Skip to content

Commit 7af6b94

Browse files
AegrahAegrah
committed
[New Rule] Persistence via DPKG/RPM Package
1 parent 2ff2965 commit 7af6b94

File tree

4 files changed

+173
-0
lines changed

4 files changed

+173
-0
lines changed

‎hunting/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ Here are the queries currently available:
4040
- [OSQuery SUID Hunting](./linux/docs/privilege_escalation_via_suid_binaries.md) (ES|QL)
4141
- [Persistence Through Reverse/Bind Shells](./linux/docs/persistence_reverse_bind_shells.md) (ES|QL)
4242
- [Persistence via Cron](./linux/docs/persistence_via_cron.md) (ES|QL)
43+
- [Persistence via DPKG/RPM Package](./linux/docs/persistence_via_rpm_dpkg_installer_packages.md) (ES|QL)
4344
- [Persistence via Message-of-the-Day](./linux/docs/persistence_via_message_of_the_day.md) (ES|QL)
4445
- [Persistence via Package Manager](./linux/docs/persistence_via_package_manager.md) (ES|QL)
4546
- [Persistence via SSH Configurations and/or Keys](./linux/docs/persistence_via_ssh_configurations_and_keys.md) (ES|QL)

‎hunting/index.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,11 @@ linux:
220220
mitre:
221221
- T1037.004
222222
- T1546.003
223+
1d7cae97-2dea-4f01-b04c-85fa4bd991d0:
224+
name: Persistence via DPKG/RPM Package
225+
path: ./linux/queries/persistence_via_rpm_dpkg_installer_packages.toml
226+
mitre:
227+
- T1546.016
223228
okta:
224229
0b936024-71d9-11ef-a9be-f661ea17fbcc:
225230
name: Failed OAuth Access Token Retrieval via Public Client App

‎hunting/linux/docs/persistence_via_rpm_dpkg_installer_packages.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# Persistence via DPKG/RPM Package
2+
3+
---
4+
5+
## Metadata
6+
7+
- **Author:** Elastic
8+
- **Description:** This hunt identifies potential persistence mechanisms leveraging DPKG or RPM package managers on Linux systems. These tools, used for installing and managing software, can be exploited by attackers to execute malicious scripts or establish persistence via lifecycle scripts (preinst, postinst, prerm, postrm). This hunt focuses on detecting suspicious file creations and anomalous process activity related to these package managers.
9+
10+
- **UUID:** `1d7cae97-2dea-4f01-b04c-85fa4bd991d0`
11+
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
12+
- **Language:** `[ES|QL, SQL]`
13+
- **Source File:** [Persistence via DPKG/RPM Package](../queries/persistence_via_rpm_dpkg_installer_packages.toml)
14+
15+
## Query
16+
17+
```sql
18+
from logs-endpoint.events.file-*
19+
| keep @timestamp, host.os.type, event.action, file.path, file.name, agent.id, process.executable
20+
| where @timestamp > now() - 7 days
21+
| where host.os.type == "linux" and event.action in ("rename", "creation") and (
22+
file.path like "/var/lib/dpkg/info/*" or
23+
file.path like "/var/lib/rpm/*"
24+
) and not (
25+
// Remove these exclusions if you have a high suspicion of this activity
26+
// Add additional exclusions here if necessary based on your environment
27+
file.name like "*-new" or
28+
file.name like "__db*.*" or
29+
file.name like "*.list" or
30+
file.name like "*.md5sums*"
31+
)
32+
| stats cc = count(), agent_count = count_distinct(agent.id) by file.name, process.executable
33+
| where agent_count <= 3
34+
| sort cc asc
35+
| limit 100
36+
```
37+
38+
```sql
39+
from logs-endpoint.events.process-*
40+
| keep @timestamp, host.os.type, event.type, event.action, process.parent.command_line, process.parent.executable, agent.id, process.executable, process.command_line
41+
| where @timestamp > now() - 7 days
42+
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
43+
process.parent.command_line like "*/var/tmp/rpm-tmp.*" or
44+
process.parent.executable like "/var/lib/dpkg/info/*"
45+
)
46+
| stats cc = count(), agent_count = count_distinct(agent.id) by process.executable, process.command_line
47+
| where agent_count <= 3
48+
| sort cc asc
49+
| limit 100
50+
```
51+
52+
```sql
53+
SELECT
54+
f.filename,
55+
f.path,
56+
u.username AS file_owner,
57+
g.groupname AS group_owner,
58+
datetime(f.atime, 'unixepoch') AS file_last_access_time,
59+
datetime(f.mtime, 'unixepoch') AS file_last_modified_time,
60+
datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,
61+
datetime(f.btime, 'unixepoch') AS file_created_time,
62+
f.size AS size_bytes
63+
FROM
64+
file f
65+
LEFT JOIN
66+
users u ON f.uid = u.uid
67+
LEFT JOIN
68+
groups g ON f.gid = g.gid
69+
WHERE (
70+
f.path LIKE '/var/lib/dpkg/info/%'
71+
OR f.path LIKE '/var/lib/rpm/%'
72+
)
73+
AND (mtime > strftime('%s', 'now') - (7 * 86400)); -- Modified in the last 7 days
74+
```
75+
76+
## Notes
77+
78+
- Monitors for the creation or renaming of files in directories associated with DPKG and RPM package managers, such as /var/lib/dpkg/info/ and /var/lib/rpm/.
79+
- Excludes common benign file patterns (e.g., temporary files, checksum files, or list files) to reduce noise while detecting unusual modifications.
80+
- Analyzes processes executed from lifecycle scripts or directories associated with package managers, such as /var/tmp/rpm-tmp.* and /var/lib/dpkg/info/*.
81+
- Uses OSQuery queries to gather detailed metadata on files and directories modified by package management activities for forensic analysis.
82+
- Provides counts and statistics to help highlight rare or unusual package management-related activity.
83+
84+
## MITRE ATT&CK Techniques
85+
86+
- [T1546.016](https://attack.mitre.org/techniques/T1546/016)
87+
88+
## License
89+
90+
- `Elastic License v2`

‎hunting/linux/queries/persistence_via_rpm_dpkg_installer_packages.toml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
[hunt]
2+
author = "Elastic"
3+
description = """
4+
This hunt identifies potential persistence mechanisms leveraging DPKG or RPM package managers on Linux systems. These tools, used for installing and managing software, can be exploited by attackers to execute malicious scripts or establish persistence via lifecycle scripts (preinst, postinst, prerm, postrm). This hunt focuses on detecting suspicious file creations and anomalous process activity related to these package managers.
5+
"""
6+
integration = ["endpoint"]
7+
uuid = "1d7cae97-2dea-4f01-b04c-85fa4bd991d0"
8+
name = "Persistence via DPKG/RPM Package"
9+
language = ["ES|QL", "SQL"]
10+
license = "Elastic License v2"
11+
notes = [
12+
"Monitors for the creation or renaming of files in directories associated with DPKG and RPM package managers, such as /var/lib/dpkg/info/ and /var/lib/rpm/.",
13+
"Excludes common benign file patterns (e.g., temporary files, checksum files, or list files) to reduce noise while detecting unusual modifications.",
14+
"Analyzes processes executed from lifecycle scripts or directories associated with package managers, such as /var/tmp/rpm-tmp.* and /var/lib/dpkg/info/*.",
15+
"Uses OSQuery queries to gather detailed metadata on files and directories modified by package management activities for forensic analysis.",
16+
"Provides counts and statistics to help highlight rare or unusual package management-related activity."
17+
]
18+
mitre = ["T1546.016"]
19+
20+
query = [
21+
'''
22+
from logs-endpoint.events.file-*
23+
| keep @timestamp, host.os.type, event.action, file.path, file.name, agent.id, process.executable
24+
| where @timestamp > now() - 7 days
25+
| where host.os.type == "linux" and event.action in ("rename", "creation") and (
26+
file.path like "/var/lib/dpkg/info/*" or
27+
file.path like "/var/lib/rpm/*"
28+
) and not (
29+
// Remove these exclusions if you have a high suspicion of this activity
30+
// Add additional exclusions here if necessary based on your environment
31+
file.name like "*-new" or
32+
file.name like "__db*.*" or
33+
file.name like "*.list" or
34+
file.name like "*.md5sums*"
35+
)
36+
| stats cc = count(), agent_count = count_distinct(agent.id) by file.name, process.executable
37+
| where agent_count <= 3
38+
| sort cc asc
39+
| limit 100
40+
''',
41+
'''
42+
from logs-endpoint.events.process-*
43+
| keep @timestamp, host.os.type, event.type, event.action, process.parent.command_line, process.parent.executable, agent.id, process.executable, process.command_line
44+
| where @timestamp > now() - 7 days
45+
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
46+
process.parent.command_line like "*/var/tmp/rpm-tmp.*" or
47+
process.parent.executable like "/var/lib/dpkg/info/*"
48+
)
49+
| stats cc = count(), agent_count = count_distinct(agent.id) by process.executable, process.command_line
50+
| where agent_count <= 3
51+
| sort cc asc
52+
| limit 100
53+
''',
54+
'''
55+
SELECT
56+
f.filename,
57+
f.path,
58+
u.username AS file_owner,
59+
g.groupname AS group_owner,
60+
datetime(f.atime, 'unixepoch') AS file_last_access_time,
61+
datetime(f.mtime, 'unixepoch') AS file_last_modified_time,
62+
datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,
63+
datetime(f.btime, 'unixepoch') AS file_created_time,
64+
f.size AS size_bytes
65+
FROM
66+
file f
67+
LEFT JOIN
68+
users u ON f.uid = u.uid
69+
LEFT JOIN
70+
groups g ON f.gid = g.gid
71+
WHERE (
72+
f.path LIKE '/var/lib/dpkg/info/%'
73+
OR f.path LIKE '/var/lib/rpm/%'
74+
)
75+
AND (mtime > strftime('%s', 'now') - (7 * 86400)); -- Modified in the last 7 days
76+
'''
77+
]

0 commit comments

Comments
 (0)