Este documento oferece uma visão geral dos conjuntos de regras na categoria "Ameaças do Linux", das fontes de dados necessárias e da configuração que você pode usar para ajustar os alertas gerados por esses conjuntos de regras.
Os conjuntos de regras na categoria "Ameaças do Linux" ajudam a identificar ameaças em ambientes Linux usando o CrowdStrike Falcon, o sistema de auditoria do Linux (AuditD) e os registros do sistema Unix.
Essa categoria inclui os seguintes conjuntos de regras:
Ferramentas de escalonamento de privilégios do SO: detecta comportamentos comuns em ferramentas de escalonamento de privilégios do Linux de código aberto.
Mecanismos de persistência:atividade usada por adversários para estabelecer
e manter o acesso persistente em hosts Linux.
Modificações de privilégios: atividade associada a tentativas e ações de autenticação privilegiada, comumente usadas para escalonamento de privilégios ou persistência em hosts Linux.
Sinais de malware: atividade binária suspeita de LOTL: detecta cenários suspeitos de uso de ferramentas integradas (Living Off the Land) com base na atividade observada de malware Linux em ambientes reais.
Indicadores de malware: atividade de download suspeita: detecta comportamentos relacionados a atividades de download maliciosas no Linux em ambientes reais.
Indicadores de malware: execução suspeita: detecta indicadores gerados por
comportamentos observados de malware Linux detectados em ambientes reais
com foco em comportamentos de execução (TA0002).
Ameaças da linha de frente da Mandiant: esse conjunto de regras contém regras derivadas da investigação e resposta da Mandiant a incidentes ativos em todo o mundo.
Essas regras abrangem TTPs comuns, como execução usando intérpretes de script (T1059), uso de serviços da Web para comando e controle (T1102) e uso de tarefas programadas para manter a persistência (T1053).
Ameaças emergentes da Mandiant Intel: esse conjunto de regras contém regras derivadas de campanhas de inteligência e eventos significativos da Mandiant, que abrangem atividades geopolíticas e de ameaças de alto impacto, conforme avaliado pela Mandiant.
Essa atividade pode incluir conflitos geopolíticos, exploração, phishing, malvertising, ransomware e comprometimentos da cadeia de suprimentos.
Dispositivos e tipos de registros aceitos
Os conjuntos de regras na categoria "Ameaças do Linux" foram testados e são compatíveis com as seguintes fontes de dados do Google Security Operations:
Sistema de auditoria do Linux (AUDITD)
Sistema Unix (NIX_SYSTEM)
CrowdStrike Falcon (CS_EDR)
Para uma lista de todas as fontes de dados compatíveis com o Google SecOps, consulte
Analistas padrão compatíveis.
Configurar dispositivos para gerar dados de registro corretos
Para que as regras na categoria "Ameaças do Linux" funcionem conforme o esperado, os dispositivos precisam
gerar dados de registro no formato esperado. Configure as seguintes regras de auditoria persistentes para o daemon de auditoria do Linux em cada dispositivo em que você vai coletar registros e enviar para o Google SecOps.
Para detalhes sobre como implementar regras de auditoria permanentes para o daemon de auditoria do Linux,
consulte a documentação específica do sistema operacional.
# Inserts the machine hostname into each log event
name_format = hostname
# Process creation (32 and 64-bit)
-a exit,always -F arch=b32 -S execve
-a exit,always -F arch=b64 -S execve
# Persistence: Cron
-w /etc/cron.allow -p wa -k cron
-w /etc/cron.d/ -p wa -k cron
-w /etc/cron.daily/ -p wa -k cron
-w /etc/cron.deny -p wa -k cron
-w /etc/cron.hourly/ -p wa -k cron
-w /etc/cron.monthly/ -p wa -k cron
-w /etc/cron.weekly/ -p wa -k cron
-w /etc/crontab -p wa -k cron
-w /var/spool/cron/ -p wa -k cron
# Persistence: System Startup
-w /etc/init/ -p wa -k init
-w /etc/init.d/ -p wa -k init
-w /etc/inittab -p wa -k init
# Persistence: Systemd Units and Generators
-w /etc/systemd/user -p wa -k systemd
-w /usr/lib/systemd/user -p wa -k systemd
-w /var/lib/systemd/linger -p wa -k systemd
-w /root/.config/systemd/user -pa wa -k systemd
-w /etc/systemd/system -p wa -k systemd
-w /usr/lib/systemd/system -p wa -k systemd
-w /run/systemd/system-generators -p wa -k systemd
-w /etc/systemd/system-generators -p wa -k systemd
-w /usr/local/lib/systemd/system-generators -p wa -k systemd
-w /usr/lib/systemd/system-generators -p wa -k systemd
-w /run/systemd/user-generators -pa wa -k systemd
-w /etc/systemd/user-generators -pa wa -k systemd
-w /usr/local/lib/systemd/user-generators -pa wa -k systemd
-w /usr/lib/systemd/user-generators -pa wa -k systemd
# Persistence: IAM
-w /etc/group -p wa -k iam_etcgroup
-w /etc/passwd -p wa -k iam_etcpasswd
-w /etc/gshadow -k iam_etcgroup
-w /etc/shadow -k iam_etcpasswd
-w /etc/sudoers -p wa -k iam_sudoers
-w /etc/sudoers.d/ -p wa -k iam_sudoers_d
-w /usr/bin/passwd -p x -k iam_passwd
-w /usr/sbin/groupadd -p x -k iam_groupmod
-w /usr/sbin/groupmod -p x -k iam_groupmod
-w /usr/sbin/addgroup -p x -k iam_groupmod
-w /usr/sbin/useradd -p x -k iam_usermod
-w /usr/sbin/userdel -p x -k iam_usermod
-w /usr/sbin/usermod -p x -k iam_usermod
-w /usr/sbin/adduser -p x -k iam_usermod
# Privilege Escalation
-w /bin/su -p x -k privesc
-w /usr/bin/sudo -p x -k privesc
# Persistence: Libraries
-w /etc/ld.so.conf -p wa -k libmod
-w /etc/ld.so.conf.d -p wa -k libmod
-w /etc/ld.so.preload -p wa -k libmod
# Persistence: PAM
-w /etc/pam.d/ -p wa -k pam
-w /etc/security/ -p wa -k pam
# Persistence: SSH
-w /etc/ssh/ -p wa -k sshconfig
-w /root/.ssh/ -p wa -k sshconfig
# Persistence: Shell Configuration
-w /etc/bashrc -p wa -k shellconfig
-w /etc/csh.cshrc -p wa -k shellconfig
-w /etc/csh.login -p wa -k shellconfig
-w /etc/fish/ -p wa -k shellconfig
-w /etc/profile -p wa -k shellconfig
-w /etc/profile.d/ -p wa -k shellconfig
-w /etc/shells -p wa -k shellconfig
-w /etc/zsh/ -p wa -k shellconfig
# Injection
-a always,exit -F arch=b32 -S ptrace
-a always,exit -F arch=b64 -S ptrace
# Failed Access Attempts
-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k file_err
-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k file_err
# Network connections
-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -k net_v4
-a always,exit -F arch=b32 -S connect -F a2=16 -F success=1 -k net_v4
-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -k net_v6
-a always,exit -F arch=b32 -S connect -F a2=28 -F success=1 -k net_v6
-a always,exit -F arch=b32 -S socket -F a0=2 -k sock_v4
-a always,exit -F arch=b64 -S socket -F a0=2 -k sock_v4
-a always,exit -F arch=b32 -S socket -F a0=10 -k sock_v6
-a always,exit -F arch=b64 -S socket -F a0=10 -k sock_v6
Campos necessários para a categoria "Ameaças do Linux"
A seção a seguir descreve os dados específicos necessários pelos conjuntos de regras na categoria "Ameaças do Linux" para oferecer o maior benefício. Verifique se os dispositivos estão configurados para registrar os seguintes dados nos registros de eventos do dispositivo.
Conjunto de dados
Campo do UDM (onde os dados são armazenados)
Definição
Principal Process Path
principal.process.file.full_path
Localização no disco do processo em execução atual, se disponível.
Linha de comando do processo principal
principal.process.command_line
Parâmetros de linha de comando do processo, se disponíveis.
Caminho do processo de destino
target.process.file.full_path
Localização no disco do processo de destino, se disponível.
Linha de comando do Target Process
target.process.command_line
Linha de comando
Domínio de consulta de DNS da rede
network.dns.questions.name
Nome de domínio das consultas DNS, se disponível.
Ajustar alertas retornados pela categoria "Ameaças do Linux"
É possível reduzir o número de detecções geradas por uma regra ou um conjunto de regras usando exclusões de regras.
Na exclusão de regra, você define os critérios de um evento da UDM que o exclui da avaliação pelo conjunto de regras.
Crie uma ou mais exclusões de regra para identificar critérios em um evento da UDM que
impedem que ele seja avaliado por esse conjunto de regras ou por regras específicas
do conjunto. Consulte Configurar exclusões de regras para informações sobre como fazer isso.
Por exemplo, é possível excluir eventos com base nos seguintes campos de UDM:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eThe Linux Threats category in Google SecOps helps identify potential threats in Linux environments using data from CrowdStrike Falcon, Linux Auditing System (AuditD), and Unix system logs.\u003c/p\u003e\n"],["\u003cp\u003eThis category includes various rule sets such as OS Privilege Escalation Tools, Persistence Mechanisms, Privilege Modifications, and multiple Malware Signals detectors, along with rules from Mandiant Front-Line and Emerging Threats Intel.\u003c/p\u003e\n"],["\u003cp\u003eTo ensure proper functionality, devices must be configured to generate log data in a specific format, including setting up persistent audit rules for the Linux Audit Daemon.\u003c/p\u003e\n"],["\u003cp\u003eSpecific UDM fields like \u003ccode\u003eprincipal.process.file.full_path\u003c/code\u003e, \u003ccode\u003eprincipal.process.command_line\u003c/code\u003e, and \u003ccode\u003enetwork.dns.questions.name\u003c/code\u003e are required for the Linux Threats category rule sets to function effectively.\u003c/p\u003e\n"],["\u003cp\u003eAlert tuning can be performed by creating rule exclusions based on criteria from UDM fields like \u003ccode\u003eprincipal.hostname\u003c/code\u003e, \u003ccode\u003etarget.user.userid\u003c/code\u003e, and \u003ccode\u003eprincipal.process.command_line\u003c/code\u003e, to reduce the number of detections.\u003c/p\u003e\n"]]],[],null,["# Overview of Linux Threats category\n==================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\n\u003cbr /\u003e\n\n| **Note:** This feature is not available to all customers in all regions.\n\n\u003cbr /\u003e\n\nThis document provides an overview of the rule sets in the Linux Threats\ncategory, the required data sources, and configuration you can use to tune the\nalerts generated by these rule sets.\n\nRule sets in the Linux Threats category help identify threats in Linux\nenvironments using CrowdStrike Falcon, Linux Auditing System (AuditD), and Unix system logs.\nThis category includes the following rule sets:\n\n- **OS Privilege Escalation Tools**: Detects behavior commonly seen in open source Linux privilege escalation tools.\n- **Persistence Mechanisms:** Activity used by adversaries to establish and maintain persistent access on Linux hosts.\n- **Privilege Modifications**: Activity associated with privileged authentication attempts and actions, commonly used to privilege-escalate or persist on Linux hosts.\n- **Malware Signals - Suspicious LOTL Binary Activity**: Detects suspicious built-in tool usage (Living Off the Land) scenarios based on the observed activity of Linux malware in real-world environments.\n- **Malware Signals - Suspicious Download Activity**: Detects behavior seen in relation to malicious download activity on Linux in real-world environments.\n- **Malware Signals - Suspicious Execution**: Detects signals generated from observed behaviors of Linux malware detected in real-world environments with a focus on Execution (TA0002) behaviors.\n- **Mandiant Front-Line Threats -** This rule set contains rules derived from Mandiant's investigation and response to active incidents across the world. These rules cover commonly seen TTPs such as execution using script interpreters (T1059), use of web services for command and control (T1102), and use of scheduled tasks to maintain persistence (T1053).\n- **Mandiant Intel Emerging Threats -** This rule set contains rules derived from Mandiant Intelligence Campaigns and Significant Events, which cover highly impactful geopolitical and threat activity, as assessed by Mandiant. This activity may include geopolitical conflict, exploitation, phishing, malvertising, ransomware, and supply chain compromises.\n\nSupported devices and log types\n-------------------------------\n\nRule sets in the Linux Threats category have been tested and are supported with\nthe following Google Security Operations supported\n[data sources](/chronicle/docs/ingestion/parser-list/supported-default-parsers):\n\n- Linux Auditing System (`AUDITD`)\n- Unix system (`NIX_SYSTEM`)\n- CrowdStrike Falcon (`CS_EDR`)\n\nFor a list of all Google SecOps supported data sources, see\n[Supported default parsers](/chronicle/docs/ingestion/parser-list/supported-default-parsers).\n\nConfigure devices to generate correct log data\n----------------------------------------------\n\nFor the rules in the Linux Threats category to function as designed, devices must\ngenerate log data in the expected format. Configure the following persistent audit rules\nfor the Linux Audit Daemon on each device where you will collect logs and sent to Google SecOps.\n\nFor details about how to implement persistent audit rules for the Linux Audit Daemon,\nsee documentation specific to the operating system. \n\n # Inserts the machine hostname into each log event\n name_format = hostname\n\n # Process creation (32 and 64-bit)\n\n -a exit,always -F arch=b32 -S execve\n -a exit,always -F arch=b64 -S execve\n\n # Persistence: Cron\n\n -w /etc/cron.allow -p wa -k cron\n -w /etc/cron.d/ -p wa -k cron\n -w /etc/cron.daily/ -p wa -k cron\n -w /etc/cron.deny -p wa -k cron\n -w /etc/cron.hourly/ -p wa -k cron\n -w /etc/cron.monthly/ -p wa -k cron\n -w /etc/cron.weekly/ -p wa -k cron\n -w /etc/crontab -p wa -k cron\n -w /var/spool/cron/ -p wa -k cron\n\n # Persistence: System Startup\n\n -w /etc/init/ -p wa -k init\n -w /etc/init.d/ -p wa -k init\n -w /etc/inittab -p wa -k init\n\n # Persistence: Systemd Units and Generators\n\n -w /etc/systemd/user -p wa -k systemd\n -w /usr/lib/systemd/user -p wa -k systemd\n -w /var/lib/systemd/linger -p wa -k systemd\n -w /root/.config/systemd/user -pa wa -k systemd\n\n -w /etc/systemd/system -p wa -k systemd\n -w /usr/lib/systemd/system -p wa -k systemd\n\n -w /run/systemd/system-generators -p wa -k systemd\n -w /etc/systemd/system-generators -p wa -k systemd\n -w /usr/local/lib/systemd/system-generators -p wa -k systemd\n -w /usr/lib/systemd/system-generators -p wa -k systemd\n\n -w /run/systemd/user-generators -pa wa -k systemd\n -w /etc/systemd/user-generators -pa wa -k systemd\n -w /usr/local/lib/systemd/user-generators -pa wa -k systemd\n -w /usr/lib/systemd/user-generators -pa wa -k systemd\n\n # Persistence: IAM\n\n -w /etc/group -p wa -k iam_etcgroup\n -w /etc/passwd -p wa -k iam_etcpasswd\n -w /etc/gshadow -k iam_etcgroup\n -w /etc/shadow -k iam_etcpasswd\n\n -w /etc/sudoers -p wa -k iam_sudoers\n -w /etc/sudoers.d/ -p wa -k iam_sudoers_d\n\n -w /usr/bin/passwd -p x -k iam_passwd\n\n -w /usr/sbin/groupadd -p x -k iam_groupmod\n -w /usr/sbin/groupmod -p x -k iam_groupmod\n -w /usr/sbin/addgroup -p x -k iam_groupmod\n -w /usr/sbin/useradd -p x -k iam_usermod\n -w /usr/sbin/userdel -p x -k iam_usermod\n -w /usr/sbin/usermod -p x -k iam_usermod\n -w /usr/sbin/adduser -p x -k iam_usermod\n\n # Privilege Escalation\n\n -w /bin/su -p x -k privesc\n -w /usr/bin/sudo -p x -k privesc\n\n # Persistence: Libraries\n\n -w /etc/ld.so.conf -p wa -k libmod\n -w /etc/ld.so.conf.d -p wa -k libmod\n -w /etc/ld.so.preload -p wa -k libmod\n\n # Persistence: PAM\n\n -w /etc/pam.d/ -p wa -k pam\n -w /etc/security/ -p wa -k pam\n\n # Persistence: SSH\n\n -w /etc/ssh/ -p wa -k sshconfig\n -w /root/.ssh/ -p wa -k sshconfig\n\n # Persistence: Shell Configuration\n\n -w /etc/bashrc -p wa -k shellconfig\n -w /etc/csh.cshrc -p wa -k shellconfig\n -w /etc/csh.login -p wa -k shellconfig\n -w /etc/fish/ -p wa -k shellconfig\n -w /etc/profile -p wa -k shellconfig\n -w /etc/profile.d/ -p wa -k shellconfig\n -w /etc/shells -p wa -k shellconfig\n -w /etc/zsh/ -p wa -k shellconfig\n\n # Injection\n\n -a always,exit -F arch=b32 -S ptrace\n -a always,exit -F arch=b64 -S ptrace\n\n # Failed Access Attempts\n\n -a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k file_err\n -a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k file_err\n\n # Network connections\n\n -a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -k net_v4\n -a always,exit -F arch=b32 -S connect -F a2=16 -F success=1 -k net_v4\n -a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -k net_v6\n -a always,exit -F arch=b32 -S connect -F a2=28 -F success=1 -k net_v6\n -a always,exit -F arch=b32 -S socket -F a0=2 -k sock_v4\n -a always,exit -F arch=b64 -S socket -F a0=2 -k sock_v4\n -a always,exit -F arch=b32 -S socket -F a0=10 -k sock_v6\n -a always,exit -F arch=b64 -S socket -F a0=10 -k sock_v6\n\nFields needed by Linux Threats category\n---------------------------------------\n\nThe following section describes specific data needed by rule sets in the Linux Threats category to get the greatest benefit. Make sure that your devices are configured to record the following data to device event logs.\n\nTuning alerts returned by Linux Threats category\n------------------------------------------------\n\nYou can reduce the number of detections a rule or rule set generates using\n[rule exclusions](/chronicle/docs/detection/rule-exclusions).\n\nIn the rule exclusion, you define the criteria of a UDM event that excludes the\nevent from being evaluated by the rule set.\n\nCreate one or more rule exclusions to identify criteria in a UDM event that\nexclude the event from being evaluated by this rule set or by specific rules in\nthe rule set. See\n[Configure rule exclusions](/chronicle/docs/detection/rule-exclusions)\nfor information about how to do this.\n\nFor example, you might exclude events based on the following UDM fields:\n\n- `principal.hostname`\n- `target.user.userid`\n- `principal.process.command_line`\n- `target.domain.name`\n- `target.process.command_line`\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
