Virtual Machine Fingerprinting

  1[metadata]
  2creation_date = "2020/04/27"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2025/01/15"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies
 11common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy
 12RAT and other malware.
 13"""
 14false_positives = [
 15    """
 16    Certain tools or automated software may enumerate hardware information. These tools can be exempted via user name or
 17    process arguments to eliminate potential noise.
 18    """,
 19]
 20from = "now-9m"
 21index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "Virtual Machine Fingerprinting"
 25risk_score = 73
 26rule_id = "5b03c9fb-9945-4d2f-9568-fd690fee3fba"
 27setup = """## Setup
 28
 29This rule requires data coming in from one of the following integrations:
 30- Elastic Defend
 31- Auditbeat
 32
 33### Elastic Defend Integration Setup
 34Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 35
 36#### Prerequisite Requirements:
 37- Fleet is required for Elastic Defend.
 38- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 39
 40#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 41- Go to the Kibana home page and click "Add integrations".
 42- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 43- Click "Add Elastic Defend".
 44- Configure the integration name and optionally add a description.
 45- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 46- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 47- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 48- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 49For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 50- Click "Save and Continue".
 51- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 52For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 53
 54### Auditbeat Setup
 55Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 56
 57#### The following steps should be executed in order to add the Auditbeat on a Linux System:
 58- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
 59- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
 60- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
 61- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
 62- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 63"""
 64severity = "high"
 65tags = [
 66    "Domain: Endpoint",
 67    "OS: Linux",
 68    "Use Case: Threat Detection",
 69    "Tactic: Discovery",
 70    "Data Source: Elastic Endgame",
 71    "Data Source: Elastic Defend",
 72    "Resources: Investigation Guide",
 73]
 74timestamp_override = "event.ingested"
 75type = "query"
 76
 77query = '''
 78event.category:process and host.os.type:linux and event.type:(start or process_started) and
 79  process.args:("/sys/class/dmi/id/bios_version" or
 80                "/sys/class/dmi/id/product_name" or
 81                "/sys/class/dmi/id/chassis_vendor" or
 82                "/proc/scsi/scsi" or
 83                "/proc/ide/hd0/model") and
 84  not user.name:root
 85'''
 86note = """## Triage and analysis
 87
 88> **Disclaimer**:
 89> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 90
 91### Investigating Virtual Machine Fingerprinting
 92
 93Virtual Machine Fingerprinting involves identifying characteristics of a virtual environment, often to tailor attacks or evade detection. Adversaries exploit this by querying system files for hardware details, a tactic seen in malware like Pupy RAT. The detection rule flags non-root users accessing specific Linux paths indicative of VM queries, signaling potential reconnaissance activities.
 94
 95### Possible investigation steps
 96
 97- Review the process execution details to identify the non-root user involved in accessing the specified paths, focusing on the user.name field.
 98- Examine the process.args field to determine which specific file paths were accessed, as this can indicate the type of virtual machine information being targeted.
 99- Investigate the parent process and command line arguments to understand the context of the process initiation and whether it aligns with legitimate user activity.
100- Check for any related alerts or logs around the same timeframe to identify potential patterns or repeated attempts at virtual machine fingerprinting.
101- Assess the system for any signs of compromise or unauthorized access, particularly focusing on the presence of known malware like Pupy RAT or similar threats.
102- Correlate the findings with MITRE ATT&CK framework references (TA0007, T1082) to understand the broader tactics and techniques potentially in use by the adversary.
103
104### False positive analysis
105
106- Non-root users running legitimate scripts or applications that query system files for hardware information may trigger the rule. Review the context of the process and user activity to determine if it aligns with expected behavior.
107- System administrators or developers using automated tools for inventory or monitoring purposes might access these paths. Consider creating exceptions for known tools or scripts that are verified as safe.
108- Security or compliance audits conducted by non-root users could inadvertently match the rule's criteria. Document and whitelist these activities if they are part of regular operations.
109- Development environments where virtual machine detection is part of testing processes may cause false positives. Identify and exclude these environments from the rule's scope if they are consistently flagged.
110- Regularly review and update the list of exceptions to ensure that only verified and necessary exclusions are maintained, minimizing the risk of overlooking genuine threats.
111
112### Response and remediation
113
114- Immediately isolate the affected system from the network to prevent further reconnaissance or potential lateral movement by the adversary.
115- Terminate any suspicious processes identified in the alert that are attempting to access the specified system files, especially those not initiated by the root user.
116- Conduct a thorough review of recent user activity and process logs to identify any unauthorized access or anomalies that may indicate further compromise.
117- Reset credentials for any non-root users involved in the alert to prevent unauthorized access, and review user permissions to ensure least privilege principles are enforced.
118- Deploy endpoint detection and response (EDR) tools to monitor for similar suspicious activities and enhance visibility into system processes and user actions.
119- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
120- Implement additional monitoring and alerting for the specific file paths and processes identified in the query to detect and respond to future attempts at virtual machine fingerprinting."""
121
122
123[[rule.threat]]
124framework = "MITRE ATT&CK"
125[[rule.threat.technique]]
126id = "T1082"
127name = "System Information Discovery"
128reference = "https://attack.mitre.org/techniques/T1082/"
129
130
131[rule.threat.tactic]
132id = "TA0007"
133name = "Discovery"
134reference = "https://attack.mitre.org/tactics/TA0007/"