Detect Socket Filters in Google Chronicle

// T1205.002 — Socket Filters / BPF Passive Backdoor Detection
// Rule 1 of 2: Auditd SYSCALL signals — BPF filter attachment and raw socket creation
// Requires Chronicle ingestion of Linux auditd logs with LINUX_AUDIT log type parser

rule t1205_002_bpf_socket_filter_syscall {
  meta:
    author          = "df00tech"
    description     = "Detects setsockopt(SO_ATTACH_FILTER) and raw socket creation (AF_PACKET/SOCK_RAW) used by BPFDoor, Penquin/Turla, CASTLETAP, and PITSTOP passive backdoors (T1205.002)"
    mitre_tactic    = "Defense Evasion, Persistence, Command And Control"
    mitre_technique = "T1205.002"
    reference       = "https://attack.mitre.org/techniques/T1205/002/"
    severity        = "HIGH"
    priority        = "HIGH"
    version         = "1.1"
    created         = "2026-04-19"

  events:
    $e.metadata.log_type = "LINUX_AUDIT"
    $e.metadata.product_event_type = "SYSCALL"
    (
      // Signal 1: setsockopt(SOL_SOCKET=1, SO_ATTACH_FILTER=26=0x1a) — syscall 54
      // Direct BPF filter installation: highest fidelity, matches BPFDoor exactly
      (
        re.regex($e.target.process.command_line, `syscall=54`) and
        re.regex($e.target.process.command_line, `\ba1=1\b`) and
        re.regex($e.target.process.command_line, `\ba2=1a\b`)
      )
      or
      // Signal 2a: socket(AF_PACKET=0x11, ...) — syscall 41, a0=11
      // Raw packet socket creation: precursor step before BPF filter attachment
      (
        re.regex($e.target.process.command_line, `syscall=41`) and
        re.regex($e.target.process.command_line, `\ba0=11\b`)
      )
      or
      // Signal 2b: socket(AF_INET=2, SOCK_RAW=3) — syscall 41, a0=2, a1=3
      (
        re.regex($e.target.process.command_line, `syscall=41`) and
        re.regex($e.target.process.command_line, `\ba0=2\b`) and
        re.regex($e.target.process.command_line, `\ba1=3\b`)
      )
    )
    not $e.principal.process.file.full_path = "/usr/sbin/tcpdump"
    not $e.principal.process.file.full_path = "/usr/bin/tcpdump"
    not $e.principal.process.file.full_path = "/usr/bin/tshark"
    not $e.principal.process.file.full_path = "/usr/bin/dumpcap"
    not $e.principal.process.file.full_path = "/usr/sbin/dhclient"
    not $e.principal.process.file.full_path = "/sbin/dhclient"
    not $e.principal.process.file.full_path = "/usr/bin/dhclient"
    not $e.principal.process.file.full_path = "/usr/sbin/arping"
    not $e.principal.process.file.full_path = "/usr/bin/ping"
    not $e.principal.process.file.full_path = "/bin/ping"
    not $e.principal.process.file.full_path = "/usr/bin/nmap"
    not $e.principal.process.file.full_path = "/usr/sbin/nmap"
    not $e.principal.process.file.full_path = "/usr/bin/hping3"
    not $e.principal.process.file.full_path = "/usr/sbin/hping3"

  condition:
    $e
}

// Rule 2 of 2: BPFDoor staging path execution
// Detects execution of binaries from world-writable paths — BPFDoor copies
// itself to /tmp or /dev/shm before attaching filters and deleting the original
// Requires Chronicle PROCESS_LAUNCH event ingestion (Elastic/CrowdStrike/Sysmon Linux)

rule t1205_002_bpfdoor_staging_exec {
  meta:
    author          = "df00tech"
    description     = "Detects process execution from world-writable staging paths associated with BPFDoor self-copy persistence mechanism (T1205.002)"
    mitre_tactic    = "Defense Evasion, Persistence"
    mitre_technique = "T1205.002"
    reference       = "https://attack.mitre.org/techniques/T1205/002/"
    severity        = "HIGH"
    priority        = "HIGH"
    version         = "1.0"
    created         = "2026-04-19"

  events:
    $p.metadata.event_type = "PROCESS_LAUNCH"
    (
      $p.target.process.file.full_path = /^\/tmp\// or
      $p.target.process.file.full_path = /^\/dev\/shm\// or
      $p.target.process.file.full_path = /^\/var\/tmp\// or
      $p.target.process.file.full_path = /^\/run\/shm\//
    )
    // Exclude known-legitimate parent processes that routinely write to temp paths
    not re.regex($p.principal.process.file.full_path,
      `/(bash|dash|sh|zsh|ksh|apt|apt-get|dpkg|yum|dnf|rpm|pip3?|make|gcc|cc|g\+\+|cargo|go)$`)
    not re.regex($p.target.process.file.full_path, `\.py$`)
    not re.regex($p.target.process.file.full_path, `\.sh$`)

  condition:
    $p
}