Skip to content

Commit b1013aa

Browse files
roikolrafaeldtinoco
roikol
authored and
rafaeldtinoco
committed
signature: add proc_kcore_read.go sig
1 parent 2125a85 commit b1013aa

File tree

3 files changed

+226
-0
lines changed

3 files changed

+226
-0
lines changed

‎signatures/golang/export.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,5 @@ var ExportedSignatures = []detect.Signature{
2121
&CgroupReleaseAgentModification{},
2222
&RcdModification{},
2323
&CorePatternModification{},
24+
&ProcKcoreRead{},
2425
}

‎signatures/golang/proc_kcore_read.go‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
"strings"
6+
7+
"github.com/aquasecurity/tracee/signatures/helpers"
8+
"github.com/aquasecurity/tracee/types/detect"
9+
"github.com/aquasecurity/tracee/types/protocol"
10+
"github.com/aquasecurity/tracee/types/trace"
11+
)
12+
13+
type ProcKcoreRead struct {
14+
cb detect.SignatureHandler
15+
kcorePath string
16+
}
17+
18+
func (sig *ProcKcoreRead) Init(cb detect.SignatureHandler) error {
19+
sig.cb = cb
20+
sig.kcorePath = "/proc/kcore"
21+
return nil
22+
}
23+
24+
func (sig *ProcKcoreRead) GetMetadata() (detect.SignatureMetadata, error) {
25+
return detect.SignatureMetadata{
26+
ID: "TRC-96",
27+
Version: "1",
28+
Name: "Kcore memory file read",
29+
Description: "An attempt to read /proc/kcore file was detected. KCore provides a full dump of the physical memory of the system in the core file format. Adversaries may read this file to get all of the host memory and use this information for container escape.",
30+
Properties: map[string]interface{}{
31+
"Severity": 2,
32+
"Category": "privilege-escalation",
33+
"Technique": "Escape to Host",
34+
"Kubernetes_Technique": "",
35+
"id": "attack-pattern--4a5b7ade-8bb5-4853-84ed-23f262002665",
36+
"external_id": "T1611",
37+
},
38+
}, nil
39+
}
40+
41+
func (sig *ProcKcoreRead) GetSelectedEvents() ([]detect.SignatureEventSelector, error) {
42+
return []detect.SignatureEventSelector{
43+
{Source: "tracee", Name: "security_file_open", Origin: "container"},
44+
}, nil
45+
}
46+
47+
func (sig *ProcKcoreRead) OnEvent(event protocol.Event) error {
48+
49+
eventObj, ok := event.Payload.(trace.Event)
50+
if !ok {
51+
return fmt.Errorf("invalid event")
52+
}
53+
54+
switch eventObj.EventName {
55+
56+
case "security_file_open":
57+
pathname, err := helpers.GetTraceeStringArgumentByName(eventObj, "pathname")
58+
if err != nil {
59+
return err
60+
}
61+
62+
flags, err := helpers.GetTraceeStringArgumentByName(eventObj, "flags")
63+
if err != nil {
64+
return err
65+
}
66+
67+
if strings.HasSuffix(pathname, sig.kcorePath) && helpers.IsFileRead(flags) {
68+
metadata, err := sig.GetMetadata()
69+
if err != nil {
70+
return err
71+
}
72+
sig.cb(detect.Finding{
73+
SigMetadata: metadata,
74+
Event: event,
75+
Data: nil,
76+
})
77+
}
78+
79+
}
80+
81+
return nil
82+
}
83+
84+
func (sig *ProcKcoreRead) OnSignal(s detect.Signal) error {
85+
return nil
86+
}
87+
func (sig *ProcKcoreRead) Close() {}

‎signatures/golang/proc_kcore_read_test.go‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
package main
2+
3+
import (
4+
"testing"
5+
6+
"github.com/aquasecurity/tracee/signatures/signaturestest"
7+
"github.com/aquasecurity/tracee/types/detect"
8+
"github.com/aquasecurity/tracee/types/trace"
9+
"github.com/stretchr/testify/assert"
10+
"github.com/stretchr/testify/require"
11+
)
12+
13+
func TestProcKcoreRead(t *testing.T) {
14+
testCases := []struct {
15+
Name string
16+
Events []trace.Event
17+
Findings map[string]detect.Finding
18+
}{
19+
{
20+
Name: "should trigger detection",
21+
Events: []trace.Event{
22+
{
23+
EventName: "security_file_open",
24+
Args: []trace.Argument{
25+
{
26+
ArgMeta: trace.ArgMeta{
27+
Name: "flags",
28+
},
29+
Value: interface{}("O_RDONLY"),
30+
},
31+
{
32+
ArgMeta: trace.ArgMeta{
33+
Name: "pathname",
34+
},
35+
Value: interface{}("/proc/kcore"),
36+
},
37+
},
38+
},
39+
},
40+
Findings: map[string]detect.Finding{
41+
"TRC-96": {
42+
Data: nil,
43+
Event: trace.Event{
44+
EventName: "security_file_open",
45+
Args: []trace.Argument{
46+
{
47+
ArgMeta: trace.ArgMeta{
48+
Name: "flags",
49+
},
50+
Value: interface{}("O_RDONLY"),
51+
},
52+
{
53+
ArgMeta: trace.ArgMeta{
54+
Name: "pathname",
55+
},
56+
Value: interface{}("/proc/kcore"),
57+
},
58+
},
59+
}.ToProtocol(),
60+
SigMetadata: detect.SignatureMetadata{
61+
ID: "TRC-96",
62+
Version: "1",
63+
Name: "Kcore memory file read",
64+
Description: "An attempt to read /proc/kcore file was detected. KCore provides a full dump of the physical memory of the system in the core file format. Adversaries may read this file to get all of the host memory and use this information for container escape.",
65+
Properties: map[string]interface{}{
66+
"Severity": 2,
67+
"Category": "privilege-escalation",
68+
"Technique": "Escape to Host",
69+
"Kubernetes_Technique": "",
70+
"id": "attack-pattern--4a5b7ade-8bb5-4853-84ed-23f262002665",
71+
"external_id": "T1611",
72+
},
73+
},
74+
},
75+
},
76+
},
77+
{
78+
Name: "should not trigger detection - wrong open flags",
79+
Events: []trace.Event{
80+
{
81+
EventName: "security_file_open",
82+
Args: []trace.Argument{
83+
{
84+
ArgMeta: trace.ArgMeta{
85+
Name: "pathname",
86+
},
87+
Value: interface{}("/proc/kcore"),
88+
},
89+
{
90+
ArgMeta: trace.ArgMeta{
91+
Name: "flags",
92+
},
93+
Value: interface{}("O_WRONLY"),
94+
},
95+
},
96+
},
97+
},
98+
Findings: map[string]detect.Finding{},
99+
},
100+
{
101+
Name: "should not trigger detection - wrong path",
102+
Events: []trace.Event{
103+
{
104+
EventName: "security_file_open",
105+
Args: []trace.Argument{
106+
{
107+
ArgMeta: trace.ArgMeta{
108+
Name: "pathname",
109+
},
110+
Value: interface{}("/proc/something"),
111+
},
112+
{
113+
ArgMeta: trace.ArgMeta{
114+
Name: "flags",
115+
},
116+
Value: interface{}("O_RDONLY"),
117+
},
118+
},
119+
},
120+
},
121+
Findings: map[string]detect.Finding{},
122+
},
123+
}
124+
125+
for _, tc := range testCases {
126+
t.Run(tc.Name, func(t *testing.T) {
127+
holder := signaturestest.FindingsHolder{}
128+
sig := ProcKcoreRead{}
129+
sig.Init(holder.OnFinding)
130+
131+
for _, e := range tc.Events {
132+
err := sig.OnEvent(e.ToProtocol())
133+
require.NoError(t, err)
134+
}
135+
assert.Equal(t, tc.Findings, holder.GroupBySigID())
136+
})
137+
}
138+
}

0 commit comments

Comments
 (0)