Detection rules for Debian Family Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 17 detection rules.

Rule Example

Below is an example of a rule definition for Audit or Logging Service Disabled (view in repository):

# Rule version v1.0.0

dataTypes:
  - linux
name: Audit or Logging Service Disabled
impact:
  confidentiality: 2
  integrity: 3
  availability: 3
category: Defense Evasion
technique: "T1562.001 - Impair Defenses: Disable or Modify Tools"
adversary: origin
references:
  - https://attack.mitre.org/techniques/T1562/001/
description: |
  Detects attempts to stop or disable audit and logging services (auditd, rsyslog, syslog-ng, journald) which attackers do to prevent their activities from being recorded.

  Next Steps:
  1. Immediately investigate the host where logging was disabled
  2. Identify the user account that stopped the service
  3. Restart the logging service and verify log integrity
  4. Review any gap in logging for potential attack evidence
  5. Check for other defense evasion techniques on the host
  6. Investigate the attack chain that led to disabling logging
where: |
  (contains("log.message", "systemctl") || contains("log.message", "service")) &&
  (contains("log.message", "stop") || contains("log.message", "disable") ||
   contains("log.message", "mask") || contains("log.message", "kill")) &&
  (contains("log.message", "auditd") || contains("log.message", "rsyslog") ||
   contains("log.message", "syslog-ng") || contains("log.message", "journald") ||
   contains("log.message", "syslog")) &&
  !(contains("log.message", "restart") || contains("log.message", "reload"))
groupBy:
  - origin.host
  - origin.user

Rule Details

Audit or Logging Service Disabled

Identifies efforts to halt or turn off audit and logging daemons (auditd, rsyslog, syslog-ng, journald), a tactic attackers use so their actions are not logged.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses: Disable or Modify Tools

• Impact: C:2 / I:3 / A:3

• Rule file: auditd_syslog_disabling.yml

• Reference: https://attack.mitre.org/techniques/T1562/001/

Container Escape Technique Detected

Identifies container escape methods such as accessing the Docker socket from inside a container, nsenter-based escapes, abuse of cgroups release_agent, and breakouts from privileged containers.

• Category: Privilege Escalation

• Technique: T1611 - Escape to Host

• Impact: C:3 / I:3 / A:3

• Rule file: container_escape_techniques.yml

• Reference: https://attack.mitre.org/techniques/T1611/

• Reference: https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/

Crontab Persistence Mechanism Detected

Identifies changes to crontab, new files in /etc/cron.d/, or creation of at jobs that could point to attacker-installed persistence. Threat actors often leverage cron jobs to keep access or run malicious payloads on a schedule.

• Category: Persistence

• Technique: T1053.003 - Scheduled Task/Job: Cron

• Impact: C:2 / I:3 / A:2

• Rule file: crontab_persistence.yml

• Reference: https://attack.mitre.org/techniques/T1053/003/

• Reference: https://man7.org/linux/man-pages/man5/crontab.5.html

Debian-Specific Kernel Exploit Attempts

Identifies possible kernel exploitation targeting Debian systems, covering Dirty COW variants, overlayfs exploits, namespace escapes, and other signs of kernel vulnerability abuse. This rule watches for kernel crashes, segmentation faults, exploit attempts, and other unusual kernel behavior that could signal exploitation in progress.

• Category: Privilege Escalation

• Technique: T1068 - Exploitation for Privilege Escalation

• Impact: C:3 / I:3 / A:3

• Rule file: debian_kernel_exploits.yml

• Reference: https://attack.mitre.org/techniques/T1068/

• Reference: https://www.debian.org/security/

• Reference: https://security-tracker.debian.org/tracker/

Debian-Specific Rootkits

Identifies signs of known Debian/Linux rootkits, such as file changes, concealed processes, network backdoors, and kernel module tampering often observed in Debian environments. This rule spots several rootkit behaviors, including unauthorized changes to system binaries, kernel module loading, hidden processes, and suspicious network activity.

• Category: Defense Evasion

• Technique: T1014 - Rootkit

• Impact: C:3 / I:3 / A:3

• Rule file: debian_specific_rootkits.yml

• Reference: https://attack.mitre.org/techniques/T1014/

• Reference: https://www.debian.org/security/

• Reference: https://wiki.debian.org/Teams/Security

Kernel Exploit Indicators Detected

Identifies evidence of kernel exploitation, such as known artifacts from Dirty Pipe (CVE-2022-0847), Dirty COW (CVE-2016-5195), OverlayFS exploits, and other kernel privilege escalation flaws.

• Category: Privilege Escalation

• Technique: T1068 - Exploitation for Privilege Escalation

• Impact: C:3 / I:3 / A:3

• Rule file: kernel_exploit_indicators.yml

• Reference: https://attack.mitre.org/techniques/T1068/

LD_PRELOAD Hijacking Detected

Changes to the LD_PRELOAD environment variable or /etc/ld.so.preload are detected; attackers use these to load malicious shared libraries into every process, achieving persistence and credential interception.

• Category: Persistence

• Technique: T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking

• Impact: C:3 / I:3 / A:2

• Rule file: ld_preload_hijacking.yml

• Reference: https://attack.mitre.org/techniques/T1574/006/

• Reference: https://man7.org/linux/man-pages/man8/ld.so.8.html

Process Masquerading Detected

Identifies processes that try to pass as legitimate system processes by changing their names via /proc/self/comm or adopting deceptive process names. This tactic is employed to avoid detection.

• Category: Defense Evasion

• Technique: T1036.004 - Masquerading: Masquerade Task or Service

• Impact: C:2 / I:3 / A:1

• Rule file: process_masquerading.yml

• Reference: https://attack.mitre.org/techniques/T1036/004/

Reverse Shell Execution Detected

Identifies typical reverse shell activity, such as bash TCP redirection, Python socket connections, netcat listeners with execute flags, and socat reverse shells. These patterns strongly suggest an active compromise.

• Category: Execution

• Technique: T1059.004 - Command and Scripting Interpreter: Unix Shell

• Impact: C:3 / I:3 / A:3

• Rule file: reverse_shell_detection.yml

• Reference: https://attack.mitre.org/techniques/T1059/004/

• Reference: https://www.revshells.com/

SSH Authorized Keys Modification

Monitors for alterations to SSH authorized_keys files, through which attackers establish persistent access by inserting their own public keys into user accounts.

• Category: Persistence

• Technique: T1098.004 - Account Manipulation: SSH Authorized Keys

• Impact: C:3 / I:3 / A:1

• Rule file: ssh_authorized_keys_modification.yml

• Reference: https://attack.mitre.org/techniques/T1098/004/

• Reference: https://man.openbsd.org/sshd.8

SSH Tunneling or Port Forwarding Detected

Identifies SSH local, remote, or dynamic port forwarding, which attackers abuse to tunnel traffic through compromised hosts, circumvent network segmentation, and exfiltrate data.

• Category: Command and Control

• Technique: T1572 - Protocol Tunneling

• Impact: C:3 / I:2 / A:1

• Rule file: ssh_tunneling_port_forwarding.yml

• Reference: https://attack.mitre.org/techniques/T1572/

• Reference: https://man.openbsd.org/ssh

SUID/SGID Binary Creation Detected

Identifies executable files that have SUID or SGID bits assigned via chmod. Attackers employ this method to create binaries that execute with elevated privileges, enabling privilege escalation.

• Category: Privilege Escalation

• Technique: T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid

• Impact: C:3 / I:3 / A:2

• Rule file: suid_sgid_binary_creation.yml

• Reference: https://attack.mitre.org/techniques/T1548/001/

• Reference: https://gtfobins.github.io/

Shell RC File Modification for Persistence

Identifies changes to shell configuration files (.bashrc, .bash_profile, /etc/profile.d/) that attackers leverage for persistence by placing malicious commands that run in every shell session.

• Category: Persistence

• Technique: T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification

• Impact: C:2 / I:3 / A:1

• Rule file: shell_rc_file_modification.yml

• Reference: https://attack.mitre.org/techniques/T1546/004/

Suspicious Binary Execution from Temporary Directory

Identifies binaries executed from temporary directories (/tmp, /dev/shm, /var/tmp), a common tactic malware and attackers use after initial compromise to stage and launch payloads.

• Category: Execution

• Technique: T1059.004 - Command and Scripting Interpreter: Unix Shell

• Impact: C:3 / I:3 / A:2

• Rule file: suspicious_binary_in_tmp.yml

• Reference: https://attack.mitre.org/techniques/T1059/004/

Systemd Timer Persistence Mechanism

Identifies the creation or alteration of systemd timer units, which can serve as a persistence mechanism. Systemd timers offer a cron alternative and can run commands on a schedule.

• Category: Persistence

• Technique: T1053.003 - Scheduled Task/Job: Cron

• Impact: C:2 / I:3 / A:2

• Rule file: systemd_timer_persistence.yml

• Reference: https://attack.mitre.org/techniques/T1053/003/

• Reference: https://www.freedesktop.org/software/systemd/man/systemd.timer.html

Unauthorized /etc/shadow or /etc/passwd Access

Identifies unauthorized access to /etc/shadow or suspicious changes to /etc/passwd, potentially signaling credential harvesting or account manipulation by an attacker.

• Category: Credential Access

• Technique: T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow

• Impact: C:3 / I:3 / A:1

• Rule file: etc_shadow_access.yml

• Reference: https://attack.mitre.org/techniques/T1003/008/

eBPF Rootkit Activity Detected

Identifies the loading of malicious eBPF programs, which can enable rootkit capabilities, intercept network traffic, and hide processes. eBPF-based rootkits run at the kernel level and are hard to detect.

• Category: Defense Evasion

• Technique: T1014 - Rootkit

• Impact: C:3 / I:3 / A:3

• Rule file: ebpf_rootkit_detection.yml

• Reference: https://attack.mitre.org/techniques/T1014/

• Reference: https://www.elastic.co/security-labs/a-peek-behind-the-bpf-curtain