APT Package Manager Configuration File Creation
Detects file creation events in the configuration directory for the APT package manager. In Linux, APT (Advanced Package Tool) is a command-line utility used for handling packages on (by default) Debian-based systems, providing functions for installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor APT to gain persistence by injecting malicious code into scripts that APT runs, thereby ensuring continued unauthorized access or control each time APT is used for package management.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2024/06/03"
3integration = ["endpoint"]
4maturity = "production"
5updated_date = "2025/01/15"
6
7[rule]
8author = ["Elastic"]
9description = """
10Detects file creation events in the configuration directory for the APT package manager. In Linux, APT (Advanced Package
11Tool) is a command-line utility used for handling packages on (by default) Debian-based systems, providing functions for
12installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor
13APT to gain persistence by injecting malicious code into scripts that APT runs, thereby ensuring continued unauthorized
14access or control each time APT is used for package management.
15"""
16from = "now-9m"
17index = ["logs-endpoint.events.file*"]
18language = "eql"
19license = "Elastic License v2"
20name = "APT Package Manager Configuration File Creation"
21references = [
22 "https://packetstormsecurity.com/files/152668/APT-Package-Manager-Persistence.html",
23 "https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
24]
25risk_score = 47
26rule_id = "7c2e1297-7664-42bc-af11-6d5d35220b6b"
27setup = """## Setup
28
29This rule requires data coming in from Elastic Defend.
30
31### Elastic Defend Integration Setup
32Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
33
34#### Prerequisite Requirements:
35- Fleet is required for Elastic Defend.
36- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
37
38#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
39- Go to the Kibana home page and click "Add integrations".
40- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
41- Click "Add Elastic Defend".
42- Configure the integration name and optionally add a description.
43- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
44- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
45- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
46- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
47For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
48- Click "Save and Continue".
49- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
50For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
51"""
52severity = "medium"
53tags = [
54 "Domain: Endpoint",
55 "OS: Linux",
56 "Use Case: Threat Detection",
57 "Tactic: Persistence",
58 "Tactic: Defense Evasion",
59 "Data Source: Elastic Defend",
60 "Resources: Investigation Guide",
61]
62timestamp_override = "event.ingested"
63type = "eql"
64
65query = '''
66file where host.os.type == "linux" and event.action in ("rename", "creation") and
67file.path : "/etc/apt/apt.conf.d/*" and not (
68 process.executable in (
69 "/bin/dpkg", "/usr/bin/dpkg", "/bin/dockerd", "/usr/bin/dockerd", "/usr/sbin/dockerd", "/bin/microdnf",
70 "/usr/bin/microdnf", "/bin/rpm", "/usr/bin/rpm", "/bin/snapd", "/usr/bin/snapd", "/bin/yum", "/usr/bin/yum",
71 "/bin/dnf", "/usr/bin/dnf", "/bin/podman", "/usr/bin/podman", "/bin/dnf-automatic", "/usr/bin/dnf-automatic",
72 "/bin/pacman", "/usr/bin/pacman", "/usr/bin/dpkg-divert", "/bin/dpkg-divert", "/sbin/apk", "/usr/sbin/apk",
73 "/usr/local/sbin/apk", "/usr/bin/apt", "/usr/sbin/pacman", "/bin/podman", "/usr/bin/podman", "/usr/bin/puppet",
74 "/bin/puppet", "/opt/puppetlabs/puppet/bin/puppet", "/usr/bin/chef-client", "/bin/chef-client",
75 "/bin/autossl_check", "/usr/bin/autossl_check", "/proc/self/exe", "/dev/fd/*", "/usr/bin/pamac-daemon",
76 "/bin/pamac-daemon", "/usr/lib/snapd/snapd", "/usr/local/bin/dockerd", "/usr/libexec/netplan/generate",
77 "/usr/local/bin/apt-get", "/usr/bin/apt-get"
78 ) or
79 file.path :("/etc/apt/apt.conf.d/*.tmp*") or
80 file.extension in ("swp", "swpx", "swx", "dpkg-remove") or
81 file.Ext.original.extension == "dpkg-new" or
82 process.executable : (
83 "/nix/store/*", "/var/lib/dpkg/*", "/tmp/vmis.*", "/snap/*", "/dev/fd/*", "/usr/lib/*", "/usr/libexec/*",
84 "/etc/kernel/*"
85 ) or
86 process.executable == null or
87 process.name in ("pveupdate", "perl") or
88 (process.name == "sed" and file.name : "sed*") or
89 (process.name == "perl" and file.name : "e2scrub_all.tmp*")
90)
91'''
92note = """## Triage and analysis
93
94> **Disclaimer**:
95> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
96
97### Investigating APT Package Manager Configuration File Creation
98
99APT is a crucial tool for managing software on Debian-based Linux systems, handling tasks like installation and updates. Adversaries may exploit APT by inserting malicious scripts into its configuration files, ensuring persistent access. The detection rule monitors for unauthorized file creation or renaming in APT's configuration directory, excluding legitimate processes, to identify potential tampering.
100
101### Possible investigation steps
102
103- Review the file creation or renaming event details, focusing on the file path to confirm it is within the APT configuration directory (/etc/apt/apt.conf.d/).
104- Identify the process responsible for the file creation or renaming by examining the process.executable field, ensuring it is not one of the legitimate processes listed in the query.
105- Investigate the origin and purpose of the newly created or renamed file by checking its contents for any suspicious or unauthorized scripts or configurations.
106- Correlate the event with recent system activity to determine if there are any other related alerts or anomalies, such as unusual user logins or network connections, that could indicate a broader attack.
107- Check the file's metadata, such as timestamps and ownership, to identify any discrepancies or signs of tampering that could suggest malicious activity.
108- If the process responsible for the event is unknown or suspicious, conduct a deeper analysis of the process, including its parent process, command-line arguments, and any associated network activity.
109
110### False positive analysis
111
112- Legitimate package management operations by system tools like dpkg or apt-get can trigger alerts. To manage this, ensure these processes are included in the exclusion list within the detection rule.
113- Temporary files created during package updates or installations, such as those with extensions like swp or dpkg-new, may cause false positives. Exclude these file extensions from triggering alerts.
114- Automated system maintenance scripts or tools like puppet or chef-client might modify APT configuration files as part of their normal operations. Add these processes to the exclusion list to prevent unnecessary alerts.
115- Custom scripts or administrative tasks that involve renaming or creating files in the APT configuration directory should be reviewed. If deemed safe, add these specific scripts or processes to the exclusion criteria.
116- Processes running from directories like /nix/store or /var/lib/dpkg may be part of legitimate system operations. Consider excluding these paths if they are verified as non-threatening.
117
118### Response and remediation
119
120- Immediately isolate the affected system from the network to prevent further unauthorized access or potential lateral movement by the adversary.
121- Conduct a thorough review of the newly created or renamed files in the /etc/apt/apt.conf.d/ directory to identify any malicious scripts or unauthorized changes.
122- Remove any identified malicious files or scripts from the APT configuration directory to eliminate the persistence mechanism.
123- Restore any legitimate configuration files from a known good backup to ensure the integrity of the APT configuration.
124- Perform a comprehensive scan of the system using updated antivirus or endpoint detection tools to identify and remove any additional malware or unauthorized changes.
125- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
126- Implement enhanced monitoring and logging for the APT configuration directory and related processes to detect similar threats in the future."""
127
128
129[[rule.threat]]
130framework = "MITRE ATT&CK"
131[[rule.threat.technique]]
132id = "T1543"
133name = "Create or Modify System Process"
134reference = "https://attack.mitre.org/techniques/T1543/"
135
136[[rule.threat.technique]]
137id = "T1546"
138name = "Event Triggered Execution"
139reference = "https://attack.mitre.org/techniques/T1546/"
140[[rule.threat.technique.subtechnique]]
141id = "T1546.016"
142name = "Installer Packages"
143reference = "https://attack.mitre.org/techniques/T1546/016/"
144
145
146[[rule.threat.technique]]
147id = "T1574"
148name = "Hijack Execution Flow"
149reference = "https://attack.mitre.org/techniques/T1574/"
150
151
152[rule.threat.tactic]
153id = "TA0003"
154name = "Persistence"
155reference = "https://attack.mitre.org/tactics/TA0003/"
156[[rule.threat]]
157framework = "MITRE ATT&CK"
158
159[rule.threat.tactic]
160id = "TA0005"
161name = "Defense Evasion"
162reference = "https://attack.mitre.org/tactics/TA0005/"
Triage and analysis
Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
Investigating APT Package Manager Configuration File Creation
APT is a crucial tool for managing software on Debian-based Linux systems, handling tasks like installation and updates. Adversaries may exploit APT by inserting malicious scripts into its configuration files, ensuring persistent access. The detection rule monitors for unauthorized file creation or renaming in APT's configuration directory, excluding legitimate processes, to identify potential tampering.
Possible investigation steps
- Review the file creation or renaming event details, focusing on the file path to confirm it is within the APT configuration directory (/etc/apt/apt.conf.d/).
- Identify the process responsible for the file creation or renaming by examining the process.executable field, ensuring it is not one of the legitimate processes listed in the query.
- Investigate the origin and purpose of the newly created or renamed file by checking its contents for any suspicious or unauthorized scripts or configurations.
- Correlate the event with recent system activity to determine if there are any other related alerts or anomalies, such as unusual user logins or network connections, that could indicate a broader attack.
- Check the file's metadata, such as timestamps and ownership, to identify any discrepancies or signs of tampering that could suggest malicious activity.
- If the process responsible for the event is unknown or suspicious, conduct a deeper analysis of the process, including its parent process, command-line arguments, and any associated network activity.
False positive analysis
- Legitimate package management operations by system tools like dpkg or apt-get can trigger alerts. To manage this, ensure these processes are included in the exclusion list within the detection rule.
- Temporary files created during package updates or installations, such as those with extensions like swp or dpkg-new, may cause false positives. Exclude these file extensions from triggering alerts.
- Automated system maintenance scripts or tools like puppet or chef-client might modify APT configuration files as part of their normal operations. Add these processes to the exclusion list to prevent unnecessary alerts.
- Custom scripts or administrative tasks that involve renaming or creating files in the APT configuration directory should be reviewed. If deemed safe, add these specific scripts or processes to the exclusion criteria.
- Processes running from directories like /nix/store or /var/lib/dpkg may be part of legitimate system operations. Consider excluding these paths if they are verified as non-threatening.
Response and remediation
- Immediately isolate the affected system from the network to prevent further unauthorized access or potential lateral movement by the adversary.
- Conduct a thorough review of the newly created or renamed files in the /etc/apt/apt.conf.d/ directory to identify any malicious scripts or unauthorized changes.
- Remove any identified malicious files or scripts from the APT configuration directory to eliminate the persistence mechanism.
- Restore any legitimate configuration files from a known good backup to ensure the integrity of the APT configuration.
- Perform a comprehensive scan of the system using updated antivirus or endpoint detection tools to identify and remove any additional malware or unauthorized changes.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
- Implement enhanced monitoring and logging for the APT configuration directory and related processes to detect similar threats in the future.
References
Related rules
- DNF Package Manager Plugin File Creation
- Directory Creation in /bin directory
- Dynamic Linker (ld.so) Creation
- Git Hook Child Process
- Git Hook Command Execution