UTMSTACK logoUTMSTACK logo
Linux RHEL Family

Detection rules for RHEL Family data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 10 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Container Platform Security AttacksPrivilege EscalationT1611 - Escape to HostC:3 / I:3 / A:2
Critical SELinux Policy ViolationPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:3 / I:3 / A:2
OpenShift Security ViolationsCredential AccessT1552.007 - Unsecured Credentials: Container APIC:3 / I:3 / A:2
RHEL Boot Loader Attack DetectionDefense Evasion, PersistenceT1542.003 - Pre-OS Boot: BootkitC:2 / I:3 / A:2
RHEL Secure Boot Violation DetectionDefense EvasionT1553.006 - Subvert Trust Controls: Code Signing Policy ModificationC:2 / I:3 / A:2
RHEL-Specific Kernel Exploitation AttemptPrivilege EscalationExploitation for Privilege EscalationC:3 / I:3 / A:3
RHEL-Specific Malware DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
RPM Database Tampering DetectionDefense EvasionT1070 - Indicator RemovalC:2 / I:3 / A:2
SystemD Unit File Attack DetectedPersistence, Privilege EscalationT1543.002 - Create or Modify System Process: Systemd ServiceC:2 / I:3 / A:2
YUM/DNF Repository Manipulation AttackInitial AccessT1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development ToolsC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Container Platform Security Attacks (view in repository):

# Rule version v1.0.0

dataTypes:
  - linux
name: Container Platform Security Attacks
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Privilege Escalation
technique: "T1611 - Escape to Host"
adversary: origin
references:
  - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/building_running_and_managing_containers/index
  - https://attack.mitre.org/techniques/T1611/
description: |
  Detects attacks against container platforms including Docker, Podman, and CRI-O such as container escape attempts, privilege escalation, unauthorized image pulls, and runtime manipulation. This rule identifies suspicious container activities that may indicate an adversary attempting to break out of container isolation or manipulate container runtime environments.

  Next Steps:
  1. Investigate the affected container and host system for signs of compromise
  2. Review container logs and runtime configurations for unauthorized changes
  3. Check for unusual process execution or file system modifications
  4. Verify container image integrity and scan for malicious content
  5. Review security policies for containers (seccomp, AppArmor, SELinux)
  6. Consider isolating the affected container and host system
  7. Update container security policies and runtime configurations as needed
where: |
  (oneOf("origin.process", ["docker", "podman", "crio", "containerd"]) ||
   oneOf("origin.process", ["dockerd", "podman", "crio", "containerd"]) ||
   oneOf("log.service", ["docker", "podman", "crio", "containerd"]) ||
   oneOf("log.process_name", ["dockerd", "podman", "crio", "containerd"])) &&
  (
    contains("log.message", "container escape") ||
    contains("log.message", "privilege escalation") ||
    contains("log.message", "unauthorized pull") ||
    contains("log.message", "runtime manipulation") ||
    contains("log.message", "seccomp violation") ||
    contains("log.message", "AppArmor violation") ||
    contains("log.message", "SELinux denial") ||
    (equals("action", "exec") && contains("log.command", "/proc/self/exe")) ||
    (equals("action", "mount") && contains("log.path", "/sys")) ||
    equals("log.event_type", "container_breakout") ||
    (oneOf("log.syscall", ["mount", "pivot_root", "chroot"]) && equals("log.result", "denied"))
  )
groupBy:
  - lastEvent.log.container_id
  - origin.host

Rule Details

Container Platform Security Attacks

Detects attacks against container platforms including Docker, Podman, and CRI-O such as container escape attempts, privilege escalation, unauthorized image pulls, and runtime manipulation. This rule identifies suspicious container activities that may indicate an adversary attempting to break out of container isolation or manipulate container runtime environments.

Critical SELinux Policy Violation

Detects critical SELinux policy violations that may indicate privilege escalation attempts, unauthorized access, or malicious activity bypassing mandatory access controls. This rule identifies AVC denials for sensitive capabilities, attempts to access shadow files, modifications to critical system directories, unconfined processes accessing executables, and unauthorized SELinux management commands.

OpenShift Security Violations

Detects security violations in OpenShift Container Platform including unauthorized API access, RBAC violations, security context constraint breaches, and malicious pod deployments. These violations indicate potential security breaches or misconfigurations that could lead to unauthorized access or privilege escalation within the cluster.

RHEL Boot Loader Attack Detection

Detects attempts to modify or tamper with the boot loader configuration, including unauthorized changes to GRUB files, boot parameters, or kernel modules that could indicate bootkit installation attempts.

RHEL Secure Boot Violation Detection

Detects violations of UEFI Secure Boot policy including unsigned kernel modules, tampering with MOK (Machine Owner Key) database, attempts to disable Secure Boot, or loading of unauthorized boot components. This indicates potential compromise of the boot chain integrity or attempts to bypass security controls.

RHEL-Specific Kernel Exploitation Attempt

Detects potential exploitation attempts targeting RHEL-specific kernel vulnerabilities, including memory corruption, privilege escalation through kernel bugs, or attempts to bypass kernel security mechanisms like SELinux or kernel module protections.

RHEL-Specific Malware Detection

Detects indicators of malware specifically targeting RHEL systems including known rootkits, suspicious kernel modules, process injection attempts, and malicious RPM packages or scripts exploiting RHEL-specific vulnerabilities.

RPM Database Tampering Detection

Detects potential tampering with the RPM database which could indicate an attacker attempting to hide malicious package installations or system modifications. This includes unauthorized access to RPM database files, non-privileged users attempting to rebuild the database, or corruption indicators in RPM logs.

SystemD Unit File Attack Detected

Detects malicious SystemD unit file creation or modification attempts, including privilege escalation through invalid usernames, suspicious service directives, or attempts to create persistent backdoors through systemd generators or malicious service configurations.

YUM/DNF Repository Manipulation Attack

Detects potential attacks on YUM/DNF repositories including unauthorized repository additions, GPG key modifications, or suspicious package installations that could indicate supply chain compromise. This rule identifies attempts to manipulate package management systems to install malicious software or bypass security controls.

**