Skip to content

Commit 8024191

Browse files
AegrahAegrah
authored
[New Hunt] Persistence via Desktop Bus (D-Bus) (#4407)
1 parent 1aea556 commit 8024191

File tree

4 files changed

+179
-0
lines changed

4 files changed

+179
-0
lines changed

‎hunting/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ Here are the queries currently available:
4343
- [Persistence Through Reverse/Bind Shells](./linux/docs/persistence_reverse_bind_shells.md) (ES|QL)
4444
- [Persistence via Cron](./linux/docs/persistence_via_cron.md) (ES|QL)
4545
- [Persistence via DPKG/RPM Package](./linux/docs/persistence_via_rpm_dpkg_installer_packages.md) (ES|QL)
46+
- [Persistence via Desktop Bus (D-Bus)](./linux/docs/persistence_via_desktop_bus.md) (ES|QL)
4647
- [Persistence via Docker Container](./linux/docs/persistence_via_malicious_docker_container.md) (ES|QL)
4748
- [Persistence via Dynamic Linker Hijacking](./linux/docs/persistence_via_dynamic_linker_hijacking.md) (ES|QL)
4849
- [Persistence via GRUB Bootloader](./linux/docs/persistence_via_grub_bootloader.md) (ES|QL)

‎hunting/index.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,11 @@ linux:
250250
path: ./linux/queries/persistence_via_malicious_docker_container.toml
251251
mitre:
252252
- T1610
253+
2223bbda-b931-4f33-aeb4-0e0732a370dd:
254+
name: Persistence via Desktop Bus (D-Bus)
255+
path: ./linux/queries/persistence_via_desktop_bus.toml
256+
mitre:
257+
- T1543
253258
4e8a17d3-9139-4b45-86d5-79e8d1eba71e:
254259
name: Persistence via PolicyKit
255260
path: ./linux/queries/persistence_via_policykit.toml

‎hunting/linux/docs/persistence_via_desktop_bus.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Persistence via Desktop Bus (D-Bus)
2+
3+
---
4+
5+
## Metadata
6+
7+
- **Author:** Elastic
8+
- **Description:** This hunt identifies potential persistence mechanisms leveraging the Desktop Bus (D-Bus) system on Linux. D-Bus is an inter-process communication (IPC) system that facilitates communication between various system components and applications. Attackers can exploit D-Bus by creating or modifying services, configuration files, or system policies to maintain persistence or execute unauthorized actions. This hunt monitors suspicious process activity related to D-Bus, tracks changes to key D-Bus configuration and service files, and retrieves metadata for further analysis. The approach helps analysts identify and respond to persistence techniques targeting D-Bus.
9+
10+
- **UUID:** `2223bbda-b931-4f33-aeb4-0e0732a370dd`
11+
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
12+
- **Language:** `[ES|QL, SQL]`
13+
- **Source File:** [Persistence via Desktop Bus (D-Bus)](../queries/persistence_via_desktop_bus.toml)
14+
15+
## Query
16+
17+
```sql
18+
sql
19+
from logs-endpoint.events.process-*
20+
| keep @timestamp, host.os.type, event.type, event.action, process.name, process.parent.name, process.command_line, process.executable, process.parent.executable, agent.id
21+
| where @timestamp > now() - 30 day
22+
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
23+
process.parent.name == "dbus-daemon" or process.name == "dbus-send"
24+
)
25+
| stats cc = count(), agent_count = count_distinct(agent.id) by process.command_line, process.executable, process.parent.executable
26+
| where agent_count <= 3 and cc < 15
27+
| sort cc asc
28+
| limit 100
29+
```
30+
31+
```sql
32+
sql
33+
from logs-endpoint.events.file-*
34+
| keep @timestamp, host.os.type, event.type, event.action, file.path, file.extension, process.name, process.executable, agent.id
35+
| where @timestamp > now() - 30 day
36+
| where host.os.type == "linux" and event.type in ("creation", "change") and (
37+
file.path like "/usr/share/dbus-1/*" or
38+
file.path like "/usr/local/share/dbus-1/*" or
39+
file.path like "/etc/dbus-1/*" or
40+
file.path like "/home/*/.local/share/dbus-1/*"
41+
) and not (
42+
file.extension in ("swp", "dpkg-new") or
43+
process.name in ("dnf", "yum", "dpkg")
44+
)
45+
| stats cc = count(), agent_count = count_distinct(agent.id) by file.path, process.executable
46+
| where agent_count <= 3
47+
| sort cc asc
48+
| limit 100
49+
```
50+
51+
```sql
52+
sql
53+
SELECT
54+
f.filename,
55+
f.path,
56+
u.username AS file_owner,
57+
g.groupname AS group_owner,
58+
datetime(f.atime, 'unixepoch') AS file_last_access_time,
59+
datetime(f.mtime, 'unixepoch') AS file_last_modified_time,
60+
datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,
61+
datetime(f.btime, 'unixepoch') AS file_created_time,
62+
f.size AS size_bytes
63+
FROM
64+
file f
65+
LEFT JOIN
66+
users u ON f.uid = u.uid
67+
LEFT JOIN
68+
groups g ON f.gid = g.gid
69+
WHERE (
70+
f.path LIKE '/usr/share/dbus-1/system-services/%'
71+
OR f.path LIKE '/usr/local/share/dbus-1/system-services/%'
72+
OR f.path LIKE '/etc/dbus-1/system.d/%'
73+
OR f.path LIKE '/usr/share/dbus-1/system.d/%'
74+
OR f.path LIKE '/usr/share/dbus-1/session-services/%'
75+
OR f.path LIKE '/home/%/.local/share/dbus-1/services/%'
76+
OR f.path LIKE '/etc/dbus-1/session.d/%'
77+
OR f.path LIKE '/usr/share/dbus-1/session.d/%'
78+
)
79+
AND (mtime > strftime('%s', 'now') - (7 * 86400)); -- Modified in the last 7 days
80+
```
81+
82+
## Notes
83+
84+
- Monitors processes related to D-Bus, such as `dbus-daemon` and `dbus-send`, to identify unauthorized or anomalous executions indicative of persistence or abuse.
85+
- Tracks creations and modifications to critical D-Bus directories, including `/usr/share/dbus-1/`, `/usr/local/share/dbus-1/`, `/etc/dbus-1/`, and `~/.local/share/dbus-1/`, which may indicate malicious activity.
86+
- Retrieves metadata for D-Bus service and configuration files, such as file ownership, access times, and modification timestamps, to detect unauthorized changes.
87+
- Focuses on recent changes within the last 7 days to identify timely indicators of compromise while maintaining historical context for analysis.
88+
89+
## MITRE ATT&CK Techniques
90+
91+
- [T1543](https://attack.mitre.org/techniques/T1543)
92+
93+
## License
94+
95+
- `Elastic License v2`

‎hunting/linux/queries/persistence_via_desktop_bus.toml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
[hunt]
2+
author = "Elastic"
3+
description = """
4+
This hunt identifies potential persistence mechanisms leveraging the Desktop Bus (D-Bus) system on Linux. D-Bus is an inter-process communication (IPC) system that facilitates communication between various system components and applications. Attackers can exploit D-Bus by creating or modifying services, configuration files, or system policies to maintain persistence or execute unauthorized actions. This hunt monitors suspicious process activity related to D-Bus, tracks changes to key D-Bus configuration and service files, and retrieves metadata for further analysis. The approach helps analysts identify and respond to persistence techniques targeting D-Bus.
5+
"""
6+
integration = ["endpoint"]
7+
uuid = "2223bbda-b931-4f33-aeb4-0e0732a370dd"
8+
name = "Persistence via Desktop Bus (D-Bus)"
9+
language = ["ES|QL", "SQL"]
10+
license = "Elastic License v2"
11+
notes = [
12+
"Monitors processes related to D-Bus, such as `dbus-daemon` and `dbus-send`, to identify unauthorized or anomalous executions indicative of persistence or abuse.",
13+
"Tracks creations and modifications to critical D-Bus directories, including `/usr/share/dbus-1/`, `/usr/local/share/dbus-1/`, `/etc/dbus-1/`, and `~/.local/share/dbus-1/`, which may indicate malicious activity.",
14+
"Retrieves metadata for D-Bus service and configuration files, such as file ownership, access times, and modification timestamps, to detect unauthorized changes.",
15+
"Focuses on recent changes within the last 7 days to identify timely indicators of compromise while maintaining historical context for analysis."
16+
]
17+
mitre = ["T1543"]
18+
query = [
19+
'''sql
20+
from logs-endpoint.events.process-*
21+
| keep @timestamp, host.os.type, event.type, event.action, process.name, process.parent.name, process.command_line, process.executable, process.parent.executable, agent.id
22+
| where @timestamp > now() - 30 day
23+
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
24+
process.parent.name == "dbus-daemon" or process.name == "dbus-send"
25+
)
26+
| stats cc = count(), agent_count = count_distinct(agent.id) by process.command_line, process.executable, process.parent.executable
27+
| where agent_count <= 3 and cc < 15
28+
| sort cc asc
29+
| limit 100
30+
''',
31+
'''sql
32+
from logs-endpoint.events.file-*
33+
| keep @timestamp, host.os.type, event.type, event.action, file.path, file.extension, process.name, process.executable, agent.id
34+
| where @timestamp > now() - 30 day
35+
| where host.os.type == "linux" and event.type in ("creation", "change") and (
36+
file.path like "/usr/share/dbus-1/*" or
37+
file.path like "/usr/local/share/dbus-1/*" or
38+
file.path like "/etc/dbus-1/*" or
39+
file.path like "/home/*/.local/share/dbus-1/*"
40+
) and not (
41+
file.extension in ("swp", "dpkg-new") or
42+
process.name in ("dnf", "yum", "dpkg")
43+
)
44+
| stats cc = count(), agent_count = count_distinct(agent.id) by file.path, process.executable
45+
| where agent_count <= 3
46+
| sort cc asc
47+
| limit 100
48+
''',
49+
'''sql
50+
SELECT
51+
f.filename,
52+
f.path,
53+
u.username AS file_owner,
54+
g.groupname AS group_owner,
55+
datetime(f.atime, 'unixepoch') AS file_last_access_time,
56+
datetime(f.mtime, 'unixepoch') AS file_last_modified_time,
57+
datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,
58+
datetime(f.btime, 'unixepoch') AS file_created_time,
59+
f.size AS size_bytes
60+
FROM
61+
file f
62+
LEFT JOIN
63+
users u ON f.uid = u.uid
64+
LEFT JOIN
65+
groups g ON f.gid = g.gid
66+
WHERE (
67+
f.path LIKE '/usr/share/dbus-1/system-services/%'
68+
OR f.path LIKE '/usr/local/share/dbus-1/system-services/%'
69+
OR f.path LIKE '/etc/dbus-1/system.d/%'
70+
OR f.path LIKE '/usr/share/dbus-1/system.d/%'
71+
OR f.path LIKE '/usr/share/dbus-1/session-services/%'
72+
OR f.path LIKE '/home/%/.local/share/dbus-1/services/%'
73+
OR f.path LIKE '/etc/dbus-1/session.d/%'
74+
OR f.path LIKE '/usr/share/dbus-1/session.d/%'
75+
)
76+
AND (mtime > strftime('%s', 'now') - (7 * 86400)); -- Modified in the last 7 days
77+
'''
78+
]

0 commit comments

Comments
 (0)