: get memory information
+    namespace: host-interaction/hardware/memory
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Discovery::System Information Discovery [T1082]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x405438
+  features:
+    - or:
+      - and:
+        - match: read file
+        - string: "/proc/meminfo"
+      - and:
+        - api: system
+        - or:
+          - string: /\/proc\/meminfo/
+          - string: /^free/

host-interaction/mutex/lock-file.yml

@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: lock file
+    namespace: host-interaction/mutex
+    author: [email protected]
+    scope: basic block
+    mbc:
+      - Process::Create Mutex [C0042]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x40858F
+  features:
+    - and:
+      - api: fcntl
+      - number: 1 = F_WRLCK
+      - number: 6 = F_SETLK

host-interaction/network/address/get-local-ipv4-addresses.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: get local IPv4 addresses
     namespace: host-interaction/network/address
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     att&ck:
       - Discovery::System Network Configuration Discovery [T1016]
@@ -11,6 +13,7 @@ rule:
       - 4C0553285D724DCAF5909924B4E3E90A:0x402010
   features:
     - or:
+      - api: getsockname
       - and:
         - api: GetAdaptersInfo
         - offset: 0x1B0 = IP_ADAPTER_INFO.IpAddressList.IpAddress

host-interaction/network/dns/resolve/resolve-dns.yml

@@ -5,6 +5,7 @@ rule:
     author:
       - [email protected]
       - johnk3r
+      - [email protected]
     scope: function
     mbc:
       - Communication::DNS Communication::Resolve [C0011.001]
@@ -20,3 +21,7 @@ rule:
       - api: getaddrinfo
       - api: GetAddrInfo
       - api: GetAddrInfoEx
+      - api: gethostbyname
+      - api: getaddrinfo
+      - api: getnameinfo
+      - api: gethostent

host-interaction/network/interface/get-networking-interfaces.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: get networking interfaces
     namespace: host-interaction/network/interface
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     att&ck:
       - Discovery::System Network Configuration Discovery [T1016]
@@ -12,3 +14,4 @@ rule:
     - or:
       - api: iphlpapi.GetIfTable
       - api: iphlpapi.GetAdaptersInfo
+      - api: getifaddrs

host-interaction/os/hostname/get-hostname.yml

@@ -2,15 +2,19 @@ rule:
   meta:
     name: get hostname
     namespace: host-interaction/os/hostname
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     att&ck:
       - Discovery::System Information Discovery [T1082]
     examples:
       - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0
+      - 7351f8a40c5450557b24622417fc478d:0x405438
   features:
     - or:
       - api: kernel32.GetComputerName
       - api: kernel32.GetComputerNameEx
       - api: GetComputerObjectName
       - api: ws2_32.gethostname
+      - api: gethostname

host-interaction/os/info/get-system-information.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: get system information
     namespace: host-interaction/os/info
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     att&ck:
       - Discovery::System Information Discovery [T1082]
@@ -17,3 +19,7 @@ rule:
       - api: ntdll.RtlGetNativeSystemInformation
       - api: ZwQuerySystemInformation
       - api: ZwQuerySystemInformationEx
+      - api: sysconf
+      - and:
+        - api: system
+        - string: "lshw"

host-interaction/os/version/get-kernel-version.yml

@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: get kernel version
+    namespace: host-interaction/os/version
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Discovery::System Information Discovery [T1082]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x405438
+  features:
+    - or:
+      - and:
+        - api: system
+        - string: "uname"
+      - api: uname

host-interaction/os/version/get-linux-distribution.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: get Linux distribution
+    namespace: host-interaction/os/version
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Discovery::System Information Discovery [T1082]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x405438
+  features:
+    - and:
+      - or:
+        - string: "/etc/os-release"
+        - string: "/etc/lsb-release"
+        - string: "/etc/issue"
+      - match: read file

host-interaction/process/create/create-process.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: create process
     namespace: host-interaction/process/create
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: basic block
     mbc:
       - Process::Create Process [C0017]
@@ -26,3 +28,13 @@ rule:
       - api: ZwCreateProcessEx
       - api: ntdll.ZwCreateUserProcess
       - api: ntdll.RtlCreateUserProcess
+      - api: execve
+      - api: execl
+      - api: execlp
+      - api: execle
+      - api: execv
+      - api: execvp
+      - api: execvpe
+      - api: posix_spawn
+      - api: posix_spawnp
+      - api: popen

host-interaction/process/terminate/terminate-process-via-kill.yml

@@ -0,0 +1,21 @@
+rule:
+  meta:
+    name: terminate process via kill
+    namespace: host-interaction/process/terminate
+    author: [email protected]
+    scope: basic block
+    mbc:
+      - Process::Terminate Process [C0018]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x402424
+  features:
+    - and:
+      - api: kill
+      - or:
+        - number: 1 = SIGHUP - controlling terminal closed
+        - number: 2 = SIGINT - interupt process stream, ctrl-C
+        - number: 3 = SIGQUIT - like ctrl-C but with a core dump
+        - number: 6 = SIGABRT
+        - number: 9 = SIGKILL - terminate immediately/hard kill
+        - number: 15 = SIGTERM - terminate whenever/soft kill
+        - number: 19 = SIGSTOP - Pause the process / free command line, ctrl-Z

host-interaction/thread/create/create-thread.yml

@@ -5,6 +5,7 @@ rule:
     author:
       - [email protected]
       - [email protected]
+      - [email protected]
     scope: basic block
     mbc:
       - Process::Create Thread [C0038]
@@ -26,3 +27,4 @@ rule:
       - api: ntdll.NtCreateThreadEx
       - api: ntdll.ZwCreateThread
       - api: ntdll.ZwCreateThreadEx
+      - api: pthread_create

lib/create-or-open-file.yml

@@ -1,7 +1,9 @@
 rule:
   meta:
     name: create or open file
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     lib: true
     scope: basic block
     mbc:
@@ -18,3 +20,9 @@ rule:
       - api: ZwCreateFile
       - api: NtOpenFile
       - api: NtCreateFile
+      - api: fopen
+      - api: fopen64
+      - api: fdopen
+      - api: freopen
+      - api: open
+      - api: openat

lib/duplicate-stdin-and-stdout.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: duplicate stdin and stdout
+    author: [email protected]
+    lib: true
+    scope: basic block
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x40236D
+  features:
+    - and:
+      - api: dup2
+      - number: 0 = STDIN
+      - number: 1 = STDOUT

linking/runtime-linking/link-function-at-runtime.yml

@@ -2,7 +2,9 @@ rule:
   meta:
     name: link function at runtime
     namespace: linking/runtime-linking
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     att&ck:
       - Execution::Shared Modules [T1129]
@@ -10,14 +12,22 @@ rule:
       - 9324D1A8AE37A36AE560C37448C9705A:0x404130
       - Practical Malware Analysis Lab 01-04.exe_:0x401350
   features:
-    - and:
-      - or:
-        - api: kernel32.LoadLibrary
-        - api: kernel32.GetModuleHandle
-        - api: kernel32.GetModuleHandleEx
-        - api: ntdll.LdrLoadDll
-      - or:
-        - api: kernel32.GetProcAddress
-        - api: ntdll.LdrGetProcedureAddress
-      - optional:
-        - characteristic: indirect call
+    - or:
+      - and:
+        - or:
+          - api: kernel32.LoadLibrary
+          - api: kernel32.GetModuleHandle
+          - api: kernel32.GetModuleHandleEx
+          - api: ntdll.LdrLoadDll
+        - or:
+          - api: kernel32.GetProcAddress
+          - api: ntdll.LdrGetProcedureAddress
+        - optional:
+          - characteristic: indirect call
+      - and:
+        - or:
+          - api: dlopen
+          - api: dlmopen
+        - or:
+          - api: dlsym
+          - api: dlvsym

linking/runtime-linking/link-many-functions-at-runtime.yml

@@ -2,19 +2,29 @@ rule:
   meta:
     name: link many functions at runtime
     namespace: linking/runtime-linking
-    author: [email protected]
+    author:
+      - [email protected]
+      - [email protected]
     scope: function
     att&ck:
       - Execution::Shared Modules [T1129]
     examples:
       - b7b5e1253710d8927cbe07d52d2d2e10:0x401000
   features:
-    - and:
-      - or:
-        - api: kernel32.LoadLibrary
-        - api: kernel32.GetModuleHandle
-        - api: kernel32.GetModuleHandleEx
-        - api: ntdll.LdrLoadDll
-      - or:
-        - count(api(kernel32.GetProcAddress)): 5 or more
-        - count(api(ntdll.LdrGetProcedureAddress)): 5 or more
+    - or:
+      - and:
+        - or:
+          - api: kernel32.LoadLibrary
+          - api: kernel32.GetModuleHandle
+          - api: kernel32.GetModuleHandleEx
+          - api: ntdll.LdrLoadDll
+        - or:
+          - count(api(kernel32.GetProcAddress)): 5 or more
+          - count(api(ntdll.LdrGetProcedureAddress)): 5 or more
+      - and:
+        - or:
+          - api: dlopen
+          - api: dlmopen
+        - or:
+          - count(api(dlsym)): 5 or more
+          - count(api(dlvsym)): 5 or more

nursery/capture-network-configuration-via-ifconfig.yml

@@ -0,0 +1,12 @@
+rule:
+  meta:
+    name: capture network configuration via ifconfig
+    namespace: collection/network
+    author: [email protected]
+    scope: basic block
+    att&ck:
+      - Discovery::System Network Configuration Discovery [T1016]
+  features:
+    - and:
+      - string: /ifconfig/
+      - api: system

nursery/collect-ssh-keys.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: collect ssh keys
+    namespace: collection
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Credential Access::Unsecured Credentials::Private Keys [T1552.004]
+  features:
+    - and:
+      - match: read file
+      - or:
+        - string: /\/\.ssh\/id_rsa/

nursery/enumerate-processes-via-procfs.yml

@@ -0,0 +1,21 @@
+rule:
+  meta:
+    name: enumerate processes via procfs
+    namespace: host-interaction/process/list
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Discovery::Process Discovery [T1057]
+      - Discovery::Software Discovery [T1518]
+  features:
+    - and:
+      - string: "/proc"
+      - or:
+        - and:
+          - match: create or open file
+          - or:
+            - api: getdents
+            - api: getdents64
+        - and:
+          - api: opendir
+          - api: readdir

nursery/interact-with-iptables.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: interact with iptables
+    namespace: host-interaction/firewall
+    author: [email protected]
+    scope: basic block
+    att&ck:
+      - Discovery::Software Discovery::Security Software Discovery [T1518.001]
+      - Defense Evasion::Impair Defenses::Disable or Modify System Firewall [T1562.004]
+  features:
+    - and:
+      - api: system
+      - string: /iptables/

persistence/persist-via-desktop-autostart.yml

@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: persist via .desktop autostart
+    namespace: persistence
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Persistence::Boot or Logon Autostart Execution::XDG Autostart Entries [T1547.013]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x407D11
+  features:
+    - and:
+      - match: write file
+      - or:
+        - string: /\/\.config\/autostart\/.+\.desktop/
+        - string: /\/etc\/xdg\/autostart/

persistence/persist-via-shell-profile-or-rc-file.yml

@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: persist via shell profile or rc file
+    namespace: persistence
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Persistence::Event Triggered Execution::Unix Shell Configuration Modification [T1546.004]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x407D11
+  features:
+    - and:
+      - match: write file
+      - or:
+        - string: /\/\.bash_profile/
+        - string: /\/\.bash_login/
+        - string: /\/\.bashrc/
+        - string: /\/\.profile/
+        - string: "/etc/profile"
+        - string: /\/etc\/profile\.d\//

persistence/service/persist-via-rc-script.yml

@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: persist via rc script
+    namespace: persistence/service
+    author: [email protected]
+    scope: function
+    att&ck:
+      - Persistence::Boot or Logon Initialization Scripts::RC Scripts [T1037.004]
+    examples:
+      - 7351f8a40c5450557b24622417fc478d:0x407D11
+  features:
+    - and:
+      - match: write file
+      - or:
+        - string: /\/etc\/init.d\//
+        - string: /\/etc\/rc[0-9].d\//