Query: Sigma YAML for linux / auditd
Matching passage: Sigma rule: detects BPFDoor .lock and .pid files access in temporary file storage facility. Logsource: linux / auditd. Rule: title: BPFDoor Abnormal Process ID or Lock File Accessed id: 808146b2-9332-4d78-9416-d7e47012d83d status: test description: detects BPFDoor .lock and .pid files access in temporary file storage facility references: - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/ - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor - https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/ - https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh author: Rafal Piasecki date: 2022-08-10 modified: 2026-03-30 tags: - attack.execution - attack.t1106 - attack.t1059 logsource: product: linux service: auditd detection: selection: type: PATH name: - /var/run/aepmonend.pid - /var/run/auditd.lock - /var/run/cma.lock - /var/run/console-kit.pid - /var/run/consolekit.pid - /var/run/daemon.pid - /var/run/hald-addon.pid - /var/run/hald-smartd.pid - /var/run/haldrund.pid - /var/run/hp-health.pid - /var/run/hpasmlit.lock - /var/run/hpasmlited.pid - /var/run/kdevrund.pid - /var/run/lldpad.lock - /var/run/mcelog.pid - /var/run/system.pid - /var/run/uvp-srv.pid - /var/run/vmtoolagt.pid - /var/run/xinetd.lock condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in. Logsource: windows / registry_set. Rule: title: Bypass UAC Using SilentCleanup Task id: 724ea201-6514-4f38-9739-e5973c34f49a status: test description: 'Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task - https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/ - https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign author: frack113, Nextron Systems date: 2022-01-06 modified: 2024-01-30 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Environment\windir filter_main_default: Details: '%SystemRoot%' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/info.yml simulation: - type: atomic-red-team name: Bypass UAC using SilentCleanup Task technique: T1548.002 atomic_guid: 28104f8a-4ff1-4582-bcf6-699dce156608