Linux Auditd Alerts on Unix Shell Configuration File Modifications

title: Linux Auditd Alerts on Unix Shell Configuration File Modifications
id: e7f55a6e-4d81-4e7a-9a18-02424952d72c
related:
  - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9
    type: obsolete
  - id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d
    type: derived
status: test
description: This rule flags auditd events where modified paths match common system and user shell startup or login configuration files (e.g., /etc/profile, /etc/bash.bashrc, and users’ .bashrc/.profile). Attackers may abuse these files to persist by injecting commands that execute when a new shell is opened or a user logs in. It relies on auditd telemetry that records the affected file path for configuration changes.
references:
  - https://objective-see.org/blog/blog_0x68.html
  - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
  - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml
author: Peter Matkovski, IAI, Huntrule Team
date: 2023-03-06
modified: 2023-03-15
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.004
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name:
      - /etc/shells
      - /etc/profile
      - /etc/profile.d/*
      - /etc/bash.bashrc
      - /etc/bashrc
      - /etc/zsh/zprofile
      - /etc/zsh/zshrc
      - /etc/zsh/zlogin
      - /etc/zsh/zlogout
      - /etc/csh.cshrc
      - /etc/csh.login
      - /root/.bashrc
      - /root/.bash_profile
      - /root/.profile
      - /root/.zshrc
      - /root/.zprofile
      - /home/*/.bashrc
      - /home/*/.zshrc
      - /home/*/.bash_profile
      - /home/*/.zprofile
      - /home/*/.profile
      - /home/*/.bash_login
      - /home/*/.bash_logout
      - /home/*/.zlogin
      - /home/*/.zlogout
  condition: selection
falsepositives:
  - Admin or User activity are expected to generate some false positives
level: medium
license: DRL-1.1