Skip to content

Back to the catalog

bencteux.frwriteup

Detecting insiders on GNU/Linux servers

A practical guide to building an auditd-based Linux intrusion detection ruleset covering reconnaissance (tcpdump/wireshark/nmap install and execution), privilege escalation (setuid/setgid syscalls, sudoers and /etc/passwd modification, process injection via ptrace and process_vm_writev), container escape via host filesystem remounting, lateral movement (xfreerdp), persistence (SSH authorized_keys, cron, systemd units, udev rules), and detection evasion via /dev/shm. Each rule is accompanied by working C PoCs and ausearch log output to validate detection, plus discussion of auditd's limitations (no path globbing, kernel syscalls only, incomplete file-change detection). Based on the author's incident response and pentesting experience, the rules and full ruleset are published on a companion GitHub repo.

TL;DR A tested, incident-response-derived auditd ruleset (with PoCs) for detecting recon, privesc, container escape, persistence, and evasion on Linux servers.
Open original ↗
Document

What it is

A self-hosted auditd ruleset (published on GitHub) for detecting intruders on GNU/Linux servers specifically — not workstations. The author frames all attacker activity as reducing to four auditable primitives: read a file, write a file, execute a binary, load a kernel module. The design goal is low false-positive rate: rules should mean "if this matches, the behaviour is suspicious," deliberately not alerting on sysadmin-plausible commands like whoami, ss -ltpn, ls /etc/cron.d, cat /etc/passwd.

How it works

Each technique gets two kinds of rule: a watch on the tool's binary path to catch installation/modification (write), and an exec rule to catch usage. The verbatim rules from the page:

# tcpdump install/modification
-w /usr/bin/tcpdump -p wa -k detect_tcpdump_install
# tcpdump use
-a always,exit -F path=/usr/bin/tcpdump -F perm=x -k detect_tcpdump_exec

# wireshark / tshark
-w /usr/bin/wireshark -p wa -k detect_wireshark_install
-w /usr/bin/tshark -p wa -k detect_tshark_install
-a always,exit -F path=/usr/bin/wireshark -F perm=x -k detect_wireshark_exec
-a always,exit -F path=/usr/bin/tshark -F perm=x -k detect_tshark_exec

# nmap (note: use rule here is a watch, not always,exit)
-w /usr/bin/nmap -p wa -k detect_nmap_install
-w /usr/bin/nmap -p x -k detect_nmap

# User/group database modification
-w /etc/passwd -p wa -k detect_modify_passwd
-w /etc/shadow -p wa -k detect_modify_shadow
-w /etc/group -p wa -k detect_modify_group
-w /etc/gshadow -p wa -k detect_modify_gshadow

Preconditions / Affected

Assumes auditd is running and the tool paths are /usr/bin/* — adjust paths for distros/installs that differ. Tuned for a server profile (few installed tools, low user activity, many daemons); the author warns it will generate noise on a workstation. Binary-path watches only fire if the attacker uses the system binary at that path, not a dropped copy elsewhere.

Caveats

The author states plainly this is a cat-and-mouse game: the rules will not catch all privilege-escalation or persistence methods, nor future techniques. The benign-command list (whoami, cat /etc/passwd, etc.) is intentionally not alerted on — treat it as corroborating context for an already-triggered signature, not as a standalone detection. The fetched page cuts off mid-sentence in the sudoers section, so the sudoers rule itself is not shown here — consult the GitHub repo for the complete set.

Note the inconsistency worth checking against the repo: nmap "use" is written as a -p x watch rather than the -a always,exit ... perm=x form used for the sniffers.

Technologies named here

Techniques named here

  • Network sniffing for reconnaissance
  • Network scanning with nmap
  • Privilege escalation via set*id syscalls to root
  • Persistence via scheduled cron tasks
  • Persistence via systemd unit/service file creation
  • Persistence via udev rules addition
  • Detection evasion / fileless malware via shared memory

Related in Blue Team & Detection