-
Notifications
You must be signed in to change notification settings - Fork 160
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
adding new rules based on private Linux sample(s)
- Loading branch information
1 parent
a20c17d
commit e78708c
Showing
17 changed files
with
109 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,7 +1,7 @@ | ||
rule: | ||
meta: | ||
name: get current user on Linux | ||
namespace: collection | ||
namespace: host-interaction/session | ||
authors: | ||
- [email protected] | ||
scope: function | ||
|
@@ -13,9 +13,8 @@ rule: | |
- and: | ||
- os: linux | ||
- or: | ||
- and: | ||
- api: geteuid | ||
- api: getpwuid | ||
- api: geteuid | ||
- api: getpwuid | ||
- api: getlogin | ||
- api: getlogin_r | ||
- api: cuserid |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
13 changes: 13 additions & 0 deletions
13
nursery/communicate-with-kernel-module-via-netlink-socket-on-linux.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
rule: | ||
meta: | ||
name: communicate with kernel module via Netlink socket on Linux | ||
namespace: host-interaction/kernel | ||
authors: | ||
- [email protected] | ||
description: Netlink is used to transfer information between the kernel and user-space processes (https://man7.org/linux/man-pages/man7/netlink.7.html) | ||
scope: basic block | ||
features: | ||
- and: | ||
- os: linux | ||
- api: socket | ||
- number: 0x10 = AF_NETLINK |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
rule: | ||
meta: | ||
name: create detached thread on Linux | ||
namespace: host-interaction/thread | ||
authors: | ||
- [email protected] | ||
scope: basic block | ||
features: | ||
- and: | ||
- os: linux | ||
- api: pthread_detach |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
rule: | ||
meta: | ||
name: get current PID on Linux | ||
namespace: host-interaction/process | ||
authors: | ||
- [email protected] | ||
scope: basic block | ||
features: | ||
- and: | ||
- os: linux | ||
- or: | ||
- api: getpid | ||
- api: getppid |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
rule: | ||
meta: | ||
name: get file system information on Linux | ||
namespace: host-interaction/file-system | ||
authors: | ||
- [email protected] | ||
scope: basic block | ||
features: | ||
- and: | ||
- os: linux | ||
- or: | ||
- api: statfs | ||
- api: fstatfs |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -4,6 +4,7 @@ rule: | |
namespace: host-interaction/os/info | ||
authors: | ||
- [email protected] | ||
- [email protected] | ||
scope: function | ||
att&ck: | ||
- Discovery::System Information Discovery [T1082] | ||
|
@@ -15,3 +16,4 @@ rule: | |
- and: | ||
- api: system | ||
- string: "lshw" | ||
- api: sysinfo |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
rule: | ||
meta: | ||
name: get user database entry on Linux | ||
namespace: host-interaction/session | ||
authors: | ||
- [email protected] | ||
scope: basic block | ||
features: | ||
- and: | ||
- os: linux | ||
- or: | ||
- api: getpwuid | ||
- api: getpwuid_r |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
rule: | ||
meta: | ||
name: persist via GNOME autostart on Linux | ||
namespace: persistence | ||
authors: | ||
- [email protected] | ||
scope: function | ||
features: | ||
- and: | ||
- os: linux | ||
- match: host-interaction/file-system/write | ||
- substring: "X-GNOME-Autostart-enabled=true" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
rule: | ||
meta: | ||
name: set thread name on Linux | ||
namespace: host-interaction/thread | ||
authors: | ||
- [email protected] | ||
scope: basic block | ||
features: | ||
- and: | ||
- os: linux | ||
- or: | ||
- api: pthread_setname_np | ||
- and: | ||
- api: prctl | ||
- number: 0xF = PR_SET_NAME |