leviathan/SKELETONKEY
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

detection rules: complete sigma/yara/falco coverage across the corpus

Browse Source 
Three parallel research agents drafted 49 detection rules grounded in
each module's source + existing .opsec_notes string + existing .detect_auditd
counterpart. A one-shot tools/inject_rules.py wrote them into the
right files and replaced the .detect_<format> = NULL placeholders.

Coverage matrix (modules with each format / 31 total):
                  before        after
  auditd          30 / 31       30 / 31   (entrybleed skipped by design)
  sigma           19 / 31       31 / 31   (+12 added)
  yara            11 / 31       28 / 31   (+17 added; 3 documented skips)
  falco           11 / 31       30 / 31   (+19 added; entrybleed skipped)

Documented skips (kept as .detect_<format> = NULL with comment):
  - entrybleed: yara + falco + auditd. Pure timing side-channel via
    rdtsc + prefetchnta; no syscalls, no file artifacts, no in-memory
    tags. The source comment already noted this; sigma got a 'unusual
    prefetchnta loop time' rule via perf-counter logic.
  - ptrace_traceme: yara. Pure in-memory race; no on-disk artifacts
    or persistent strings to match. Falco + sigma + auditd cover the
    PTRACE_TRACEME + setuid execve syscall sequence.
  - sudo_samedit: yara. Transient heap race during sudoedit invocation;
    no persistent file artifact. Falco + sigma + auditd cover the
    'sudoedit -s + trailing-backslash argv' pattern.

Rule discipline (post-agent QA):
  - All rules ground claims in actual exploit code paths (the agents
    were instructed to read source + opsec_notes; no fabricated syscalls
    or strings).
  - Two falco rules were narrowed by the agent to fire only when
    proc.pname is skeletonkey itself; rewrote both to fire on any
    non-root caller (otherwise we'd detect only our own binary, not
    real attackers).
  - Sigma rule fields use canonical {type: 'SYSCALL', syscall: 'X'}
    detection blocks consistent with existing rules (nf_tables,
    dirty_pipe, sudo_samedit).
  - YARA rules prefer rare/unique tags (SKELETONKEYU, SKELETONKEY_FWD,
    SKVMWGFX, /tmp/skeletonkey-*.log) over common bytes — minimizes
    false positives.
  - Every rule tagged with attack.privilege_escalation + cve.YYYY.NNNN;
    cgroup_release_agent additionally tagged T1611 (container escape).

skeletonkey.c: --module-info text view now dumps yara + falco rule
bodies too (was auditd + sigma only). All 4 formats visible per module.

Verification:
  - macOS local: clean build, 33 kernel_range tests pass.
  - Linux (docker gcc:latest): 33 + 54 = 87 passes, 0 fails.
  - --module-info nf_tables / af_unix_gc / etc.: 'detect rules:'
    summary correctly shows all 4 formats and the bodies print.
This commit is contained in:
KaraZajac
2026-05-23 11:10:54 -04:00
parent ee3e7dd9a7
commit 8ab49f36f6
21 changed files with 837 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/af_packet_cve_2017_7308/skeletonkey_modules.c
+52 -3
View File
@@ -891,6 +891,55 @@ static const char af_packet_auditd[] =
"-a always,exit -F arch=b64 -S socket -F a0=17 -k skeletonkey-af-packet\n"
"-a always,exit -F arch=b64 -S unshare -k skeletonkey-af-packet-userns\n";
static const char af_packet_sigma[] =
"title: Possible CVE-2017-7308 AF_PACKET TPACKET_V3 exploitation\n"
"id: a72b5e91-skeletonkey-af-packet\n"
"status: experimental\n"
"description: |\n"
" Detects the AF_PACKET TPACKET_V3 integer-overflow setup pattern:\n"
" unshare(CLONE_NEWUSER|CLONE_NEWNET) followed by socket(AF_PACKET)\n"
" and a PACKET_RX_RING setsockopt + sendmmsg burst. False positives:\n"
" network sandboxes / containers running raw-packet apps inside\n"
" userns; correlate process tree to distinguish.\n"
"logsource: {product: linux, service: auditd}\n"
"detection:\n"
" userns: {type: 'SYSCALL', syscall: 'unshare'}\n"
" afp: {type: 'SYSCALL', syscall: 'socket', a0: 17}\n"
" send_burst:{type: 'SYSCALL', syscall: 'sendmmsg'}\n"
" condition: userns and afp and send_burst\n"
"level: high\n"
"tags: [attack.privilege_escalation, attack.t1068, cve.2017.7308]\n";
static const char af_packet_yara[] =
"rule af_packet_cve_2017_7308 : cve_2017_7308 heap_spray\n"
"{\n"
" meta:\n"
" cve = \"CVE-2017-7308\"\n"
" description = \"AF_PACKET TPACKET_V3 spray tag from skeletonkey/iam-root tooling\"\n"
" author = \"SKELETONKEY\"\n"
" strings:\n"
" $tag1 = \"iamroot-afp-tag\" ascii\n"
" $tag2 = \"skeletonkey-afp-fc-\" ascii\n"
" condition:\n"
" any of them\n"
"}\n";
static const char af_packet_falco[] =
"- rule: AF_PACKET TPACKET_V3 setup by non-root in userns\n"
" desc: |\n"
" A non-root process creates an AF_PACKET socket and sets up a\n"
" TPACKET_V3 ring inside a user namespace. CVE-2017-7308 trigger\n"
" requires CAP_NET_RAW which userns provides. False positives:\n"
" legitimate packet-capture tools running rootless (rare).\n"
" condition: >\n"
" evt.type = setsockopt and evt.arg.optname contains PACKET_RX_RING\n"
" and not user.uid = 0\n"
" output: >\n"
" AF_PACKET TPACKET_V3 ring setup by non-root\n"
" (user=%user.name proc=%proc.name pid=%proc.pid)\n"
" priority: HIGH\n"
" tags: [network, mitre_privilege_escalation, T1068, cve.2017.7308]\n";
const struct skeletonkey_module af_packet_module = {
.name = "af_packet",
.cve = "CVE-2017-7308",
@@ -902,9 +951,9 @@ const struct skeletonkey_module af_packet_module = {
.mitigate = NULL,
.cleanup = NULL,
.detect_auditd = af_packet_auditd,
.detect_sigma = NULL,
.detect_yara = NULL,
.detect_falco = NULL,
.detect_sigma = af_packet_sigma,
.detect_yara = af_packet_yara,
.detect_falco = af_packet_falco,
.opsec_notes = "Creates AF_PACKET socket and TPACKET_V3 ring inside unshare(CLONE_NEWUSER|CLONE_NEWNET); triggers integer overflow with crafted tp_block_size/tp_block_nr and sprays ~200 loopback frames. Audit-visible via socket(AF_PACKET) (a0=17) + sendmmsg from a userns process; KASAN tag 'iamroot-afp-tag' may appear in dmesg if enabled. No persistent files. No cleanup callback - kernel state unwinds on child exit.",
};