Linux HackTool Execution
A Sigma rule for process creation on Linux, by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure]).
high 1 ATT&CK technique 24 programs it names 118 everyday examples trip it
What it looks for
detection:
selection_c2_framework_cobaltstrike:
Image|contains:
- '/cobaltstrike'
- '/teamserver'
selection_c2_frameworks:
Image|endswith:
- '/crackmapexec'
- '/havoc'
- '/merlin-agent'
- '/merlinServer-Linux-x64'
- '/msfconsole'
- '/msfvenom'
- '/ps-empire server'
- '/ps-empire'
- '/sliver-client'
- '/sliver-server'
- '/Villain.py'
selection_exploit_tools:
Image|endswith:
- '/aircrack-ng'
- '/bloodhound-python'
- '/bpfdos'
- '/ebpfki'
- '/evil-winrm'
- '/hashcat'
- '/hoaxshell.py'
- '/hydra'
- '/john'
- '/ncrack'
- '/nxc-ubuntu-latest'
- '/pidhide'
- '/pspy32'
- '/pspy32s'
- '/pspy64'
- '/pspy64s'
- '/setoolkit'
- '/sqlmap'
- '/writeblocker'
selection_linpeas:
Image|contains: '/linpeas'
selection_scanners:
Image|endswith:
- '/autorecon'
- '/httpx'
- '/legion'
- '/naabu'
- '/netdiscover'
- '/nuclei'
- '/recon-ng'
selection_scanners_sniper:
Image|contains: '/sniper'
selection_web_enum:
Image|endswith:
- '/dirb'
- '/dirbuster'
- '/eyewitness'
- '/feroxbuster'
- '/ffuf'
- '/gobuster'
- '/wfuzz'
- '/whatweb'
selection_web_vuln:
Image|endswith:
- '/joomscan'
- '/nikto'
- '/wpscan'
condition: 1 of selection_*
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure]), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Perform a brute-force attack (mode 3) with the default hashcat mask on the page for hashcat
hashcat --hash-type hash_type_id --attack-mode 3 hash_valueIdentifyPerform a brute-force attack (mode 3) with a known pattern of 4 digits on the page for hashcat
hashcat --hash-type hash_type_id --attack-mode 3 hash_value "?d?d?d?d"IdentifyPerform a brute-force attack (mode 3) using at most 8 of all printable ASCII characters on the page for hashcat
hashcat --hash-type hash_type_id --attack-mode 3 --increment hash_value "?a?a?a?a?a?a?a?a"IdentifyLaunch the interactive console (append --quiet to suppress the startup banner) on the page for msfconsole
sudo msfconsoleIdentifyExecute console commands (Note: Use ; for passing multiple commands) on the page for msfconsole
sudo msfconsole --execute-command "use auxiliary/scanner/portscan/tcp; set PORTS 80,443; set RHOSTS example.com; run; quit"IdentifyRun a specific resource file on the page for msfconsole
sudo msfconsole --resource path/to/file.rcIdentifyCrack key from capture file using wordlist on the page for aircrack-ng
aircrack-ng -w path/to/wordlist.txt path/to/capture.capIdentifyCrack key using multiple CPU threads from capture file using wordlist on the page for aircrack-ng
aircrack-ng -p number -w path/to/wordlist.txt path/to/capture.capIdentifyCrack key from capture file using wordlist and the access point's essid on the page for aircrack-ng
aircrack-ng -w path/to/wordlist.txt -e extended_ssid path/to/capture.capIdentifyCrack key from capture file using wordlist and the access point's MAC address on the page for aircrack-ng
aircrack-ng -w path/to/wordlist.txt --bssid mac path/to/capture.capIdentifyPerform reconnaissance on target host(s) (detailed scan results will be dumped in results) on the page for autorecon
sudo autorecon host_or_ip1,host_or_ip2,...IdentifyPerform reconnaissance on target(s) from a file on the page for autorecon
sudo autorecon --target-file path/to/fileIdentifyAnd 106 more examples on CmdID’s program pages.
The commands documented for hashcat, msfconsole, sqlmap trip it too: each is on its program’s page, read by CmdID.