Query: Sigma rule for All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -
Matching passage: Sigma rule: All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -. Logsource: linux / auditd. Rule: title: Bpfdoor TCP Ports Redirect id: 70b4156e-50fc-4523-aa50-c9dddf1993fc status: test description: 'All TCP traffic on particular port from attacker is routed to different port. ex. ''/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only. ' references: - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/ - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor author: Rafal Piasecki date: 2022-08-10 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: auditd detection: cmd: type: EXECVE a0|endswith: iptables a1: -t a2: nat keywords: - --to-ports 42 - --to-ports 43 condition: cmd and keywords falsepositives: - Legitimate ports redirect level: medium
Near-miss passage: Sigma rule: Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping. Logsource: windows / process_creation. Rule: title: Webshell Hacking Activity Patterns id: 4ebc877f-4612-45cb-b3a5-8e3834db36c9 status: test description: 'Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system ' references: - https://youtu.be/7aemGhaE9ds?t=641 author: Florian Roth (Nextron Systems) date: 2022-03-17 modified: 2023-11-09 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \w3wp.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - catalina.jar - CATALINA_HOME selection_child_1: CommandLine|contains|all: - rundll32 - comsvcs selection_child_2: CommandLine|contains|all: - ' -hp' - ' a ' - ' -m' selection_child_3: CommandLine|contains|all: - net - ' user ' - ' /add' selection_child_4: CommandLine|contains|all: - net - ' localgroup ' - ' administrators ' - /add selection_child_5: Image|endswith: - \ntdsutil.exe - \ldifde.exe - \adfind.exe - \procdump.exe - \Nanodump.exe - \vssadmin.exe - \fsutil.exe selection_child_6: CommandLine|contains: - ' -decode ' - ' -NoP ' - ' -W Hidden ' - ' /decode ' - ' /ticket:' - ' sekurlsa' - .dmp full - .downloadfile( - .downloadstring( - FromBase64String - process call create - 'reg save ' - whoami /priv condition: 1 of selection_webserver_* and 1 of selection_child_* falsepositives: - Unlikely level: high