Detection rules › Panther
A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094
Detects vulnerable versions of XZ and liblzma on Linux and MacOS using Osquery logs. Versions 5.6.0 and 5.6.1 of xz and liblzma are most likely vulnerable to backdoor exploit. Vuln management pack must be enabled: https://github.com/osquery/osquery/blob/master/packs/vuln-management.conf
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools |
Rule body yaml
AnalysisType: rule
Filename: osquery_linux_mac_vulnerable_xz_liblzma.py
RuleID: "Osquery.Linux.Mac.VulnerableXZliblzma"
DisplayName: "A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094"
Enabled: true
LogTypes:
- Osquery.Differential
Tags:
- Osquery
- MacOS
- Linux
- Emerging Threats
- Supply Chain Compromise
Reports:
MITRE ATT&CK:
- TA0001:T1195.001
Severity: High
Description: >
Detects vulnerable versions of XZ and liblzma on Linux and MacOS using Osquery logs.
Versions 5.6.0 and 5.6.1 of xz and liblzma are most likely vulnerable to backdoor exploit.
Vuln management pack must be enabled: https://github.com/osquery/osquery/blob/master/packs/vuln-management.conf
Runbook: Upgrade/downgrade xz and liblzma to non-vulnerable versions
Reference: https://gist.github.com/jamesspi/ee8319f55d49b4f44345c626f80c430f
SummaryAttributes:
- name
- hostIdentifier
- action
Tests:
- Name: Vulnerable liblzma
ExpectedResult: true
Log:
{
"name": "pack_vuln-management_rpm_packages",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"source": "test-host",
"name": "liblzma.so",
"version": "5.6.1.000",
"status": "Potentially vulnerable",
},
}
- Name: Vulnerable xz
ExpectedResult: true
Log:
{
"name": "pack_vuln-management_deb_packages",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"source": "test-host",
"name": "xz",
"version": "5.6.0.000",
"status": "Potentially vulnerable",
},
}
- Name: Not vulnerable
ExpectedResult: false
Log:
{
"name": "pack_vuln-management_rpm_packages",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"source": "test-host",
"name": "liblzma.so",
"version": "5.4.6.000",
"status": "Most likely not vulnerable",
},
}
Detection logic
Condition
name in ["pack_vuln-management_homebrew_packages", "pack_vuln-management_deb_packages", "pack_vuln-management_rpm_packages"]
columns.name in ["xz", "liblzma", "xz-libs", "xz-utils"] or columns.name starts_with "liblzma"
columns.version starts_with "5.6.0" or columns.version starts_with "5.6.1"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
columns.name | in |
|
columns.name | starts_with |
|
columns.version | starts_with |
|
name | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
name | columns.name |
version | columns.version |
hostIdentifier |