update: Potential Netcat Reverse Shell Execution - add nc.openbsd and nc.traditional binary matches#6013
Open
Bit-ByteBandit wants to merge 4 commits into
Open
Conversation
These certificate trust update utilities are shell scripts, not regular binaries. In process creation logs, the Image field may show the shell interpreter while the actual utility appears in CommandLine. This changes the detection from Image|endswith to CommandLine|contains to avoid missing script-based executions.
Expand the netcat reverse shell rule to also match nc.openbsd and nc.traditional. Keep the existing /nc match because nc may be installed directly as the binary name or exposed through alternatives/symlinks on some systems. Keeping it avoids reducing coverage while adding coverage for additional netcat binary names.
github-actions
Bot
added
Rules
Review Needed
Comment on lines
23
to
26
| - '/nc' | ||
| - '/nc.openbsd' | ||
| - '/nc.traditional' | ||
| - '/ncat' |
Collaborator
There was a problem hiding this comment.
Suggested change
| - '/nc' | |
| - '/nc.openbsd' | |
| - '/nc.traditional' | |
| - '/ncat' | |
| - '/nc.openbsd' | |
| - '/nc.traditional' | |
| - '/nc' | |
| - '/ncat' | |
| - '/netcat.openbsd' | |
| - '/netcat.traditional' | |
| - '/netcat' |
| - https://www.infosecademy.com/netcat-reverse-shells/ | ||
| - https://man7.org/linux/man-pages/man1/ncat.1.html | ||
| author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' | ||
| author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems), Eissa Bageri' |
Collaborator
There was a problem hiding this comment.
Suggested change
| author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems), Eissa Bageri' | |
| author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' |
Adding a few entries to existing logic doesn't constitute authorship unless a major change is made to rule's logic
Comment on lines
+18
to
+20
| CommandLine|contains: | ||
| - 'update-ca-certificates' | ||
| - 'update-ca-trust' |
Collaborator
There was a problem hiding this comment.
Either close your old PR #6013 to keep this change here (making all the necessary changes of PR title, description etc ofc) or remove this change
swachchhanda000
added
the
Author Input Required
Collaborator
swachchhanda000
left a comment
swachchhanda000
left a comment
There was a problem hiding this comment.
Hi @Bit-ByteBandit,
Thanks for your submission. Looks solid.
I have same questions and suggestion for you. please have a look.
Cheers!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of the Pull Request
Expand the Linux
Potential Netcat Reverse Shell Executionrule to also matchnc.openbsdandnc.traditional.The existing
/ncmatch is kept becausencis commonly used as a symlink tonc.openbsdon some systems. Keeping it avoids reducing coverage while adding coverage for additional netcat binary names.Changelog
update: Potential Netcat Reverse Shell Execution - add nc.openbsd and nc.traditional binary matches
Example Log Event
N/A
Fixed Issues
N/A
SigmaHQ Rule Creation Conventions