Detectionmediumtest
Bpfdoor TCP Ports Redirect
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
Linuxauditd
ProductLinux← raw: linux
Serviceauditd← raw: auditd
Detection Logic
Detection Logic2 selectors
detection:
cmd:
type: 'EXECVE'
a0|endswith: 'iptables'
a1: '-t'
a2: 'nat'
keywords:
- '--to-ports 42'
- '--to-ports 43'
condition: cmd and keywordsFalse Positives
Legitimate ports redirect
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
70b4156e-50fc-4523-aa50-c9dddf1993fc
Status
test
Level
medium
Type
Detection
Created
Wed Aug 10
Author
Path
rules/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml
Raw Tags
attack.defense-evasionattack.t1562.004