Credential Access - Rules update

rules/credential_access/adversary-in-the-middle.yaml

@@ -0,0 +1,65 @@
+# Title: DHCP Network Manipulation and Attack Detection
+
+# Creation Date: 2025/04/10
+
+# MITRE ATT&CK Tactic: TA0006 - Credential Access - https://attack.mitre.org/tactics/TA0006/
+
+# MITRE ATT&CK Technique: T1580 - Adversary-in-the-middle - https://attack.mitre.org/techniques/T1557/002/
+
+- name: DHCP Network Discover
+  type: Send
+  category: credential_access
+  severity: low
+  description: Detects DHCP starvation attempts by monitoring excessive DISCOVER packets to broadcast addresses. 
+    Adversaries may exhaust the IP address pool by rapidly requesting many leases using spoofed MAC addresses.
+  condition: payload.is_tcp == "false" AND
+    (payload.destination.port == 67 OR payload.destination.port == 547) AND
+    payload.len <= 400 AND
+    payload.destination.ip IN ["255.255.255.255"] 
+    AND NOT (
+      header.image ENDS_WITH "/dhcpd" OR
+      header.image ENDS_WITH "/dhclient" OR
+      header.image ENDS_WITH "/dnsmasq" OR
+      header.image ENDS_WITH "/isc-dhcp-server" OR
+      header.image ENDS_WITH "/NetworkManager" OR
+      header.image ENDS_WITH "/systemd-networkd"
+    )
+
+# DHCP Server Spoofing Detection
+- name: Unauthorized DHCP Server
+  type: Bind
+  category: credential_access
+  severity: medium
+  description: Detects processes binding to DHCP server ports, which may indicate rogue DHCP services. 
+    Adversaries may run malicious DHCP servers to redirect victim network traffic, leading to attacks like man-in-the-middle (MITM) or traffic interception.
+  condition: payload.is_tcp == "false" AND 
+      (payload.address.port == 67 OR payload.address.port == 68 OR payload.address.port == 546 OR payload.address.port == 547)
+    AND NOT (
+      header.image ENDS_WITH "/dhcpd" OR
+      header.image ENDS_WITH "/dhclient" OR
+      header.image ENDS_WITH "/dnsmasq" OR
+      header.image ENDS_WITH "/isc-dhcp-server" OR
+      header.image ENDS_WITH "/NetworkManager" OR
+      header.image ENDS_WITH "/systemd-networkd"
+    )
+
+# DHCP Attack Tools Detection
+- name: DHCP Attack Tools
+  type: Exec
+  category: credential_access
+  severity: high
+  description: Detects execution of known DHCP spoofing tools or suspicious command-line arguments that suggest malicious intent.
+  condition: 
+    payload.filename ENDS_WITH "ettercap" OR 
+    payload.filename ENDS_WITH "bettercap" OR
+    payload.filename ENDS_WITH "yersinia" OR
+    payload.filename ENDS_WITH "responder" OR
+    payload.filename ENDS_WITH "mitmf" OR 
+    (payload.argv CONTAINS "dhcp" AND (
+      payload.argv CONTAINS "spoof" OR
+      payload.argv CONTAINS "poison" OR
+      payload.argv CONTAINS "hijack" OR
+      payload.argv CONTAINS "--dhcp" OR
+      payload.argv CONTAINS "-dhcp" OR
+      payload.argv CONTAINS "--dhcp-spoof"
+    ))

rules/credential_access/collection_sensitive_files.yaml

@@ -0,0 +1,28 @@
+# Title: Archive Collected Data, Archive via Utility
+
+# Creation date: 2025/04/09
+
+# MITRE ATT&CK Tactic: TA0006 - Credential Access - https://attack.mitre.org/tactics/TA0006/
+
+# MITRE ATT&CK Technique: T1560 - Archive via Utility - https://attack.mitre.org/techniques/T1560/001/
+
+- name: Sensitive file compression
+  type: FileOpened
+  category: credential_access
+  severity: medium
+  description: Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials
+    and system configurations.
+  condition: (header.image ENDS_WITH "/zip" OR header.image ENDS_WITH "/tar" OR header.image ENDS_WITH "/gzip"
+      OR header.image ENDS_WITH "/hdiutil" OR header.image ENDS_WITH "/7z" OR header.image ENDS_WITH "/pigz" 
+      OR header.image ENDS_WITH "/xz" OR header.image ENDS_WITH "/bzip2")
+    AND (
+        payload.filename STARTS_WITH "/root/.ssh/"
+        OR payload.filename STARTS_WITH "/root/.bash_history"
+        OR payload.filename STARTS_WITH "/root/.aws/"
+        OR payload.filename STARTS_WITH "/root/.docker/config"
+        OR payload.filename STARTS_WITH "/etc/hosts"
+        OR payload.filename STARTS_WITH "/etc/group"
+        OR payload.filename STARTS_WITH "/etc/passwd"
+        OR payload.filename STARTS_WITH "/etc/shadow"
+        OR payload.filename STARTS_WITH "/etc/gshadow"
+    )

rules/credential_access/create_file_in_root.yaml

@@ -1,27 +1,44 @@
-# Title: Create files under /root
+# Title: Creation of Suspicious Files in Restricted Directories
 
-# Creation date: 2024/04/18
+# Creation Date: 2022/10/21
 
 # MITRE ATT&CK Tactic: TA0006 - Credential Access - https://attack.mitre.org/tactics/TA0006/
 
-# MITRE ATT&CK Technique: T1552.001 - Credentials in Files - https://attack.mitre.org/techniques/T1552/001/
+# MITRE ATT&CK Technique: TT1552 - Unsecured Credentials - https://attack.mitre.org/techniques/T1552/
 
 - name: Create files below /root
   type: FileCreated
   category: credential_access
-  severity: medium
+  severity: low
   description: Detects the creation of files below /root. Adversaries may create files below /root to gain access to information or to escalate 
     privileges.
-  condition: payload.filename STARTS_WITH "/root" AND NOT payload.filename IN [
-    "/root/.auth_tokens",
-    "/root/.bash_history",
-    "/root/.ash_history", 
-    "/root/.aws/credentials",
-    "/root/.viminfo.tmp",
-    "/root/.lesshst",
-    "/root/.bzr.log",
-    "/root/.gitconfig.lock",
-    "/root/.babel.json",
-    "/root/.localstack", 
-    "/root/.wget-hsts"
-    ]
+  condition: payload.filename STARTS_WITH "/root" 
+    AND NOT (
+      payload.filename IN [
+      "/root/.auth_tokens",
+      "/root/.bash_history",
+      "/root/.ash_history", 
+      "/root/.aws/credentials",
+      "/root/.viminfo.tmp",
+      "/root/.lesshst",
+      "/root/.bzr.log",
+      "/root/.gitconfig.lock",
+      "/root/.babel.json",
+      "/root/.localstack", 
+      "/root/.wget-hsts",
+      "/root/.vimrc",
+      "/root/.bashrc",
+      "/root/.profile",
+      "/root/.ssh/authorized_keys", 
+      "/root/.ssh/known_hosts",
+      ] 
+      OR (
+        payload.filename STARTS_WITH "/root/.config/" OR
+        payload.filename STARTS_WITH "/root/.cache/" OR
+        payload.filename STARTS_WITH "/root/.docker/") 
+      OR (header.image IN [
+        "/usr/bin/apt", "/usr/bin/apt-get","/usr/bin/dpkg", "/usr/bin/yum", "/usr/bin/opkg",
+        "/usr/bin/pacman", "/usr/bin/rpm", "/usr/bin/zypper", "/usr/bin/emerge", "/usr/bin/nix-env"]
+        OR header.image STARTS_WITH "/usr/bin/dnf"
+      )
+    )

rules/credential_access/credential_dumping.yaml

@@ -16,4 +16,34 @@
     Using the combined file generated from the utility, the malicious threat actors can use them as input
     for password-cracking utilities or prepare themselves for future operations by gathering
     credential information of the victim.
-  condition: header.image ENDS_WITH "/unshadow" AND payload.argc >= 2
+  condition: header.image ENDS_WITH "/unshadow" AND payload.argc >= 2
+
+- name: strace on init process
+  type: Exec
+  category: credential_access
+  severity: medium
+  description: Detects the execution of the ptrace syscall (called by strace) with specific arguments. Attackers can exploit ptrace to 
+    dump the memory of the init process (PID 1) to extract sensitive information, potentially enabling unauthorized access to internal 
+    resources and remote control over compromised systems.
+  condition: payload.filename ENDS_WITH "/strace"
+    AND (payload.argv CONTAINS "--pid"
+      OR payload.argv CONTAINS "-p")
+    AND payload.argv CONTAINS "1"
+
+- name: Suspicious command targeting /proc filesystem
+  type: FileOpened
+  category: credential_access
+  severity: low
+  description: Detects attempt to search process memory for credential patterns within the /proc filesystem.
+    Adversaries may gather credentials from the proc filesystem or /proc. (Tools like LaZagne or MimiPenguin)
+  condition: payload.filename STARTS_WITH "/proc" AND (payload.filename ENDS_WITH "/maps" OR payload.filename ENDS_WITH "/mem")
+    AND NOT (header.image STARTS_WITH "/usr/lib64/" OR header.image ENDS_WITH "/runc" OR header.image ENDS_WITH "/docker" OR
+      header.image ENDS_WITH "/containerd-shim" OR header.image ENDS_WITH "/containerd-shim-runc-v2" OR header.image ENDS_WITH "/containerd" OR header.image ENDS_WITH "/crio" OR
+      header.image ENDS_WITH "/podman" OR header.image ENDS_WITH "/crun")
+
+- name: Suspicious gcore execution
+  type: Exec
+  category: credential_access
+  severity: low
+  description: Detects use of `gcore` to create a core dump of a running process. Adversaries may use this to extract memory contents for credential harvesting.
+  condition: payload.filename ENDS_WITH "/gcore"

rules/credential_access/gdb_init_memory_dump.yaml

@@ -1,4 +1,4 @@
-# Title: Gdb Init Memory Dump
+# Title: Linux init (PID 1) Secret Dump via GDB
 
 # Creation date: 2023/08/30
 
@@ -10,10 +10,11 @@
   type: Exec
   category: credential_access
   severity: medium
-  description: This rule monitors for the execution of the GDB utility with specific arguments. Attackers can exploit the GDB utility to 
+  description: Detects the execution of the GDB utility with specific arguments. Attackers can exploit the GDB utility to 
     dump the memory of the init process (PID 1) to extract sensitive information, potentially enabling unauthorized access to internal 
     resources and remote control over compromised systems.
   condition: payload.filename ENDS_WITH "/gdb" 
     AND (payload.argv CONTAINS "--pid" 
-    OR payload.argv CONTAINS "-p") 
+    OR payload.argv CONTAINS "-p"
+    OR payload.argv CONTAINS "attach") 
     AND payload.argv CONTAINS "1"

rules/credential_access/link_sensitive_file.yaml

@@ -1,22 +1,22 @@
-# Title: Link to sensitive file
+# Title: Creation of Links to Sensitive Files
 
 # Creation date: 2022/10/21
 
 # MITRE ATT&CK Tactic: TA0006 - Credential Access - https://attack.mitre.org/tactics/TA0006/
 
-# MITRE ATT&CK Technique: T1003 - OS Credential Dumping - https://attack.mitre.org/techniques/T1003
+# MITRE ATT&CK Technique: T1552 - Unsecured Credentials - https://attack.mitre.org/techniques/T1552/
 
 - name: Create sensitive files symlink
   type: FileLink
-  category: execution
+  category: credential_access
   severity: medium
   description: Detects the creation of sensitive files as a symlink. Adversaries may create symlinks to sensitive files to gain access to 
     information or to escalate privileges.
   condition: (payload.destination IN ["/etc/shadow", "/etc/sudoers", "/etc/pam.conf", "/etc/security/pwquality.conf"] OR payload.destination STARTS_WITH "/etc/sudoers.d/" OR payload.destination STARTS_WITH "/etc/pam.d") AND payload.hard_link == "false"
 
 - name: Create sensitive files hardlink
   type: FileLink
-  category: execution
+  category: credential_access
   severity: medium
   description: Detects the creation of sensitive files as a hardlink. Adversaries may create hardlinks to sensitive files to gain access to 
     information or to escalate privileges.

rules/credential_access/read_aws_credential.yaml

@@ -0,0 +1,14 @@
+# Title: Access to AWS Credentials File
+
+# Creation date: 2025/04/17
+
+# MITRE ATT&CK Tactic: TA0006 - Credential Access - https://attack.mitre.org/tactics/TA0006/
+
+# MITRE ATT&CK Technique: T1552.001 - Credentials in Files - https://attack.mitre.org/techniques/T1552/001/
+
+- name: Access to AWS credentials file
+  type: FileOpened
+  category: credential_access
+  severity: low
+  description: Detects direct access to the AWS credentials file, a common source of cloud access tokens.
+  condition: payload.filename ENDS_WITH "/.aws/credentials"

rules/credential_access/read_ssh_information.yaml

@@ -12,7 +12,13 @@
   severity: medium
   description: Detects the read of SSH information. Adversaries may read SSH information to gather information about the system or to use in later 
     stages of an attack.
-  condition: payload.filename STARTS_WITH "/root/.ssh/" AND NOT header.image IN [
+  condition: (
+    payload.filename STARTS_WITH "/root/.ssh/" OR
+    payload.filename STARTS_WITH "/etc/ssh/" OR
+    payload.filename ENDS_WITH ".ssh/config" OR
+    payload.filename ENDS_WITH "/.ssh/authorized_keys"
+    )
+    AND NOT header.image IN [
     "/usr/sbin/sshd",
     "/usr/bin/sftp-server",
     "/usr/bin/ssh-agent", 
@@ -23,4 +29,4 @@
     "/usr/bin/ssh-keysign",
     "/usr/bin/ssh-keyscan",
     "/usr/bin/ssh-add"
-  ]
+    ]

rules/credential_access/search_pk_passwd.yaml

@@ -12,13 +12,37 @@
   severity: medium
   description: Detects the execution of the 'find' or 'grep' process with arguments related to private keys or passwords. Adversaries may use 
     this technique to search for, analyze, or manipulate private keys or passwords on the system.
-  condition: (
-    payload.filename ENDS_WITH "/find" AND (payload.argv CONTAINS "id_rsa" OR payload.argv CONTAINS "id_dsa")
-    ) OR (
-      payload.filename ENDS_WITH "grep" AND (
-        payload.argv CONTAINS "BEGIN PRIVATE"
-          OR payload.argv CONTAINS "BEGIN RSA PRIVATE"
-          OR payload.argv CONTAINS "BEGIN DSA PRIVATE"
-          OR payload.argv CONTAINS "BEGIN EC PRIVATE"
+  condition: (payload.filename ENDS_WITH "/find" AND (payload.argv CONTAINS "id_rsa" OR payload.argv CONTAINS "id_dsa")) 
+    OR (payload.filename ENDS_WITH "grep" 
+      AND (
+          payload.argv CONTAINS "BEGIN PRIVATE" OR
+          payload.argv CONTAINS "BEGIN RSA PRIVATE" OR
+          payload.argv CONTAINS "BEGIN DSA PRIVATE" OR
+          payload.argv CONTAINS "BEGIN EC PRIVATE"
       )
     )
+
+- name: Grep recursive password search
+  type: Exec
+  category: credential_access
+  severity: medium
+  description: Detects use of grep to recursively search for the term 'password' across the filesystem.
+  condition: (payload.filename ENDS_WITH "/grep" OR payload.filename ENDS_WITH "/rg") 
+    AND (payload.argv CONTAINS "password" OR payload.argv CONTAINS "Password" OR payload.argv CONTAINS "PASSWORD")
+
+- name: Suspicious Credential or Key File Access
+  type: FileOpened
+  category: credential_access
+  severity: low
+  description: Detects access to files potentially containing credentials or private keys using basic inspection tools. 
+    Adversaries may use commands like `cat`, `less`, or `strings` to extract sensitive data from .pem, .key, .crt, or config files during post-compromise activity.
+  condition: (
+    header.image ENDS_WITH "cat" OR
+    header.image ENDS_WITH "less" OR
+    header.image ENDS_WITH "more" OR
+    header.image ENDS_WITH "strings"    
+    ) AND (
+      payload.filename CONTAINS ".pem" OR
+      payload.filename CONTAINS ".key" OR
+      payload.filename CONTAINS ".crt"
+    )

rules/credential_access/ssh_backdoor_log.yaml

@@ -9,7 +9,7 @@
 - name: SSH related file changes
   type: FileOpened
   category: credential_access
-  severity: high
+  severity: low
   description: Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file.
     Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to
     enable unauthorized access or to log SSH credentials for exfiltration.
@@ -33,4 +33,3 @@
     "/var/run/udevd.pid"
     ]
    )
-

rules/credential_access/ssh_bruteforce.yaml

@@ -0,0 +1,16 @@
+# Title: SSH Brute-force via sshpass and credential file
+
+# Creation date: 2025/04/17
+
+# MITRE ATT&CK Tactic: TA0006 - Credential Access - https://attack.mitre.org/tactics/TA0006/
+
+# MITRE ATT&CK Technique: T1110.004 - Credential Stuffing - https://attack.mitre.org/techniques/T1110/004/
+
+- name: SSH Brute-force attempt
+  type: Exec
+  category: credential_access
+  severity: medium
+  description: Detects usage of sshpass in loops with credential files to brute-force SSH access, typically indicative of credential stuffing or lateral movement testing.
+  condition: (header.image ENDS_WITH "sshpass" AND payload.argv CONTAINS "ssh" AND payload.argv CONTAINS "-p")
+    OR (payload.filename ENDS_WITH "/hydra" AND payload.argv CONTAINS "-P")
+

rules/credential_access/sshd_config_tampering.yaml

@@ -0,0 +1,15 @@
+# Title: SSHD Config Tampering
+
+# Creation Date: 2025/04/09
+
+# MITRE ATT&CK Tactic: T0006 - Credential Access - https://attack.mitre.org/tactics/TA0006/
+
+# MITRE ATT&CK Technique: T1098 - Account Manipulation - https://attack.mitre.org/techniques/T1098/
+
+- name: SSHD config modification
+  type: FileOpened
+  category: credential_access
+  severity: high
+  description: Detects changes to /etc/ssh/sshd_config, which may indicate attempts to bypass authentication controls or enable unauthorized access.
+  condition: payload.filename STARTS_WITH "/etc/ssh/sshd_config" 
+    AND (payload.flags CONTAINS "O_WRONLY" OR payload.flags CONTAINS "O_RDWR")