[New Rules] PAM Module Creation & Unusual PAM Grantor #3743

Aegrah · 2024-06-03T11:14:40Z

Summary

Research related to this PR is conducted and documented in https://github.com/elastic/ia-trade-team/issues/374. This issue also contains the query + validation aspect.

This PR:

Adds a new rule for PAM configuration/module creation. This is also already part of https://github.com/elastic/detection-rules/blob/main/rules/cross-platform/persistence_credential_access_modify_auth_module_or_config.toml to some extend, however this rule needs constant tuning, and becomes rather complicated due to its cross-platform nature. Once this rules works well, I will deprecate the CP PAM rule, and split it into a MacOS/Linux rule.
Adds an auditd rule for an unusual data grantor that does not require additional auditd configuration to set up.

Using the new_terms value, it will reduce noise. The screenshot above is my custom-built PAM backdoor.

rules/linux/persistence_pluggable_authentication_module_creation.toml

terrancedejesus

Very nice, asked a question about broadening PAM file name scope.

rules/linux/persistence_pluggable_authentication_module_creation.toml

…on.toml

rules/linux/persistence_pluggable_authentication_module_creation.toml

rules/linux/persistence_unusual_pam_grantor.toml

rules/linux/persistence_pluggable_authentication_module_creation.toml

…on.toml

* [New Rules] PAM Module Creation & Unusual PAM Grantor * Update persistence_unusual_pam_grantor.toml * Update persistence_pluggable_authentication_module_creation.toml * Update rules/linux/persistence_pluggable_authentication_module_creation.toml * Update persistence_pluggable_authentication_module_creation.toml * Update persistence_unusual_pam_grantor.toml * Update rules/linux/persistence_pluggable_authentication_module_creation.toml (cherry picked from commit c87c4c9)

[New Rules] PAM Module Creation & Unusual PAM Grantor

f950c6f

Aegrah added OS: Linux Rule: New Proposal for new rule Area: RAD Team: TRADE labels Jun 3, 2024

Aegrah self-assigned this Jun 3, 2024

Update persistence_unusual_pam_grantor.toml

8024f64

Aegrah marked this pull request as ready for review June 3, 2024 11:44

Aegrah requested review from w0rk3r, imays11 and terrancedejesus June 3, 2024 11:44

github-actions bot added the backport: auto label Jun 3, 2024

terrancedejesus reviewed Jun 4, 2024

View reviewed changes

rules/linux/persistence_pluggable_authentication_module_creation.toml Outdated Show resolved Hide resolved

botelastic bot added the Domain: Endpoint label Jun 4, 2024

terrancedejesus approved these changes Jun 4, 2024

View reviewed changes

Update persistence_pluggable_authentication_module_creation.toml

7f3a695

Aegrah commented Jun 6, 2024

View reviewed changes

rules/linux/persistence_pluggable_authentication_module_creation.toml Outdated Show resolved Hide resolved

Update rules/linux/persistence_pluggable_authentication_module_creati…

0cbdcb3

…on.toml

Aegrah requested review from DefSecSentinel and Samirbous June 11, 2024 08:56

Samirbous approved these changes Jun 11, 2024

View reviewed changes

Aegrah added 3 commits June 11, 2024 11:38

Update persistence_pluggable_authentication_module_creation.toml

282bd48

Update persistence_unusual_pam_grantor.toml

7e4d08f

Merge branch 'main' into new-rule-pam-module-creation

ef18d3e

Aegrah commented Jun 11, 2024

View reviewed changes

rules/linux/persistence_pluggable_authentication_module_creation.toml Outdated Show resolved Hide resolved

Aegrah added 2 commits June 11, 2024 11:43

Update rules/linux/persistence_pluggable_authentication_module_creati…

17349ac

…on.toml

Merge branch 'main' into new-rule-pam-module-creation

441189b

Aegrah merged commit c87c4c9 into main Jun 11, 2024
9 checks passed

Aegrah deleted the new-rule-pam-module-creation branch June 11, 2024 09:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[New Rules] PAM Module Creation & Unusual PAM Grantor #3743

[New Rules] PAM Module Creation & Unusual PAM Grantor #3743

Aegrah commented Jun 3, 2024

terrancedejesus left a comment

[New Rules] PAM Module Creation & Unusual PAM Grantor #3743

[New Rules] PAM Module Creation & Unusual PAM Grantor #3743

Conversation

Aegrah commented Jun 3, 2024

Summary

terrancedejesus left a comment

Choose a reason for hiding this comment