Potential Persistence via File Modification

  1[metadata]
  2creation_date = "2024/06/03"
  3integration = ["fim"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule leverages the File Integrity Monitoring (FIM) integration to detect file modifications of files that are
 11commonly used for persistence on Linux systems. The rule detects modifications to files that are commonly used for cron
 12jobs, systemd services, message-of-the-day (MOTD), SSH configurations, shell configurations, runtime control, init
 13daemon, passwd/sudoers/shadow files, Systemd udevd, and XDG/KDE autostart entries. To leverage this rule, the paths
 14specified in the query need to be added to the FIM policy in the Elastic Security app.
 15"""
 16from = "now-9m"
 17index = ["logs-fim.event-*", "auditbeat-*"]
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Potential Persistence via File Modification"
 21references = [
 22    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
 23    "https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
 24    "https://www.elastic.co/security-labs/continuation-on-persistence-mechanisms",
 25    "https://www.elastic.co/security-labs/approaching-the-summit-on-persistence",
 26    "https://www.elastic.co/security-labs/the-grand-finale-on-linux-persistence",
 27    "https://slayer0x.github.io/awscli/",
 28]
 29risk_score = 21
 30rule_id = "192657ba-ab0e-4901-89a2-911d611eee98"
 31setup = """## Setup
 32
 33This rule requires data coming in from the Elastic File Integrity Monitoring (FIM) integration.
 34
 35### Elastic FIM Integration Setup
 36To configure the Elastic FIM integration, follow these steps:
 37
 381. Install and configure the Elastic Agent on your Linux system. You can refer to the [Elastic Agent documentation](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html) for detailed instructions.
 392. Once the Elastic Agent is installed, navigate to the Elastic Security app in Kibana.
 403. In the Kibana home page, click on "Integrations" in the left sidebar.
 414. Search for "File Integrity Monitoring" in the search bar and select the integration.
 425. Provide a name and optional description for the integration.
 436. Select the appropriate agent policy for your Linux system or create a new one.
 447. Configure the FIM policy by specifying the paths that you want to monitor for file modifications. You can use the same paths mentioned in the `query` field of the rule. Note that FIM does not accept wildcards in the paths, so you need to specify the exact paths you want to monitor.
 458. Save the configuration and the Elastic Agent will start monitoring the specified paths for file modifications.
 46
 47For more details on configuring the Elastic FIM integration, you can refer to the [Elastic FIM documentation](https://docs.elastic.co/integrations/fim).
 48"""
 49severity = "low"
 50tags = [
 51    "Domain: Endpoint",
 52    "OS: Linux",
 53    "Use Case: Threat Detection",
 54    "Tactic: Persistence",
 55    "Tactic: Credential Access",
 56    "Tactic: Privilege Escalation",
 57    "Tactic: Defense Evasion",
 58    "Data Source: File Integrity Monitoring",
 59    "Resources: Investigation Guide",
 60    "Noise: Medium",
 61    "Performance: Normal",
 62    "Rule Type: Event Correlation (EQL)",
 63    "Platform: Linux",
 64]
 65timestamp_override = "event.ingested"
 66type = "eql"
 67
 68query = '''
 69file where host.os.type == "linux" and data_stream.dataset == "fim.event" and event.action == "updated" and
 70file.path : (
 71  // cron, anacron & at
 72  "/etc/cron.d/*", "/etc/cron.daily/*", "/etc/cron.hourly/*", "/etc/cron.monthly/*",
 73  "/etc/cron.weekly/*", "/etc/crontab", "/var/spool/cron/crontabs/*", "/etc/cron.allow",
 74  "/etc/cron.deny",  "/var/spool/anacron/*", "/var/spool/cron/atjobs/*",
 75
 76  // systemd services & timers
 77  "/etc/systemd/system/*", "/usr/local/lib/systemd/system/*", "/lib/systemd/system/*",
 78  "/usr/lib/systemd/system/*", "/home/*/.config/systemd/user/*", "/home/*/.local/share/systemd/user/*",
 79  "/root/.config/systemd/user/*", "/root/.local/share/systemd/user/*",
 80
 81  // LD_PRELOAD
 82  "/etc/ld.so.preload", "/etc/ld.so.conf.d/*", "/etc/ld.so.conf",
 83
 84  // Dynamic linker
 85  "/lib/ld-linux*.so*", "/lib64/ld-linux*.so*", "/usr/lib/ld-linux*.so*", "/usr/lib64/ld-linux*.so*",
 86
 87  // message-of-the-day (MOTD)
 88  "/etc/update-motd.d/*",
 89
 90  // SSH
 91  "/home/*/.ssh/*", "/root/.ssh/*", "/etc/ssh/*",
 92
 93  // system-wide shell configurations
 94  "/etc/profile", "/etc/profile.d/*", "/etc/bash.bashrc", "/etc/zsh/*", "/etc/csh.cshrc",
 95  "/etc/csh.login", "/etc/fish/config.fish", "/etc/ksh.kshrc",
 96
 97  // root and user shell configurations
 98  "/home/*/.profile", "/home/*/.bashrc", "/home/*/.bash_login", "/home/*/.bash_logout",
 99  "/root/.profile", "/root/.bashrc", "/root/.bash_login", "/root/.bash_logout",
100  "/home/*/.zprofile", "/home/*/.zshrc", "/root/.zprofile", "/root/.zshrc",
101  "/home/*/.cshrc", "/home/*/.login", "/home/*/.logout", "/root/.cshrc", "/root/.login", "/root/.logout",
102  "/home/*/.config/fish/config.fish", "/root/.config/fish/config.fish",
103  "/home/*/.kshrc", "/root/.kshrc",
104
105  // Alias files
106  "/home/*/.bash_aliases", "/root/.bash_aliases", "/home/*/.zsh_aliases", "/root/.zsh_aliases",
107  "/home/*/.aws/cli/alias", "/root/.aws/cli/alias", 
108
109  // runtime control
110  "/etc/rc.common", "/etc/rc.local",
111
112  // System V init/Upstart
113  "/etc/init.d/*", "/etc/init/*",
114
115  // passwd/sudoers/shadow
116  "/etc/passwd", "/etc/shadow", "/etc/sudoers", "/etc/sudoers.d/*",
117
118  // Systemd udevd
119  "/lib/udev/*", "/etc/udev/rules.d/*", "/usr/lib/udev/rules.d/*", "/run/udev/rules.d/*", "/usr/local/lib/udev/rules.d/*",
120
121  // XDG/KDE autostart entries
122  "/home/*/.config/autostart/*", "/root/.config/autostart/*", "/etc/xdg/autostart/*", "/usr/share/autostart/*",
123  "/home/*/.kde/Autostart/*", "/root/.kde/Autostart/*",
124  "/home/*/.kde4/Autostart/*", "/root/.kde4/Autostart/*",
125  "/home/*/.kde/share/autostart/*", "/root/.kde/share/autostart/*",
126  "/home/*/.kde4/share/autostart/*", "/root/.kde4/share/autostart/*",
127  "/home/*/.local/share/autostart/*", "/root/.local/share/autostart/*",
128  "/home/*/.config/autostart-scripts/*", "/root/.config/autostart-scripts/*",
129
130  // LKM configuration files
131  "/etc/modules", "/etc/modprobe.d/*", "/usr/lib/modprobe.d/*", "/etc/modules-load.d/*",
132  "/run/modules-load.d/*", "/usr/local/lib/modules-load.d/*", "/usr/lib/modules-load.d/*",
133
134  // PAM modules & configuration files
135  "/lib/security/*", "/lib64/security/*", "/usr/lib/security/*", "/usr/lib64/security/*",
136  "/lib/x86_64-linux-gnu/security/*", "/usr/lib/x86_64-linux-gnu/security/*",
137  "/etc/pam.d/*", "/etc/security/pam_*", "/etc/pam.conf",
138
139  // Polkit Rule files
140  "/etc/polkit-1/rules.d/*", "/usr/share/polkit-1/rules.d/*",
141
142  // Polkit pkla files
143  "/etc/polkit-1/localauthority/*", "/var/lib/polkit-1/localauthority/*",
144
145  // Polkit Action files
146  "/usr/share/polkit-1/actions/*",
147
148  // Polkit Legacy paths
149  "/lib/polkit-1/rules.d/*", "/lib64/polkit-1/rules.d/*", "/var/lib/polkit-1/rules.d/*",
150
151  // NetworkManager
152  "/etc/NetworkManager/dispatcher.d/*",
153
154  // D-bus Service files
155  "/usr/share/dbus-1/system-services/*", "/etc/dbus-1/system.d/*",
156  "/lib/dbus-1/system-services/*", "/run/dbus/system.d/*",
157  "/home/*/.local/share/dbus-1/services/*", "/home/*/.dbus/session-bus/*",
158  "/usr/share/dbus-1/services/*", "/etc/dbus-1/session.d/*",
159
160  // GRUB
161  "/etc/default/grub.d/*", "/etc/default/grub", "/etc/grub.d/*", "/boot/grub2/grub.cfg",
162  "/boot/grub/grub.cfg", "/boot/efi/EFI/*/grub.cfg", "/etc/sysconfig/grub",
163
164  // Dracut
165  "/lib/dracut/modules.d/*", "/usr/lib/dracut/modules.d/*",
166
167  // Misc.
168  "/etc/shells"
169
170) and not (
171  file.path : (
172    "/var/spool/cron/crontabs/tmp.*", "/run/udev/rules.d/*rules.*", "/home/*/.ssh/known_hosts.*", "/root/.ssh/known_hosts.*"
173  ) or
174  file.extension in ("dpkg-new", "dpkg-remove", "SEQ")
175)
176'''
177note = """## Triage and analysis
178
179> **Disclaimer**:
180> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
181
182### Investigating Potential Persistence via File Modification
183
184File Integrity Monitoring (FIM) is crucial for detecting unauthorized changes to critical files, often targeted by adversaries for persistence. Attackers may modify cron jobs, systemd services, or shell configurations to maintain access or escalate privileges. The detection rule monitors these files for updates, flagging potential persistence attempts by identifying suspicious modifications outside normal operations.
185
186### Possible investigation steps
187
188- Review the file path from the alert to determine which specific file was modified and assess its role in the system, focusing on paths commonly used for persistence such as cron jobs, systemd services, or shell configurations.
189- Check the timestamp of the modification event to correlate it with any known legitimate changes or scheduled maintenance activities, ensuring the modification was not part of normal operations.
190- Investigate the user or process responsible for the modification by examining the associated user ID or process ID, and verify if the user or process has legitimate reasons to alter the file.
191- Analyze recent login and session activity for the user or process involved in the modification to identify any unusual patterns or unauthorized access attempts.
192- Cross-reference the modification event with other security logs or alerts to identify any related suspicious activities, such as privilege escalation attempts or unauthorized access to sensitive files.
193- If the modified file is a configuration file, review its contents for any unauthorized or suspicious entries that could indicate persistence mechanisms, such as new cron jobs or altered systemd service configurations.
194
195### False positive analysis
196
197- Routine system updates or package installations may modify files monitored by the rule, such as those in /etc/cron.d or /etc/systemd/system. To manage these, consider excluding specific file paths or extensions like dpkg-new and dpkg-remove during known maintenance windows.
198- User-specific configuration changes, such as updates to shell profiles in /home/*/.bashrc, can trigger alerts. Implement exceptions for user directories where frequent legitimate changes occur, ensuring these are well-documented and reviewed regularly.
199- Automated scripts or management tools that update system configurations, like /etc/ssh/sshd_config, can cause false positives. Identify these tools and create exceptions for their expected file modification patterns.
200- Temporary files created during system operations, such as /var/spool/cron/crontabs/tmp.*, may be flagged. Exclude these temporary paths to reduce noise while maintaining security oversight.
201- Regular updates to known_hosts files in /home/*/.ssh/known_hosts can be mistaken for suspicious activity. Exclude these files from monitoring to prevent unnecessary alerts while ensuring SSH configurations are still monitored.
202
203### Response and remediation
204
205- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the attacker.
206- Review the specific file modifications flagged by the alert to determine if they are unauthorized or malicious. Restore any altered files to their last known good state using backups or system snapshots.
207- Change all passwords and SSH keys associated with the affected system to prevent unauthorized access using compromised credentials.
208- Conduct a thorough scan of the system for additional indicators of compromise, such as unauthorized user accounts or unexpected running processes, and remove any malicious artifacts found.
209- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if other systems may be affected.
210- Implement additional monitoring on the affected system and similar systems to detect any further unauthorized file modifications or suspicious activities.
211- Review and update access controls and permissions on critical files and directories to minimize the risk of unauthorized modifications in the future."""
212
213[[rule.threat]]
214framework = "MITRE ATT&CK"
215
216[[rule.threat.technique]]
217id = "T1037"
218name = "Boot or Logon Initialization Scripts"
219reference = "https://attack.mitre.org/techniques/T1037/"
220
221[[rule.threat.technique.subtechnique]]
222id = "T1037.004"
223name = "RC Scripts"
224reference = "https://attack.mitre.org/techniques/T1037/004/"
225
226[[rule.threat.technique]]
227id = "T1053"
228name = "Scheduled Task/Job"
229reference = "https://attack.mitre.org/techniques/T1053/"
230
231[[rule.threat.technique.subtechnique]]
232id = "T1053.002"
233name = "At"
234reference = "https://attack.mitre.org/techniques/T1053/002/"
235
236[[rule.threat.technique]]
237id = "T1098"
238name = "Account Manipulation"
239reference = "https://attack.mitre.org/techniques/T1098/"
240
241[[rule.threat.technique.subtechnique]]
242id = "T1098.004"
243name = "SSH Authorized Keys"
244reference = "https://attack.mitre.org/techniques/T1098/004/"
245
246[[rule.threat.technique]]
247id = "T1136"
248name = "Create Account"
249reference = "https://attack.mitre.org/techniques/T1136/"
250
251[[rule.threat.technique.subtechnique]]
252id = "T1136.001"
253name = "Local Account"
254reference = "https://attack.mitre.org/techniques/T1136/001/"
255
256[[rule.threat.technique]]
257id = "T1543"
258name = "Create or Modify System Process"
259reference = "https://attack.mitre.org/techniques/T1543/"
260
261[[rule.threat.technique.subtechnique]]
262id = "T1543.002"
263name = "Systemd Service"
264reference = "https://attack.mitre.org/techniques/T1543/002/"
265
266[[rule.threat.technique]]
267id = "T1546"
268name = "Event Triggered Execution"
269reference = "https://attack.mitre.org/techniques/T1546/"
270
271[[rule.threat.technique.subtechnique]]
272id = "T1546.004"
273name = "Unix Shell Configuration Modification"
274reference = "https://attack.mitre.org/techniques/T1546/004/"
275
276[[rule.threat.technique.subtechnique]]
277id = "T1546.017"
278name = "Udev Rules"
279reference = "https://attack.mitre.org/techniques/T1546/017/"
280
281[[rule.threat.technique]]
282id = "T1547"
283name = "Boot or Logon Autostart Execution"
284reference = "https://attack.mitre.org/techniques/T1547/"
285
286[[rule.threat.technique.subtechnique]]
287id = "T1547.006"
288name = "Kernel Modules and Extensions"
289reference = "https://attack.mitre.org/techniques/T1547/006/"
290
291[[rule.threat.technique.subtechnique]]
292id = "T1547.013"
293name = "XDG Autostart Entries"
294reference = "https://attack.mitre.org/techniques/T1547/013/"
295
296[[rule.threat.technique]]
297id = "T1556"
298name = "Modify Authentication Process"
299reference = "https://attack.mitre.org/techniques/T1556/"
300
301[[rule.threat.technique]]
302id = "T1574"
303name = "Hijack Execution Flow"
304reference = "https://attack.mitre.org/techniques/T1574/"
305
306[[rule.threat.technique.subtechnique]]
307id = "T1574.006"
308name = "Dynamic Linker Hijacking"
309reference = "https://attack.mitre.org/techniques/T1574/006/"
310
311[rule.threat.tactic]
312id = "TA0003"
313name = "Persistence"
314reference = "https://attack.mitre.org/tactics/TA0003/"
315
316[[rule.threat]]
317framework = "MITRE ATT&CK"
318
319[[rule.threat.technique]]
320id = "T1053"
321name = "Scheduled Task/Job"
322reference = "https://attack.mitre.org/techniques/T1053/"
323
324[[rule.threat.technique.subtechnique]]
325id = "T1053.003"
326name = "Cron"
327reference = "https://attack.mitre.org/techniques/T1053/003/"
328
329[[rule.threat.technique]]
330id = "T1548"
331name = "Abuse Elevation Control Mechanism"
332reference = "https://attack.mitre.org/techniques/T1548/"
333
334[[rule.threat.technique.subtechnique]]
335id = "T1548.003"
336name = "Sudo and Sudo Caching"
337reference = "https://attack.mitre.org/techniques/T1548/003/"
338
339[rule.threat.tactic]
340id = "TA0004"
341name = "Privilege Escalation"
342reference = "https://attack.mitre.org/tactics/TA0004/"
343
344[[rule.threat]]
345framework = "MITRE ATT&CK"
346
347[[rule.threat.technique]]
348id = "T1556"
349name = "Modify Authentication Process"
350reference = "https://attack.mitre.org/techniques/T1556/"
351
352[rule.threat.tactic]
353id = "TA0006"
354name = "Credential Access"
355reference = "https://attack.mitre.org/tactics/TA0006/"
356
357[[rule.threat]]
358framework = "MITRE ATT&CK"
359
360[[rule.threat.technique]]
361id = "T1014"
362name = "Rootkit"
363reference = "https://attack.mitre.org/techniques/T1014/"
364
365[rule.threat.tactic]
366id = "TA0005"
367name = "Defense Evasion"
368reference = "https://attack.mitre.org/tactics/TA0005/"