Post Exploitation command execution Detection Scenario by crowdsecurity | CrowdSec Hub

Post Exploitation command execution

Attack scenariolinux:post-exploitationMITRE T1059.004

By: crowdsecurity
Version: 0.7
Name: crowdsecurity/auditd-postexploit-rm
Remediation: Alert only

Detect post-exploitation behaviour : rm execve bursts

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/auditd

Installs 1 parser and 6 scenarios.

View Auditd - Post-Exploitation Detection →

Installation

sudo cscli scenarios install crowdsecurity/auditd-postexploit-rm

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/auditd-postexploit-rm.yaml· 23 linesGitHub

1type: leaky1
2#debug: true
3name: crowdsecurity/auditd-postexploit-rm
4description: "Detect post-exploitation behaviour : rm execve bursts"
5filter: evt.Meta.log_type == 'execve' && evt.Meta.exe in ['/usr/bin/rm', '/bin/rm']2
6#grouping by ppid to track on process doing a lot of invocations to rm, such as a shell script
7groupby: evt.Meta.ppid3
8leakspeed: 1s4
9capacity: 55
10blackhole: 1m6
11labels:
12  confidence: 1
13  spoofable: 0
14  classification:7
15    - attack.T1059.004
16  behavior: "linux:post-exploitation"
17  intent: anomalous
18  label: "Post Exploitation command execution"
19  service: linux
20  remediation: false8
21scope:
22  type: pid
23  expression: evt.Meta.ppid

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Auditd : burst of file suppression

Attempt to detect a process that is attempting to rm a lot of files.

This pattern is usually seen in post-exploitation behaviors where a backdoors is trying to "kill" competition.