Skip to content

Commit fada8a1

Browse files
AegrahAegrah
committed
[New Hunt] Linux PAM Persistence
1 parent 2ff2965 commit fada8a1

File tree

4 files changed

+179
-0
lines changed

4 files changed

+179
-0
lines changed

‎hunting/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ Here are the queries currently available:
4242
- [Persistence via Cron](./linux/docs/persistence_via_cron.md) (ES|QL)
4343
- [Persistence via Message-of-the-Day](./linux/docs/persistence_via_message_of_the_day.md) (ES|QL)
4444
- [Persistence via Package Manager](./linux/docs/persistence_via_package_manager.md) (ES|QL)
45+
- [Persistence via Pluggable Authentication Modules](./linux/docs/persistence_via_pluggable_authentication_module.md) (ES|QL)
4546
- [Persistence via SSH Configurations and/or Keys](./linux/docs/persistence_via_ssh_configurations_and_keys.md) (ES|QL)
4647
- [Persistence via System V Init](./linux/docs/persistence_via_sysv_init.md) (ES|QL)
4748
- [Persistence via Systemd (Timers)](./linux/docs/persistence_via_systemd_timers.md) (ES|QL)

‎hunting/index.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,11 @@ linux:
220220
mitre:
221221
- T1037.004
222222
- T1546.003
223+
2a3c46b8-7bd6-4bc4-a4a8-a1af114ea152:
224+
name: Persistence via Pluggable Authentication Modules
225+
path: ./linux/queries/persistence_via_pluggable_authentication_module.toml
226+
mitre:
227+
- T1556.003
223228
okta:
224229
0b936024-71d9-11ef-a9be-f661ea17fbcc:
225230
name: Failed OAuth Access Token Retrieval via Public Client App

‎hunting/linux/docs/persistence_via_pluggable_authentication_module.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Persistence via Pluggable Authentication Modules
2+
3+
---
4+
5+
## Metadata
6+
7+
- **Author:** Elastic
8+
- **Description:** This hunt identifies potential persistence mechanisms leveraging Pluggable Authentication Modules (PAM) on Linux systems. PAM is a powerful framework for managing authentication-related tasks, but its flexibility can be abused by attackers to introduce malicious modules or modify configurations to gain unauthorized access or establish persistence. This hunt monitors for modifications to PAM-related files, directories, and modules.
9+
10+
- **UUID:** `2a3c46b8-7bd6-4bc4-a4a8-a1af114ea152`
11+
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
12+
- **Language:** `[ES|QL, SQL]`
13+
- **Source File:** [Persistence via Pluggable Authentication Modules](../queries/persistence_via_pluggable_authentication_module.toml)
14+
15+
## Query
16+
17+
```sql
18+
from logs-endpoint.events.file-*
19+
| where @timestamp > now() - 7 days
20+
| where host.os.type == "linux" and event.action in ("rename", "creation") and (
21+
file.path like "/lib/security/*" or
22+
file.path like "/lib64/security/*" or
23+
file.path like "/usr/lib64/security/*" or
24+
file.path like "/usr/lib/x86_64-linux-gnu/security/*" or
25+
file.path like "/lib/x86_64-linux-gnu/security/*" or
26+
file.path like "/etc/pam.d/*" or
27+
file.path == "/etc/pam.conf"
28+
)
29+
| stats cc = count(), agent_count = count_distinct(agent.id) by file.path, process.executable
30+
| where agent_count <= 3
31+
| sort cc asc
32+
| limit 100
33+
```
34+
35+
```sql
36+
SELECT
37+
f.filename,
38+
f.path,
39+
u.username AS file_owner,
40+
g.groupname AS group_owner,
41+
datetime(f.atime, 'unixepoch') AS file_last_access_time,
42+
datetime(f.mtime, 'unixepoch') AS file_last_modified_time,
43+
datetime(f.ctime, 'unixepoch') AS file_last_status_change_time
44+
datetime(f.btime, 'unixepoch') AS file_created_time,
45+
f.size AS size_bytes
46+
FROM
47+
file f
48+
LEFT JOIN
49+
users u ON f.uid = u.uid
50+
LEFT JOIN
51+
groups g ON f.gid = g.gid
52+
WHERE
53+
f.path LIKE '/lib/security/%'
54+
OR f.path LIKE '/lib64/security/%'
55+
OR f.path LIKE '/usr/lib/security/%'
56+
OR f.path LIKE '/usr/lib64/security/%'
57+
OR f.path LIKE '/usr/lib/x86_64-linux-gnu/security/%'
58+
OR f.path LIKE '/lib/x86_64-linux-gnu/security/%'
59+
OR f.path like '/etc/pam.d/%'
60+
OR f.path = '/etc/pam.conf'
61+
```
62+
63+
```sql
64+
SELECT * FROM file
65+
WHERE (
66+
path LIKE '/lib/security/%'
67+
OR path LIKE '/lib64/security/%'
68+
OR path LIKE '/usr/lib/security/%'
69+
OR path LIKE '/usr/lib64/security/%'
70+
OR path LIKE '/usr/lib/x86_64-linux-gnu/security/%'
71+
OR path LIKE '/lib/x86_64-linux-gnu/security/%'
72+
OR path like '/etc/pam.d/%'
73+
OR path = '/etc/pam.conf'
74+
)
75+
AND (mtime > strftime('%s', 'now') - (7 * 86400)); -- Modified in the last 7 days
76+
```
77+
78+
## Notes
79+
80+
- PAM modules are critical to Linux authentication workflows, but they can be abused to establish persistence or execute malicious actions.
81+
- This hunt identifies suspicious file creation or modification events in PAM directories, such as /etc/pam.d/, /lib/security/, and related paths.
82+
- Uses ES|QL queries to track file events and identify potentially malicious activity based on process activity and file paths.
83+
- Complemented by OSQuery queries to provide detailed file metadata for modified PAM-related files, including timestamps and ownership information.
84+
- The hunt focuses on minimizing false positives by excluding common legitimate processes while tagging unusual activity.
85+
- MITRE ATT&CK Technique T1556.003 (Modify Authentication Process: Pluggable Authentication Modules) is addressed in this hunt.
86+
87+
## MITRE ATT&CK Techniques
88+
89+
- [T1556.003](https://attack.mitre.org/techniques/T1556/003)
90+
91+
## License
92+
93+
- `Elastic License v2`

‎hunting/linux/queries/persistence_via_pluggable_authentication_module.toml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
[hunt]
2+
author = "Elastic"
3+
description = """
4+
This hunt identifies potential persistence mechanisms leveraging Pluggable Authentication Modules (PAM) on Linux systems. PAM is a powerful framework for managing authentication-related tasks, but its flexibility can be abused by attackers to introduce malicious modules or modify configurations to gain unauthorized access or establish persistence. This hunt monitors for modifications to PAM-related files, directories, and modules.
5+
"""
6+
integration = ["endpoint"]
7+
uuid = "2a3c46b8-7bd6-4bc4-a4a8-a1af114ea152"
8+
name = "Persistence via Pluggable Authentication Modules"
9+
language = ["ES|QL", "SQL"]
10+
license = "Elastic License v2"
11+
notes = [
12+
"PAM modules are critical to Linux authentication workflows, but they can be abused to establish persistence or execute malicious actions.",
13+
"This hunt identifies suspicious file creation or modification events in PAM directories, such as /etc/pam.d/, /lib/security/, and related paths.",
14+
"Uses ES|QL queries to track file events and identify potentially malicious activity based on process activity and file paths.",
15+
"Complemented by OSQuery queries to provide detailed file metadata for modified PAM-related files, including timestamps and ownership information.",
16+
"The hunt focuses on minimizing false positives by excluding common legitimate processes while tagging unusual activity.",
17+
"MITRE ATT&CK Technique T1556.003 (Modify Authentication Process: Pluggable Authentication Modules) is addressed in this hunt."
18+
]
19+
mitre = ["T1556.003"]
20+
21+
query = [
22+
'''
23+
from logs-endpoint.events.file-*
24+
| where @timestamp > now() - 7 days
25+
| where host.os.type == "linux" and event.action in ("rename", "creation") and (
26+
file.path like "/lib/security/*" or
27+
file.path like "/lib64/security/*" or
28+
file.path like "/usr/lib64/security/*" or
29+
file.path like "/usr/lib/x86_64-linux-gnu/security/*" or
30+
file.path like "/lib/x86_64-linux-gnu/security/*" or
31+
file.path like "/etc/pam.d/*" or
32+
file.path == "/etc/pam.conf"
33+
)
34+
| stats cc = count(), agent_count = count_distinct(agent.id) by file.path, process.executable
35+
| where agent_count <= 3
36+
| sort cc asc
37+
| limit 100
38+
''',
39+
'''
40+
SELECT
41+
f.filename,
42+
f.path,
43+
u.username AS file_owner,
44+
g.groupname AS group_owner,
45+
datetime(f.atime, 'unixepoch') AS file_last_access_time,
46+
datetime(f.mtime, 'unixepoch') AS file_last_modified_time,
47+
datetime(f.ctime, 'unixepoch') AS file_last_status_change_time
48+
datetime(f.btime, 'unixepoch') AS file_created_time,
49+
f.size AS size_bytes
50+
FROM
51+
file f
52+
LEFT JOIN
53+
users u ON f.uid = u.uid
54+
LEFT JOIN
55+
groups g ON f.gid = g.gid
56+
WHERE
57+
f.path LIKE '/lib/security/%'
58+
OR f.path LIKE '/lib64/security/%'
59+
OR f.path LIKE '/usr/lib/security/%'
60+
OR f.path LIKE '/usr/lib64/security/%'
61+
OR f.path LIKE '/usr/lib/x86_64-linux-gnu/security/%'
62+
OR f.path LIKE '/lib/x86_64-linux-gnu/security/%'
63+
OR f.path like '/etc/pam.d/%'
64+
OR f.path = '/etc/pam.conf'
65+
''',
66+
'''
67+
SELECT * FROM file
68+
WHERE (
69+
path LIKE '/lib/security/%'
70+
OR path LIKE '/lib64/security/%'
71+
OR path LIKE '/usr/lib/security/%'
72+
OR path LIKE '/usr/lib64/security/%'
73+
OR path LIKE '/usr/lib/x86_64-linux-gnu/security/%'
74+
OR path LIKE '/lib/x86_64-linux-gnu/security/%'
75+
OR path like '/etc/pam.d/%'
76+
OR path = '/etc/pam.conf'
77+
)
78+
AND (mtime > strftime('%s', 'now') - (7 * 86400)); -- Modified in the last 7 days
79+
'''
80+
]

0 commit comments

Comments
 (0)