Linux_Rootkit_Snapekit_01205a75

rule Linux_Rootkit_Snapekit_01205a75 {
    meta:
        author = "Elastic Security"
        id = "01205a75-f40a-4f01-9519-19b801ec2aef"
        fingerprint = "9316cdd987f5d13fc73707d508fab08cad5d47a4d8346ba0c364514cab146d11"
        creation_date = "2024-11-13"
        last_modified = "2024-11-22"
        threat_name = "Linux.Rootkit.Snapekit"
        reference_sample = "58d1e56fff04affb4c8cbb5fc3ea848e88d1f05c07e6f730e1cf17100ef1b666"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $str1 = "author=Humzak711"
        $str2 = "name=snapekit"
        $str3 = "description=snapekit"
        $str4 = "license=GPL"
        $str5 = "snapekit"
        $func1 = "snapekit_filepath"
        $func2 = "additional_hidden_filepaths"
        $func3 = "snapekit_persistence_config_files"
        $func4 = "snapekit_persistence_config_dirs"
        $func5 = "snapekit_C2_ips_ipv4"
        $func6 = "snapekit_C2_ips_ipv6"
        $func7 = "unpack_rootkit"
        $hook1 = "getdents64_snape"
        $hook2 = "kill_snape"
        $hook3 = "load_userspace_payload"
        $hook4 = "lstat_snape"
        $hook5 = "open_snape"
        $hook6 = "openat2_snape"
        $hook7 = "openat_snape"
        $hook8 = "pread64_snape"
        $hook9 = "ptrace_snape"
        $hook10 = "pwrite64_snape"
        $hook11 = "read_snape"
        $hook12 = "stat_snape"
        $hook13 = "statfs_snape"
        $hook14 = "statx_snape"
        $hook15 = "tcp4_seq_show_snape"
        $hook16 = "tcp6_seq_show_snape"
        $hook17 = "udp4_seq_show_snape"
        $hook18 = "udp6_seq_show_snape"
        $hook19 = "unhook_kernelAPI"
        $hook20 = "unlink_snape"
        $hook21 = "unlinkat_snape"
        $hook22 = "write_snape"
        $hook23 = "sys_call_table_snape"
        $hook24 = "hooked_tcp6_seq_show"
        $hook25 = "hooked_udp4_seq_show"
        $hook26 = "hooked_udp6_seq_show"
    condition:
        3 of ($str*) or 3 of ($func*) or 5 of ($hook*)
}