Suspicious Access to AppArmor Policy Management Files

[rule]
description = """
Detects processes accessing AppArmor policy management pseudo-files located under "/sys/kernel/security/apparmor/".
These special kernel interfaces are used to load, replace, or remove AppArmor profiles (".load", ".replace", ".remove").
In normal environments, AppArmor policy management is typically performed by administrative tools such as
"apparmor_parser" during system initialization or package installation. Direct interaction with these pseudo-files from
shell utilities, interpreters, or scripting environments is uncommon and may indicate attempts to modify security policy
at runtime. Adversaries may abuse these interfaces to weaken or disable AppArmor protections, introduce malicious
profiles, or exploit vulnerabilities in the AppArmor policy parser as part of local privilege escalation chains.
"""
id = "bb0b594d-a674-47c7-9500-d48eb289e679"
license = "Elastic License v2"
name = "Suspicious Access to AppArmor Policy Management Files"
os_list = ["linux"]
reference = [
    "https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt",
    "https://blog.qualys.com/vulnerabilities-threat-research/2026/03/12/crackarmor-critical-apparmor-flaws-enable-local-privilege-escalation-to-root",
]
version = "1.0.1"

query = '''
process where event.type == "start" and event.action == "exec" and (
  process.name in (
    "cat", "echo", "tee", "dd", "truncate", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
    "busybox", "awk", "sed", "xargs", "find", "grep", "node", "timeout", "env"
  ) or
  process.name like (".*", "python*", "perl*", "ruby*", "lua*", "php*")
) and
process.command_line like (
  "*/sys/kernel/security/apparmor/.load*",
  "*/sys/kernel/security/apparmor/.replace*",
  "*/sys/kernel/security/apparmor/.remove*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"