Skip to content

Commit 40fc0cd

Browse files
roikolrafaeldtinoco
roikol
authored and
rafaeldtinoco
committed
signature: add kernel_module_loading.go sig
1 parent 0046569 commit 40fc0cd

File tree

3 files changed

+220
-0
lines changed

3 files changed

+220
-0
lines changed

‎signatures/golang/export.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,5 @@ var ExportedSignatures = []detect.Signature{
3131
&DynamicCodeLoading{},
3232
&FilelessExecution{},
3333
&IllegitimateShell{},
34+
&KernelModuleLoading{},
3435
}

‎signatures/golang/kernel_module_loading.go‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
6+
"github.com/aquasecurity/tracee/signatures/helpers"
7+
"github.com/aquasecurity/tracee/types/detect"
8+
"github.com/aquasecurity/tracee/types/protocol"
9+
"github.com/aquasecurity/tracee/types/trace"
10+
)
11+
12+
type KernelModuleLoading struct {
13+
cb detect.SignatureHandler
14+
}
15+
16+
func (sig *KernelModuleLoading) Init(cb detect.SignatureHandler) error {
17+
sig.cb = cb
18+
return nil
19+
}
20+
21+
func (sig *KernelModuleLoading) GetMetadata() (detect.SignatureMetadata, error) {
22+
return detect.SignatureMetadata{
23+
ID: "TRC-57",
24+
Version: "1",
25+
Name: "Kernel module loading detected",
26+
Description: "Loading of a kernel module was detected. Kernel modules are binaries meant to run in the kernel. Adversaries may try and load kernel modules to extend their capabilities and avoid detection by running in the kernel and not user space.",
27+
Properties: map[string]interface{}{
28+
"Severity": 2,
29+
"Category": "persistence",
30+
"Technique": "Kernel Modules and Extensions",
31+
"Kubernetes_Technique": "",
32+
"id": "attack-pattern--a1b52199-c8c5-438a-9ded-656f1d0888c6",
33+
"external_id": "T1547.006",
34+
},
35+
}, nil
36+
}
37+
38+
func (sig *KernelModuleLoading) GetSelectedEvents() ([]detect.SignatureEventSelector, error) {
39+
return []detect.SignatureEventSelector{
40+
{Source: "tracee", Name: "init_module", Origin: "*"},
41+
{Source: "tracee", Name: "security_kernel_read_file", Origin: "*"},
42+
}, nil
43+
}
44+
45+
func (sig *KernelModuleLoading) OnEvent(event protocol.Event) error {
46+
47+
eventObj, ok := event.Payload.(trace.Event)
48+
if !ok {
49+
return fmt.Errorf("invalid event")
50+
}
51+
52+
switch eventObj.EventName {
53+
54+
case "init_module":
55+
metadata, err := sig.GetMetadata()
56+
if err != nil {
57+
return err
58+
}
59+
sig.cb(detect.Finding{
60+
SigMetadata: metadata,
61+
Event: event,
62+
Data: nil,
63+
})
64+
65+
case "security_kernel_read_file":
66+
67+
loadedType, err := helpers.GetTraceeStringArgumentByName(eventObj, "type")
68+
if err != nil {
69+
return err
70+
}
71+
72+
if loadedType == "kernel-module" {
73+
metadata, err := sig.GetMetadata()
74+
if err != nil {
75+
return err
76+
}
77+
sig.cb(detect.Finding{
78+
SigMetadata: metadata,
79+
Event: event,
80+
Data: nil,
81+
})
82+
}
83+
84+
}
85+
86+
return nil
87+
}
88+
89+
func (sig *KernelModuleLoading) OnSignal(s detect.Signal) error {
90+
return nil
91+
}
92+
func (sig *KernelModuleLoading) Close() {}

‎signatures/golang/kernel_module_loading_test.go‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
package main
2+
3+
import (
4+
"testing"
5+
6+
"github.com/aquasecurity/tracee/signatures/signaturestest"
7+
"github.com/aquasecurity/tracee/types/detect"
8+
"github.com/aquasecurity/tracee/types/trace"
9+
"github.com/stretchr/testify/assert"
10+
"github.com/stretchr/testify/require"
11+
)
12+
13+
func TestKernelModuleLoading(t *testing.T) {
14+
testCases := []struct {
15+
Name string
16+
Events []trace.Event
17+
Findings map[string]detect.Finding
18+
}{
19+
{
20+
Name: "should trigger detection - init_module",
21+
Events: []trace.Event{
22+
{
23+
EventName: "init_module",
24+
},
25+
},
26+
Findings: map[string]detect.Finding{
27+
"TRC-57": {
28+
Data: nil,
29+
Event: trace.Event{
30+
EventName: "init_module",
31+
}.ToProtocol(),
32+
SigMetadata: detect.SignatureMetadata{
33+
ID: "TRC-57",
34+
Version: "1",
35+
Name: "Kernel module loading detected",
36+
Description: "Loading of a kernel module was detected. Kernel modules are binaries meant to run in the kernel. Adversaries may try and load kernel modules to extend their capabilities and avoid detection by running in the kernel and not user space.",
37+
Properties: map[string]interface{}{
38+
"Severity": 2,
39+
"Category": "persistence",
40+
"Technique": "Kernel Modules and Extensions",
41+
"Kubernetes_Technique": "",
42+
"id": "attack-pattern--a1b52199-c8c5-438a-9ded-656f1d0888c6",
43+
"external_id": "T1547.006",
44+
},
45+
},
46+
},
47+
},
48+
},
49+
{
50+
Name: "should trigger detection - security_kernel_read_file",
51+
Events: []trace.Event{
52+
{
53+
EventName: "security_kernel_read_file",
54+
Args: []trace.Argument{
55+
{
56+
ArgMeta: trace.ArgMeta{
57+
Name: "type",
58+
},
59+
Value: interface{}("kernel-module"),
60+
},
61+
},
62+
},
63+
},
64+
Findings: map[string]detect.Finding{
65+
"TRC-57": {
66+
Data: nil,
67+
Event: trace.Event{
68+
EventName: "security_kernel_read_file",
69+
Args: []trace.Argument{
70+
{
71+
ArgMeta: trace.ArgMeta{
72+
Name: "type",
73+
},
74+
Value: interface{}("kernel-module"),
75+
},
76+
},
77+
}.ToProtocol(),
78+
SigMetadata: detect.SignatureMetadata{
79+
ID: "TRC-57",
80+
Version: "1",
81+
Name: "Kernel module loading detected",
82+
Description: "Loading of a kernel module was detected. Kernel modules are binaries meant to run in the kernel. Adversaries may try and load kernel modules to extend their capabilities and avoid detection by running in the kernel and not user space.",
83+
Properties: map[string]interface{}{
84+
"Severity": 2,
85+
"Category": "persistence",
86+
"Technique": "Kernel Modules and Extensions",
87+
"Kubernetes_Technique": "",
88+
"id": "attack-pattern--a1b52199-c8c5-438a-9ded-656f1d0888c6",
89+
"external_id": "T1547.006",
90+
},
91+
},
92+
},
93+
},
94+
},
95+
{
96+
Name: "should not trigger detection - security_kernel_read_file wrong type",
97+
Events: []trace.Event{
98+
{
99+
EventName: "security_kernel_read_file",
100+
Args: []trace.Argument{
101+
{
102+
ArgMeta: trace.ArgMeta{
103+
Name: "type",
104+
},
105+
Value: interface{}("firmware"),
106+
},
107+
},
108+
},
109+
},
110+
Findings: map[string]detect.Finding{},
111+
},
112+
}
113+
114+
for _, tc := range testCases {
115+
t.Run(tc.Name, func(t *testing.T) {
116+
holder := signaturestest.FindingsHolder{}
117+
sig := KernelModuleLoading{}
118+
sig.Init(holder.OnFinding)
119+
120+
for _, e := range tc.Events {
121+
err := sig.OnEvent(e.ToProtocol())
122+
require.NoError(t, err)
123+
}
124+
assert.Equal(t, tc.Findings, holder.GroupBySigID())
125+
})
126+
}
127+
}

0 commit comments

Comments
 (0)