Credential Access - Rules update - #356
Merged
Merged
Conversation
paolo9921
force-pushed
the
new-rules/credential_access
branch
from
July 11, 2025 10:34
b5efb08 to
46d4d4e
Compare
banditopazzo
requested changes
Jul 14, 2025
banditopazzo
left a comment
banditopazzo
left a comment
Member
There was a problem hiding this comment.
please take a look a the review. I added also a few questions
|
|
||
| - name: Network Connection to IMDS API | ||
| type: Connect | ||
| category: discovery |
Member
There was a problem hiding this comment.
is it discovery or credential_access?
| - name: Read SSH information | ||
| type: FileOpened | ||
| category: credential_access | ||
| category: execution |
Member
There was a problem hiding this comment.
is it credential_access or execution?
|
|
||
| - name: DHCP Network Discover | ||
| type: Send | ||
| category: impact |
Member
There was a problem hiding this comment.
is it impact or credential_access?
| payload.filename STARTS_WITH "/root/.cache/" OR | ||
| payload.filename STARTS_WITH "/root/.docker/") | ||
| ) | ||
| OR (header.image IN [ |
| condition: header.image ENDS_WITH "/unshadow" AND payload.argc >= 2 No newline at end of file | ||
| condition: header.image ENDS_WITH "/unshadow" AND payload.argc >= 2 | ||
|
|
||
| - name: strace execution with specific arguments |
Member
There was a problem hiding this comment.
maybe the rule name should contain reference to init or pid 1
|
|
||
| - name: Create sensitive files symlink | ||
| type: FileLink | ||
| category: execution |
|
|
||
| - name: Create sensitive files hardlink | ||
| type: FileLink | ||
| category: execution |
Comment on lines
+15
to
+20
| condition: (payload.destination IN ["/etc/shadow", "/etc/sudoers", "/etc/pam.conf", "/etc/security/pwquality.conf"] OR payload.destination STARTS_WITH "/etc/sudoers.d/" OR payload.destination STARTS_WITH "/etc/pam.d") AND payload.hard_link == "false" | ||
| condition: ( | ||
| (payload.destination ENDS_WITH "/etc/shadow" OR | ||
| payload.destination ENDS_WITH "/etc/sudoers" OR | ||
| payload.destination ENDS_WITH "/etc/pam.conf" OR | ||
| payload.destination ENDS_WITH "/etc/security/pwquality.conf") | ||
| OR payload.destination STARTS_WITH "/etc/sudoers.d/" OR payload.destination STARTS_WITH "/etc/pam.d") AND payload.hard_link == "false" |
Member
There was a problem hiding this comment.
the previous IN was more efficient and the new ENDS_WITH doesn't add any additional benefit
Comment on lines
+23
to
+32
| condition: (payload.destination IN ["/etc/shadow", "/etc/sudoers", "/etc/pam.conf", "/etc/security/pwquality.conf"] OR payload.destination STARTS_WITH "/etc/sudoers.d/" OR payload.destination STARTS_WITH "/etc/pam.d") AND payload.hard_link == "true" | ||
| condition: ( | ||
| (payload.destination ENDS_WITH "/etc/shadow" OR | ||
| payload.destination ENDS_WITH "/etc/sudoers" OR | ||
| payload.destination ENDS_WITH "/etc/pam.conf" OR | ||
| payload.destination ENDS_WITH "/etc/security/pwquality.conf") |
Member
There was a problem hiding this comment.
the previous IN was more efficient and the new ENDS_WITH doesn't add any additional benefit
added 2 commits
July 14, 2025 15:00
banditopazzo
approved these changes
Jul 14, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Credential Access - Rules update
MITRE Tactic: Credential Access
I have
cargo fmt;cargo clippy;cargo testand all tests pass;