Elastic low stable eql

Binfmt Configuration File Creation

This rule detects the creation of a binfmt configuration file. Binfmt is a utility that is used to configure the behavior of the Linux kernel when executing binary files. By creating a malicious binfmt configuration file, threat actors can execute a backdoor script or command on the target system.

View Source

Detection Logic

file where host.os.type == "linux" and event.action != "deletion" and process.executable != null and
file.path like (
  "/etc/binfmt.d/*.conf", "/run/binfmt.d/*.conf", "/usr/local/lib/binfmt.d/*.conf", "/usr/lib/binfmt.d/*.conf",
  "/proc/sys/fs/binfmt_misc/register", "/proc/sys/fs/binfmt_misc/*"
) and
not (
  file.path like (
    "/usr/lib/binfmt.d/python3.*.conf", "/usr/lib/binfmt.d/qemu-*-static.conf",
    "/proc/sys/fs/binfmt_misc/status"
  ) or
  process.executable == "/usr/lib/systemd/systemd-binfmt"
)

Field Validations

Loading…

Comments (0)

Loading comments...