Query: detection rule: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands
Matching passage: Sigma rule: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands. Logsource: linux / auditd. Rule: title: Unix Shell Configuration Modification id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d related: - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9 type: obsolete status: test description: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened. references: - https://objective-see.org/blog/blog_0x68.html - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat author: Peter Matkovski, IAI date: 2023-03-06 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.004 logsource: product: linux service: auditd detection: selection: type: PATH name: - /etc/shells - /etc/profile - /etc/profile.d/* - /etc/bash.bashrc - /etc/bashrc - /etc/zsh/zprofile - /etc/zsh/zshrc - /etc/zsh/zlogin - /etc/zsh/zlogout - /etc/csh.cshrc - /etc/csh.login - /root/.bashrc - /root/.bash_profile - /root/.profile - /root/.zshrc - /root/.zprofile - /home/*/.bashrc - /home/*/.zshrc - /home/*/.bash_profile - /home/*/.zprofile - /home/*/.profile - /home/*/.bash_login - /home/*/.bash_logout - /home/*/.zlogin - /home/*/.zlogout condition: selection falsepositives: - Admin or User activity are expected to generate some false positives level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Wi. Logsource: windows / process_creation. Rule: title: Renamed AutoIt Execution id: f4264e47-f522-4c38-a420-04525d5b880f status: test description: 'Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious. ' references: - https://twitter.com/malmoeb/status/1665463817130725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w - https://www.autoitscript.com/site/ author: Florian Roth (Nextron Systems) date: 2023-06-04 modified: 2024-11-23 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - ' /AutoIt3ExecuteScript' - ' /ErrorStdOut' selection_2: Hashes|contains: - IMPHASH=FDC554B3A8683918D731685855683DDF - IMPHASH=CD30A61B60B3D60CECDB034C8C83C290 - IMPHASH=F8A00C72F2D667D2EDBB234D0C0AE000 selection_3: OriginalFileName: - AutoIt3.exe - AutoIt2.exe - AutoIt.exe filter_main_legit_name: Image|endswith: - \AutoIt.exe - \AutoIt2.exe - \AutoIt3_x64.exe - \AutoIt3.exe condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high