splApache-2.0from splunk/security_content

Linux Auditd Possible Access Or Modification Of Sshd Config File

The following analytic detects access, deletion or modification of the ssh_config file on Linux systems. It leverages data from Linux Auditd, focusing on events of type PATH with a nametype of ("NORMAL", "CREATE", "DELETE"). This activity could be significant because unauthorized changes to ssh_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system. Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml

`linux_auditd`
(
  (type=PATH nametype IN ("NORMAL", "CREATE", "DELETE"))
  OR
  type=CWD
)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"

| stats
  values(type) as types
  values(name) as names
  values(nametype) as nametype
  values(cwd) as cwd_list
  values(_time) as event_times
  by audit_id, host

| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/ssh/ssh_config.*"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest

| stats count min(e_time) as firstTime max(e_time) as lastTime
  values(nametype) as nametype
  by current_working_directory
     reconstructed_path
     match_count
     dest
     audit_id

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
|  `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`