Modify Shell Configuration File

Description

Detect attempts to modify shell configuration files, primarily aimed at establishing persistence by automatically inserting commands into scripts executed by shells. The upstream rule excludes shell processes because they often create unnecessary noise. However, this might lead to missed detections. To customize the rule for your situation, you can fine-tune it using enhanced profiling. For example, you might want to only consider interactive shell processes (where proc.tty != 0).

Query · falco

open_write and (fd.filename in (shell_config_filenames) or
     fd.name in (shell_config_files) or
     fd.directory in (shell_config_directories))
and not proc.name in (shell_binaries) and not exe_running_docker_save and not user_known_shell_config_modifiers

Rule dependencies

Depends on

  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_shell_config_modifiers
    A shared condition, not a detection — not indexed on this site.

Analyst notes

A shell configuration file has been modified | file=%fd.name pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Modify Shell Configuration File · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Modify Shell Configuration File
desc: 'Detect attempts to modify shell configuration files, primarily aimed at establishing
  persistence by automatically inserting commands into scripts executed by shells.
  The upstream rule excludes shell processes because they often create unnecessary
  noise. However, this might lead to missed detections. To customize the rule for
  your situation, you can fine-tune it using enhanced profiling. For example, you
  might want to only consider interactive shell processes (where proc.tty != 0).

  '
condition: "open_write and (fd.filename in (shell_config_filenames) or\n     fd.name\
  \ in (shell_config_files) or\n     fd.directory in (shell_config_directories))\n\
  and not proc.name in (shell_binaries) and not exe_running_docker_save and not user_known_shell_config_modifiers\n"
output: A shell configuration file has been modified | file=%fd.name pcmdline=%proc.pcmdline
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: WARNING
tags:
- maturity_incubating
- host
- container
- filesystem
- mitre_persistence
- T1546.004

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.