synoti logosynoti logo
Linux RHEL Family

Detection rules for RHEL Family Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 10 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Container Platform Security AttacksPrivilege EscalationT1611 - Escape to HostC:3 / I:3 / A:2
Critical SELinux Policy ViolationPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:3 / I:3 / A:2
OpenShift Security ViolationsCredential AccessT1552.007 - Unsecured Credentials: Container APIC:3 / I:3 / A:2
RHEL Boot Loader Attack DetectionDefense Evasion, PersistenceT1542.003 - Pre-OS Boot: BootkitC:2 / I:3 / A:2
RHEL Secure Boot Violation DetectionDefense EvasionT1553.006 - Subvert Trust Controls: Code Signing Policy ModificationC:2 / I:3 / A:2
RHEL-Specific Kernel Exploitation AttemptPrivilege EscalationExploitation for Privilege EscalationC:3 / I:3 / A:3
RHEL-Specific Malware DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
RPM Database Tampering DetectionDefense EvasionT1070 - Indicator RemovalC:2 / I:3 / A:2
SystemD Unit File Attack DetectedPersistence, Privilege EscalationT1543.002 - Create or Modify System Process: Systemd ServiceC:2 / I:3 / A:2
YUM/DNF Repository Manipulation AttackInitial AccessT1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development ToolsC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Container Platform Security Attacks (view in repository):

# Rule version v1.0.0

dataTypes:
  - linux
name: Container Platform Security Attacks
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Privilege Escalation
technique: "T1611 - Escape to Host"
adversary: origin
references:
  - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/building_running_and_managing_containers/index
  - https://attack.mitre.org/techniques/T1611/
description: |
  Detects attacks against container platforms including Docker, Podman, and CRI-O such as container escape attempts, privilege escalation, unauthorized image pulls, and runtime manipulation. This rule identifies suspicious container activities that may indicate an adversary attempting to break out of container isolation or manipulate container runtime environments.

  Next Steps:
  1. Investigate the affected container and host system for signs of compromise
  2. Review container logs and runtime configurations for unauthorized changes
  3. Check for unusual process execution or file system modifications
  4. Verify container image integrity and scan for malicious content
  5. Review security policies for containers (seccomp, AppArmor, SELinux)
  6. Consider isolating the affected container and host system
  7. Update container security policies and runtime configurations as needed
where: |
  (oneOf("origin.process", ["docker", "podman", "crio", "containerd"]) ||
   oneOf("origin.process", ["dockerd", "podman", "crio", "containerd"]) ||
   oneOf("log.service", ["docker", "podman", "crio", "containerd"]) ||
   oneOf("log.process_name", ["dockerd", "podman", "crio", "containerd"])) &&
  (
    contains("log.message", "container escape") ||
    contains("log.message", "privilege escalation") ||
    contains("log.message", "unauthorized pull") ||
    contains("log.message", "runtime manipulation") ||
    contains("log.message", "seccomp violation") ||
    contains("log.message", "AppArmor violation") ||
    contains("log.message", "SELinux denial") ||
    (equals("action", "exec") && contains("log.command", "/proc/self/exe")) ||
    (equals("action", "mount") && contains("log.path", "/sys")) ||
    equals("log.event_type", "container_breakout") ||
    (oneOf("log.syscall", ["mount", "pivot_root", "chroot"]) && equals("log.result", "denied"))
  )
groupBy:
  - lastEvent.log.container_id
  - origin.host

Rule Details

Container Platform Security Attacks

Identifies attacks aimed at container platforms such as Docker, Podman, and CRI-O, including efforts to escape containers, escalate privileges, pull images without authorization, and alter runtime settings. The rule spots suspicious container behavior that may signal an adversary trying to breach container isolation or tamper with container runtime environments.

Critical SELinux Policy Violation

Identifies serious SELinux policy violations that could point to privilege escalation attempts, unauthorized access, or malicious activity evading mandatory access controls. The rule detects AVC denials for sensitive capabilities, efforts to access shadow files, changes to critical system directories, unconfined processes executing binaries, and unauthorized SELinux management commands.

OpenShift Security Violations

Identifies security violations within OpenShift Container Platform, such as unauthorized API access, RBAC violations, security context constraint breaches, and malicious pod deployments. Such violations may signal security breaches or misconfigurations that could enable unauthorized access or privilege escalation in the cluster.

RHEL Boot Loader Attack Detection

Identifies efforts to alter or tamper with boot loader configuration, including unauthorized modifications to GRUB files, boot parameters, or kernel modules that may point to bootkit installation attempts.

RHEL Secure Boot Violation Detection

Identifies UEFI Secure Boot policy violations, such as unsigned kernel modules, tampering with the MOK (Machine Owner Key) database, attempts to turn off Secure Boot, or loading unauthorized boot components. This may indicate compromise of boot chain integrity or efforts to bypass security controls.

RHEL-Specific Kernel Exploitation Attempt

Identifies possible exploitation attempts aimed at RHEL-specific kernel vulnerabilities, including memory corruption, privilege escalation via kernel bugs, or efforts to evade kernel security mechanisms such as SELinux or kernel module protections.

RHEL-Specific Malware Detection

Identifies signs of malware that specifically targets RHEL systems, including known rootkits, suspicious kernel modules, process injection attempts, and malicious RPM packages or scripts that exploit RHEL-specific vulnerabilities.

RPM Database Tampering Detection

Identifies possible tampering with the RPM database that could suggest an attacker is trying to conceal malicious package installations or system changes. This covers unauthorized access to RPM database files, non-privileged users trying to rebuild the database, or signs of corruption in RPM logs.

SystemD Unit File Attack Detected

Identifies malicious attempts to create or modify SystemD unit files, including privilege escalation via invalid usernames, suspicious service directives, or efforts to establish persistent backdoors through systemd generators or malicious service configurations.

YUM/DNF Repository Manipulation Attack

Identifies potential attacks against YUM/DNF repositories, including unauthorized repository additions, GPG key changes, or suspicious package installations that may indicate supply chain compromise. The rule detects attempts to manipulate package management systems to install malicious software or evade security controls.

**