Detection rules for AS/400 Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 8 detection rules.

Rule Example

Below is an example of a rule definition for IBM AS/400 Audit Journal Disabling Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - ibm-as400
name: IBM AS/400 Audit Journal Disabling Detection
impact:
  confidentiality: 2
  integrity: 3
  availability: 1
category: Defense Evasion
technique: "T1562.002 - Impair Defenses: Disable Windows Event Logging"
adversary: origin
references:
  - https://www.ibm.com/docs/en/i/7.5?topic=auditing-changing-security
  - https://attack.mitre.org/techniques/T1562/002/
description: |
  Detects attempts to disable or modify IBM AS/400 security auditing via CHGAUD, QAUDCTL, or QAUDLVL system value changes. Attackers disable auditing to cover their tracks.

  Next Steps:
  1. Verify the audit configuration change was authorized
  2. Re-enable auditing immediately if unauthorized
  3. Check QAUDJRN journal for recent entries before the change
  4. Review system activity during the audit gap
  5. Restrict CHGAUD and system value change authority
  6. Implement monitoring for audit control system values
where: |
  exists("log.message") &&
  (
    contains("log.message", "CHGAUD") ||
    (contains("log.message", "QAUDCTL") && contains("log.message", "*NONE")) ||
    (contains("log.message", "QAUDLVL") && contains("log.message", "changed")) ||
    (contains("log.message", "QAUDLVL2") && contains("log.message", "changed")) ||
    (contains("log.message", "audit") && contains("log.message", "disabled")) ||
    (contains("log.message", "QAUDJRN") && contains("log.message", "DLTJRN")) ||
    contains("log.message", "CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*NONE')")
  )
groupBy:
  - adversary.host
  - adversary.user

Rule Details

IBM AS/400 Audit Journal Disabling Detection

Identifies attempts to turn off or alter IBM AS/400 security auditing through changes to the CHGAUD, QAUDCTL, or QAUDLVL system values. Adversaries disable auditing to conceal their activity.

• Category: Defense Evasion

• Technique: T1562.002 - Impair Defenses: Disable Windows Event Logging

• Impact: C:2 / I:3 / A:1

• Rule file: as400_audit_journal_disable.yml

• Reference: https://www.ibm.com/docs/en/i/7.5?topic=auditing-changing-security

• Reference: https://attack.mitre.org/techniques/T1562/002/

IBM AS/400 Exit Point Tampering Detection

Identifies tampering with IBM AS/400 exit points through ADDEXITPGM to register malicious programs. Exit points intercept system operations and may be exploited for credential capture, data interception, or persistent backdoor access.

• Category: Persistence

• Technique: T1562 - Impair Defenses

• Impact: C:3 / I:3 / A:2

• Rule file: as400_exit_point_tampering.yml

• Reference: https://www.ibm.com/docs/en/i/7.5?topic=programs-exit

• Reference: https://attack.mitre.org/techniques/T1562/

IBM AS/400 Job Queue Manipulation Detection

Identifies unusual job submissions and job queue manipulations on IBM AS/400 that could point to unauthorized task execution with elevated authority or persistence mechanisms.

• Category: Execution

• Technique: T1053 - Scheduled Task/Job

• Impact: C:2 / I:3 / A:2

• Rule file: as400_job_queue_manipulation.yml

• Reference: https://www.ibm.com/docs/en/i/7.5?topic=concepts-job-queues

• Reference: https://attack.mitre.org/techniques/T1053/

IBM AS/400 Library List Manipulation Detection

Identifies manipulation of IBM AS/400 library lists through the CHGLIBL, ADDLIBLE, or CHGSYSLIBL commands. Adversaries change library lists to inject malicious programs that run in place of legitimate system commands (library list hijacking).

• Category: Privilege Escalation

• Technique: T1574 - Hijack Execution Flow

• Impact: C:3 / I:3 / A:2

• Rule file: as400_library_list_manipulation.yml

• Reference: https://www.ibm.com/docs/en/i/7.5?topic=concepts-library-lists

• Reference: https://attack.mitre.org/techniques/T1574/

IBM AS/400 Program Adopt Authority Abuse Detection

Identifies programs that use adopted authority with *ALLOBJ special authority on IBM AS/400. Adversaries create programs that adopt elevated privileges to circumvent authorization controls and reach sensitive objects.

• Category: Privilege Escalation

• Technique: T1548 - Abuse Elevation Control Mechanism

• Impact: C:3 / I:3 / A:2

• Rule file: as400_program_adopt_abuse.yml

• Reference: https://www.ibm.com/docs/en/i/7.5?topic=programs-adopted-authority

• Reference: https://attack.mitre.org/techniques/T1548/

IBM AS/400 Remote Command Execution Detection

Identifies remote command execution on IBM AS/400 through RCMD, RMTCMD, DDM, or DRDA protocols. These commands enable adversaries to perform operations from remote systems.

• Category: Lateral Movement

• Technique: T1021 - Remote Services

• Impact: C:3 / I:3 / A:2

• Rule file: as400_remote_command.yml

• Reference: https://www.ibm.com/docs/en/i/7.5?topic=ssw_ibm_i_75/cl/runrmtcmd.htm

• Reference: https://attack.mitre.org/techniques/T1021/

IBM AS/400 SQL Injection via ODBC/JDBC Detection

Identifies SQL injection attempts aimed at IBM AS/400 over ODBC/JDBC connections. Watches database server job logs and diagnostic messages for suspicious SQL patterns.

• Category: Initial Access

• Technique: T1190 - Exploit Public-Facing Application

• Impact: C:3 / I:3 / A:2

• Rule file: as400_sql_injection.yml

• Reference: https://www.ibm.com/docs/en/i/7.5?topic=services-sql-diagnostic

• Reference: https://attack.mitre.org/techniques/T1190/

IBM AS/400 Unauthorized IFS Access Detection

Identifies unauthorized access to the IBM AS/400 Integrated File System (IFS). Watches for activity involving sensitive directories, configuration files, and bulk file operations that might indicate data theft.

• Category: Collection

• Technique: T1005 - Data from Local System

• Impact: C:3 / I:2 / A:1

• Rule file: as400_ifs_access.yml

• Reference: https://www.ibm.com/docs/en/i/7.5?topic=system-integrated-file

• Reference: https://attack.mitre.org/techniques/T1005/