Bpfdoor TCP Ports Redirect

Status: test
Severity: medium
Log source: product linux, service auditd
Author: Rafal Piasecki
Source: github.com/SigmaHQ/sigma

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

Known false positives

Legitimate ports redirect

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1686` Disable or Modify System Firewall

Telemetry coverage

Platform	Record / event type
Linux	auditd EXECVE record: Arguments supplied to the execve system call

Rule body

title: Bpfdoor TCP Ports Redirect
id: 70b4156e-50fc-4523-aa50-c9dddf1993fc
status: test
description: |
    All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
    The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
references:
    - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
    - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
author: Rafal Piasecki
date: 2022-08-10
tags:
    - attack.defense-impairment
    - attack.t1686
logsource:
    product: linux
    service: auditd
detection:
    cmd:
        type: 'EXECVE'
        a0|endswith: 'iptables'
        a1: '-t'
        a2: 'nat'
    keywords:
        - '--to-ports 42'
        - '--to-ports 43'
    condition: cmd and keywords
falsepositives:
    - Legitimate ports redirect
level: medium

Stages and Predicates

Stage 0: `condition`

cmd and keywords

Stage 1: `cmd`

cmd:
    type: 'EXECVE'
    a0|endswith: 'iptables'
    a1: '-t'
    a2: 'nat'

Stage 2: `keywords`

keywords:
    - '--to-ports 42'
    - '--to-ports 43'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`a0`	ends_with	`iptables`	`field:"a0" kind:ends_with value:"iptables"`
`a1`	eq	`-t`	`field:"a1" kind:eq value:"-t"`
`a2`	eq	`nat`	`field:"a2" kind:eq value:"nat"`
`type`	eq	`EXECVE`	`field:"type" kind:eq value:"EXECVE"`