Dokumen ini memberikan ringkasan set aturan dalam kategori Ancaman Linux, sumber data yang diperlukan, dan konfigurasi yang dapat Anda gunakan untuk menyesuaikan pemberitahuan yang dihasilkan oleh set aturan ini.
Kumpulan aturan dalam kategori Ancaman Linux membantu mengidentifikasi ancaman di lingkungan Linux menggunakan CrowdStrike Falcon, Sistem Audit Linux (AuditD), dan log sistem Unix.
Kategori ini mencakup set aturan berikut:
Alat Eskalasi Akses OS: Mendeteksi perilaku yang umumnya terlihat di alat eskalasi akses Linux open source.
Mekanisme Persistensi: Aktivitas yang digunakan oleh musuh untuk membuat dan mempertahankan akses persisten di host Linux.
Modifikasi Hak Istimewa: Aktivitas yang terkait dengan upaya dan tindakan autentikasi istimewa, yang biasanya digunakan untuk eskalasi hak istimewa atau tetap ada di host Linux.
Sinyal Malware - Aktivitas Biner LOTL Mencurigakan: Mendeteksi skenario penggunaan alat bawaan yang mencurigakan (Living Off the Land) berdasarkan aktivitas malware Linux yang diamati di lingkungan dunia nyata.
Sinyal Malware - Aktivitas Download Mencurigakan: Mendeteksi perilaku yang terlihat terkait dengan aktivitas download berbahaya di Linux dalam lingkungan dunia nyata.
Sinyal Malware - Eksekusi Mencurigakan: Mendeteksi sinyal yang dihasilkan dari
perilaku malware Linux yang teramati dan terdeteksi di lingkungan dunia nyata
dengan fokus pada perilaku Eksekusi (TA0002).
Ancaman Garis Depan Mandiant - Kumpulan aturan ini berisi aturan yang berasal dari
investigasi dan respons Mandiant terhadap insiden aktif di seluruh dunia.
Aturan ini mencakup TTP yang sering terlihat seperti eksekusi menggunakan interpreter skrip (T1059), penggunaan layanan web untuk command and control (T1102), dan penggunaan tugas terjadwal untuk mempertahankan persistensi (T1053).
Mandiant Intel Emerging Threats - Kumpulan aturan ini berisi aturan yang berasal dari Kampanye Intelijen dan Peristiwa Penting Mandiant, yang mencakup aktivitas geopolitik dan ancaman yang sangat berdampak, sebagaimana dinilai oleh Mandiant.
Aktivitas ini dapat mencakup konflik geopolitik, eksploitasi, phishing, malvertising, ransomware, dan kompromi supply chain.
Perangkat dan jenis log yang didukung
Set aturan dalam kategori Ancaman Linux telah diuji dan didukung dengan
sumber data berikut yang didukung Google Security Operations:
Mengonfigurasi perangkat untuk membuat data log yang benar
Agar aturan dalam kategori Ancaman Linux berfungsi seperti yang dirancang, perangkat harus membuat data log dalam format yang diharapkan. Konfigurasi aturan audit persisten berikut untuk Daemon Audit Linux di setiap perangkat tempat Anda akan mengumpulkan log dan mengirimkannya ke SecOps Google.
Untuk mengetahui detail cara menerapkan aturan audit persisten untuk Linux Audit Daemon, lihat dokumentasi khusus sistem operasi.
# Inserts the machine hostname into each log event
name_format = hostname
# Process creation (32 and 64-bit)
-a exit,always -F arch=b32 -S execve
-a exit,always -F arch=b64 -S execve
# Persistence: Cron
-w /etc/cron.allow -p wa -k cron
-w /etc/cron.d/ -p wa -k cron
-w /etc/cron.daily/ -p wa -k cron
-w /etc/cron.deny -p wa -k cron
-w /etc/cron.hourly/ -p wa -k cron
-w /etc/cron.monthly/ -p wa -k cron
-w /etc/cron.weekly/ -p wa -k cron
-w /etc/crontab -p wa -k cron
-w /var/spool/cron/ -p wa -k cron
# Persistence: System Startup
-w /etc/init/ -p wa -k init
-w /etc/init.d/ -p wa -k init
-w /etc/inittab -p wa -k init
# Persistence: Systemd Units and Generators
-w /etc/systemd/user -p wa -k systemd
-w /usr/lib/systemd/user -p wa -k systemd
-w /var/lib/systemd/linger -p wa -k systemd
-w /root/.config/systemd/user -pa wa -k systemd
-w /etc/systemd/system -p wa -k systemd
-w /usr/lib/systemd/system -p wa -k systemd
-w /run/systemd/system-generators -p wa -k systemd
-w /etc/systemd/system-generators -p wa -k systemd
-w /usr/local/lib/systemd/system-generators -p wa -k systemd
-w /usr/lib/systemd/system-generators -p wa -k systemd
-w /run/systemd/user-generators -pa wa -k systemd
-w /etc/systemd/user-generators -pa wa -k systemd
-w /usr/local/lib/systemd/user-generators -pa wa -k systemd
-w /usr/lib/systemd/user-generators -pa wa -k systemd
# Persistence: IAM
-w /etc/group -p wa -k iam_etcgroup
-w /etc/passwd -p wa -k iam_etcpasswd
-w /etc/gshadow -k iam_etcgroup
-w /etc/shadow -k iam_etcpasswd
-w /etc/sudoers -p wa -k iam_sudoers
-w /etc/sudoers.d/ -p wa -k iam_sudoers_d
-w /usr/bin/passwd -p x -k iam_passwd
-w /usr/sbin/groupadd -p x -k iam_groupmod
-w /usr/sbin/groupmod -p x -k iam_groupmod
-w /usr/sbin/addgroup -p x -k iam_groupmod
-w /usr/sbin/useradd -p x -k iam_usermod
-w /usr/sbin/userdel -p x -k iam_usermod
-w /usr/sbin/usermod -p x -k iam_usermod
-w /usr/sbin/adduser -p x -k iam_usermod
# Privilege Escalation
-w /bin/su -p x -k privesc
-w /usr/bin/sudo -p x -k privesc
# Persistence: Libraries
-w /etc/ld.so.conf -p wa -k libmod
-w /etc/ld.so.conf.d -p wa -k libmod
-w /etc/ld.so.preload -p wa -k libmod
# Persistence: PAM
-w /etc/pam.d/ -p wa -k pam
-w /etc/security/ -p wa -k pam
# Persistence: SSH
-w /etc/ssh/ -p wa -k sshconfig
-w /root/.ssh/ -p wa -k sshconfig
# Persistence: Shell Configuration
-w /etc/bashrc -p wa -k shellconfig
-w /etc/csh.cshrc -p wa -k shellconfig
-w /etc/csh.login -p wa -k shellconfig
-w /etc/fish/ -p wa -k shellconfig
-w /etc/profile -p wa -k shellconfig
-w /etc/profile.d/ -p wa -k shellconfig
-w /etc/shells -p wa -k shellconfig
-w /etc/zsh/ -p wa -k shellconfig
# Injection
-a always,exit -F arch=b32 -S ptrace
-a always,exit -F arch=b64 -S ptrace
# Failed Access Attempts
-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k file_err
# Network connections
-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -k net_v4
-a always,exit -F arch=b32 -S connect -F a2=16 -F success=1 -k net_v4
-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -k net_v6
-a always,exit -F arch=b32 -S connect -F a2=28 -F success=1 -k net_v6
-a always,exit -F arch=b32 -S socket -F a0=2 -k sock_v4
-a always,exit -F arch=b64 -S socket -F a0=2 -k sock_v4
-a always,exit -F arch=b32 -S socket -F a0=10 -k sock_v6
-a always,exit -F arch=b64 -S socket -F a0=10 -k sock_v6
Kolom yang diperlukan oleh kategori Ancaman Linux
Bagian berikut menjelaskan data spesifik yang diperlukan oleh set aturan dalam kategori Ancaman Linux untuk mendapatkan manfaat terbesar. Pastikan perangkat Anda dikonfigurasi untuk merekam data berikut ke log peristiwa perangkat.
Set data
Kolom UDM (tempat data disimpan)
Definisi
Jalur Proses Utama
principal.process.file.full_path
Lokasi di disk dari proses yang sedang berjalan, jika tersedia.
Command Line Proses Utama
principal.process.command_line
Parameter command line proses, jika tersedia.
Jalur Proses Target
target.process.file.full_path
Lokasi proses target di disk, jika tersedia.
Command Line Target Proses
target.process.command_line
Command line
Domain Kueri DNS Jaringan
network.dns.questions.name
Nama domain kueri DNS, jika tersedia.
Menyesuaikan pemberitahuan yang ditampilkan oleh kategori Ancaman Linux
Anda dapat mengurangi jumlah deteksi yang dihasilkan oleh aturan atau kumpulan aturan menggunakan
pengecualian aturan.
Dalam pengecualian aturan, Anda menentukan kriteria peristiwa UDM yang mengecualikan peristiwa agar tidak dievaluasi oleh set aturan.
Buat satu atau beberapa pengecualian aturan untuk mengidentifikasi kriteria dalam peristiwa UDM yang
mengecualikan peristiwa agar tidak dievaluasi oleh set aturan ini atau oleh aturan tertentu dalam
set aturan. Lihat
Mengonfigurasi pengecualian aturan
untuk mengetahui informasi tentang cara melakukannya.
Misalnya, Anda dapat mengecualikan peristiwa berdasarkan kolom UDM berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eThe Linux Threats category in Google SecOps helps identify potential threats in Linux environments using data from CrowdStrike Falcon, Linux Auditing System (AuditD), and Unix system logs.\u003c/p\u003e\n"],["\u003cp\u003eThis category includes various rule sets such as OS Privilege Escalation Tools, Persistence Mechanisms, Privilege Modifications, and multiple Malware Signals detectors, along with rules from Mandiant Front-Line and Emerging Threats Intel.\u003c/p\u003e\n"],["\u003cp\u003eTo ensure proper functionality, devices must be configured to generate log data in a specific format, including setting up persistent audit rules for the Linux Audit Daemon.\u003c/p\u003e\n"],["\u003cp\u003eSpecific UDM fields like \u003ccode\u003eprincipal.process.file.full_path\u003c/code\u003e, \u003ccode\u003eprincipal.process.command_line\u003c/code\u003e, and \u003ccode\u003enetwork.dns.questions.name\u003c/code\u003e are required for the Linux Threats category rule sets to function effectively.\u003c/p\u003e\n"],["\u003cp\u003eAlert tuning can be performed by creating rule exclusions based on criteria from UDM fields like \u003ccode\u003eprincipal.hostname\u003c/code\u003e, \u003ccode\u003etarget.user.userid\u003c/code\u003e, and \u003ccode\u003eprincipal.process.command_line\u003c/code\u003e, to reduce the number of detections.\u003c/p\u003e\n"]]],[],null,["# Overview of Linux Threats category\n==================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\n\u003cbr /\u003e\n\n| **Note:** This feature is not available to all customers in all regions.\n\n\u003cbr /\u003e\n\nThis document provides an overview of the rule sets in the Linux Threats\ncategory, the required data sources, and configuration you can use to tune the\nalerts generated by these rule sets.\n\nRule sets in the Linux Threats category help identify threats in Linux\nenvironments using CrowdStrike Falcon, Linux Auditing System (AuditD), and Unix system logs.\nThis category includes the following rule sets:\n\n- **OS Privilege Escalation Tools**: Detects behavior commonly seen in open source Linux privilege escalation tools.\n- **Persistence Mechanisms:** Activity used by adversaries to establish and maintain persistent access on Linux hosts.\n- **Privilege Modifications**: Activity associated with privileged authentication attempts and actions, commonly used to privilege-escalate or persist on Linux hosts.\n- **Malware Signals - Suspicious LOTL Binary Activity**: Detects suspicious built-in tool usage (Living Off the Land) scenarios based on the observed activity of Linux malware in real-world environments.\n- **Malware Signals - Suspicious Download Activity**: Detects behavior seen in relation to malicious download activity on Linux in real-world environments.\n- **Malware Signals - Suspicious Execution**: Detects signals generated from observed behaviors of Linux malware detected in real-world environments with a focus on Execution (TA0002) behaviors.\n- **Mandiant Front-Line Threats -** This rule set contains rules derived from Mandiant's investigation and response to active incidents across the world. These rules cover commonly seen TTPs such as execution using script interpreters (T1059), use of web services for command and control (T1102), and use of scheduled tasks to maintain persistence (T1053).\n- **Mandiant Intel Emerging Threats -** This rule set contains rules derived from Mandiant Intelligence Campaigns and Significant Events, which cover highly impactful geopolitical and threat activity, as assessed by Mandiant. This activity may include geopolitical conflict, exploitation, phishing, malvertising, ransomware, and supply chain compromises.\n\nSupported devices and log types\n-------------------------------\n\nRule sets in the Linux Threats category have been tested and are supported with\nthe following Google Security Operations supported\n[data sources](/chronicle/docs/ingestion/parser-list/supported-default-parsers):\n\n- Linux Auditing System (`AUDITD`)\n- Unix system (`NIX_SYSTEM`)\n- CrowdStrike Falcon (`CS_EDR`)\n\nFor a list of all Google SecOps supported data sources, see\n[Supported default parsers](/chronicle/docs/ingestion/parser-list/supported-default-parsers).\n\nConfigure devices to generate correct log data\n----------------------------------------------\n\nFor the rules in the Linux Threats category to function as designed, devices must\ngenerate log data in the expected format. Configure the following persistent audit rules\nfor the Linux Audit Daemon on each device where you will collect logs and sent to Google SecOps.\n\nFor details about how to implement persistent audit rules for the Linux Audit Daemon,\nsee documentation specific to the operating system. \n\n # Inserts the machine hostname into each log event\n name_format = hostname\n\n # Process creation (32 and 64-bit)\n\n -a exit,always -F arch=b32 -S execve\n -a exit,always -F arch=b64 -S execve\n\n # Persistence: Cron\n\n -w /etc/cron.allow -p wa -k cron\n -w /etc/cron.d/ -p wa -k cron\n -w /etc/cron.daily/ -p wa -k cron\n -w /etc/cron.deny -p wa -k cron\n -w /etc/cron.hourly/ -p wa -k cron\n -w /etc/cron.monthly/ -p wa -k cron\n -w /etc/cron.weekly/ -p wa -k cron\n -w /etc/crontab -p wa -k cron\n -w /var/spool/cron/ -p wa -k cron\n\n # Persistence: System Startup\n\n -w /etc/init/ -p wa -k init\n -w /etc/init.d/ -p wa -k init\n -w /etc/inittab -p wa -k init\n\n # Persistence: Systemd Units and Generators\n\n -w /etc/systemd/user -p wa -k systemd\n -w /usr/lib/systemd/user -p wa -k systemd\n -w /var/lib/systemd/linger -p wa -k systemd\n -w /root/.config/systemd/user -pa wa -k systemd\n\n -w /etc/systemd/system -p wa -k systemd\n -w /usr/lib/systemd/system -p wa -k systemd\n\n -w /run/systemd/system-generators -p wa -k systemd\n -w /etc/systemd/system-generators -p wa -k systemd\n -w /usr/local/lib/systemd/system-generators -p wa -k systemd\n -w /usr/lib/systemd/system-generators -p wa -k systemd\n\n -w /run/systemd/user-generators -pa wa -k systemd\n -w /etc/systemd/user-generators -pa wa -k systemd\n -w /usr/local/lib/systemd/user-generators -pa wa -k systemd\n -w /usr/lib/systemd/user-generators -pa wa -k systemd\n\n # Persistence: IAM\n\n -w /etc/group -p wa -k iam_etcgroup\n -w /etc/passwd -p wa -k iam_etcpasswd\n -w /etc/gshadow -k iam_etcgroup\n -w /etc/shadow -k iam_etcpasswd\n\n -w /etc/sudoers -p wa -k iam_sudoers\n -w /etc/sudoers.d/ -p wa -k iam_sudoers_d\n\n -w /usr/bin/passwd -p x -k iam_passwd\n\n -w /usr/sbin/groupadd -p x -k iam_groupmod\n -w /usr/sbin/groupmod -p x -k iam_groupmod\n -w /usr/sbin/addgroup -p x -k iam_groupmod\n -w /usr/sbin/useradd -p x -k iam_usermod\n -w /usr/sbin/userdel -p x -k iam_usermod\n -w /usr/sbin/usermod -p x -k iam_usermod\n -w /usr/sbin/adduser -p x -k iam_usermod\n\n # Privilege Escalation\n\n -w /bin/su -p x -k privesc\n -w /usr/bin/sudo -p x -k privesc\n\n # Persistence: Libraries\n\n -w /etc/ld.so.conf -p wa -k libmod\n -w /etc/ld.so.conf.d -p wa -k libmod\n -w /etc/ld.so.preload -p wa -k libmod\n\n # Persistence: PAM\n\n -w /etc/pam.d/ -p wa -k pam\n -w /etc/security/ -p wa -k pam\n\n # Persistence: SSH\n\n -w /etc/ssh/ -p wa -k sshconfig\n -w /root/.ssh/ -p wa -k sshconfig\n\n # Persistence: Shell Configuration\n\n -w /etc/bashrc -p wa -k shellconfig\n -w /etc/csh.cshrc -p wa -k shellconfig\n -w /etc/csh.login -p wa -k shellconfig\n -w /etc/fish/ -p wa -k shellconfig\n -w /etc/profile -p wa -k shellconfig\n -w /etc/profile.d/ -p wa -k shellconfig\n -w /etc/shells -p wa -k shellconfig\n -w /etc/zsh/ -p wa -k shellconfig\n\n # Injection\n\n -a always,exit -F arch=b32 -S ptrace\n -a always,exit -F arch=b64 -S ptrace\n\n # Failed Access Attempts\n\n -a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k file_err\n\n # Network connections\n\n -a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -k net_v4\n -a always,exit -F arch=b32 -S connect -F a2=16 -F success=1 -k net_v4\n -a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -k net_v6\n -a always,exit -F arch=b32 -S connect -F a2=28 -F success=1 -k net_v6\n -a always,exit -F arch=b32 -S socket -F a0=2 -k sock_v4\n -a always,exit -F arch=b64 -S socket -F a0=2 -k sock_v4\n -a always,exit -F arch=b32 -S socket -F a0=10 -k sock_v6\n -a always,exit -F arch=b64 -S socket -F a0=10 -k sock_v6\n\nFields needed by Linux Threats category\n---------------------------------------\n\nThe following section describes specific data needed by rule sets in the Linux Threats category to get the greatest benefit. Make sure that your devices are configured to record the following data to device event logs.\n\nTuning alerts returned by Linux Threats category\n------------------------------------------------\n\nYou can reduce the number of detections a rule or rule set generates using\n[rule exclusions](/chronicle/docs/detection/rule-exclusions).\n\nIn the rule exclusion, you define the criteria of a UDM event that excludes the\nevent from being evaluated by the rule set.\n\nCreate one or more rule exclusions to identify criteria in a UDM event that\nexclude the event from being evaluated by this rule set or by specific rules in\nthe rule set. See\n[Configure rule exclusions](/chronicle/docs/detection/rule-exclusions)\nfor information about how to do this.\n\nFor example, you might exclude events based on the following UDM fields:\n\n- `principal.hostname`\n- `target.user.userid`\n- `principal.process.command_line`\n- `target.domain.name`\n- `target.process.command_line`\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
