Detection rules › Sigma
Bpfdoor TCP Ports Redirect
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment | T1686 Disable or Modify System Firewall |
Event coverage
| Provider | Event |
|---|---|
| Linux-Auditd | Event ID 1309 |
Rule body yaml
title: Bpfdoor TCP Ports Redirect
id: 70b4156e-50fc-4523-aa50-c9dddf1993fc
status: test
description: |
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
references:
- https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
- https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
author: Rafal Piasecki
date: 2022-08-10
tags:
- attack.defense-impairment
- attack.t1686
logsource:
product: linux
service: auditd
detection:
cmd:
type: 'EXECVE'
a0|endswith: 'iptables'
a1: '-t'
a2: 'nat'
keywords:
- '--to-ports 42'
- '--to-ports 43'
condition: cmd and keywords
falsepositives:
- Legitimate ports redirect
level: medium
Stages and Predicates
Stage 0: condition
cmd and keywordsStage 1: cmd
cmd:
type: 'EXECVE'
a0|endswith: 'iptables'
a1: '-t'
a2: 'nat'
Stage 2: keywords
keywords:
- '--to-ports 42'
- '--to-ports 43'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.