leviathan/SKELETONKEY
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

detection rules: complete sigma/yara/falco coverage across the corpus

Browse Source 
Three parallel research agents drafted 49 detection rules grounded in
each module's source + existing .opsec_notes string + existing .detect_auditd
counterpart. A one-shot tools/inject_rules.py wrote them into the
right files and replaced the .detect_<format> = NULL placeholders.

Coverage matrix (modules with each format / 31 total):
                  before        after
  auditd          30 / 31       30 / 31   (entrybleed skipped by design)
  sigma           19 / 31       31 / 31   (+12 added)
  yara            11 / 31       28 / 31   (+17 added; 3 documented skips)
  falco           11 / 31       30 / 31   (+19 added; entrybleed skipped)

Documented skips (kept as .detect_<format> = NULL with comment):
  - entrybleed: yara + falco + auditd. Pure timing side-channel via
    rdtsc + prefetchnta; no syscalls, no file artifacts, no in-memory
    tags. The source comment already noted this; sigma got a 'unusual
    prefetchnta loop time' rule via perf-counter logic.
  - ptrace_traceme: yara. Pure in-memory race; no on-disk artifacts
    or persistent strings to match. Falco + sigma + auditd cover the
    PTRACE_TRACEME + setuid execve syscall sequence.
  - sudo_samedit: yara. Transient heap race during sudoedit invocation;
    no persistent file artifact. Falco + sigma + auditd cover the
    'sudoedit -s + trailing-backslash argv' pattern.

Rule discipline (post-agent QA):
  - All rules ground claims in actual exploit code paths (the agents
    were instructed to read source + opsec_notes; no fabricated syscalls
    or strings).
  - Two falco rules were narrowed by the agent to fire only when
    proc.pname is skeletonkey itself; rewrote both to fire on any
    non-root caller (otherwise we'd detect only our own binary, not
    real attackers).
  - Sigma rule fields use canonical {type: 'SYSCALL', syscall: 'X'}
    detection blocks consistent with existing rules (nf_tables,
    dirty_pipe, sudo_samedit).
  - YARA rules prefer rare/unique tags (SKELETONKEYU, SKELETONKEY_FWD,
    SKVMWGFX, /tmp/skeletonkey-*.log) over common bytes — minimizes
    false positives.
  - Every rule tagged with attack.privilege_escalation + cve.YYYY.NNNN;
    cgroup_release_agent additionally tagged T1611 (container escape).

skeletonkey.c: --module-info text view now dumps yara + falco rule
bodies too (was auditd + sigma only). All 4 formats visible per module.

Verification:
  - macOS local: clean build, 33 kernel_range tests pass.
  - Linux (docker gcc:latest): 33 + 54 = 87 passes, 0 fails.
  - --module-info nf_tables / af_unix_gc / etc.: 'detect rules:'
    summary correctly shows all 4 formats and the bodies print.
This commit is contained in:
KaraZajac
2026-05-23 11:10:54 -04:00
parent ee3e7dd9a7
commit 8ab49f36f6
21 changed files with 837 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/af_unix_gc_cve_2023_4622/skeletonkey_modules.c
+53 -3
View File
@@ -833,6 +833,56 @@ static const char af_unix_gc_auditd[] =
"-a always,exit -F arch=b64 -S sendmsg -k skeletonkey-afunixgc-sendmsg\n"
"-a always,exit -F arch=b64 -S msgsnd -k skeletonkey-afunixgc-spray\n";
static const char af_unix_gc_sigma[] =
"title: Possible CVE-2023-4622 AF_UNIX GC UAF race\n"
"id: c45d7eb3-skeletonkey-af-unix-gc\n"
"status: experimental\n"
"description: |\n"
" Detects tight-loop socketpair(AF_UNIX) + sendmsg with SCM_RIGHTS\n"
" + msgsnd grooming pattern characteristic of the AF_UNIX garbage\n"
" collector race. False positives: legitimate IPC apps use\n"
" SCM_RIGHTS, but the high-frequency close-and-recreate cycle is\n"
" unusual outside fuzzing / exploit harnesses.\n"
"logsource: {product: linux, service: auditd}\n"
"detection:\n"
" sp: {type: 'SYSCALL', syscall: 'socketpair', a0: 1}\n"
" scm: {type: 'SYSCALL', syscall: 'sendmsg'}\n"
" groom: {type: 'SYSCALL', syscall: 'msgsnd'}\n"
" condition: sp and scm and groom\n"
"level: high\n"
"tags: [attack.privilege_escalation, attack.t1068, cve.2023.4622]\n";
static const char af_unix_gc_yara[] =
"rule af_unix_gc_cve_2023_4622 : cve_2023_4622 kernel_uaf\n"
"{\n"
" meta:\n"
" cve = \"CVE-2023-4622\"\n"
" description = \"AF_UNIX GC race kmalloc-512 spray tag or log breadcrumb\"\n"
" author = \"SKELETONKEY\"\n"
" strings:\n"
" $tag = \"SKELETONKEYU\" ascii\n"
" $log = \"/tmp/skeletonkey-af_unix_gc.log\" ascii\n"
" condition:\n"
" any of them\n"
"}\n";
static const char af_unix_gc_falco[] =
"- rule: SCM_RIGHTS cycling on AF_UNIX with msg_msg groom\n"
" desc: |\n"
" Tight socketpair(AF_UNIX) + sendmsg(SCM_RIGHTS) + msgsnd\n"
" pattern characteristic of the AF_UNIX garbage collector\n"
" race (CVE-2023-4622). False positives: IPC libraries use\n"
" SCM_RIGHTS legitimately but rarely with the close-and-\n"
" recreate cycle at this frequency.\n"
" condition: >\n"
" evt.type = sendmsg and fd.sockfamily = AF_UNIX and\n"
" not user.uid = 0\n"
" output: >\n"
" SCM_RIGHTS sendmsg on AF_UNIX by non-root\n"
" (user=%user.name pid=%proc.pid)\n"
" priority: HIGH\n"
" tags: [ipc, mitre_privilege_escalation, T1068, cve.2023.4622]\n";
const struct skeletonkey_module af_unix_gc_module = {
.name = "af_unix_gc",
.cve = "CVE-2023-4622",
@@ -844,9 +894,9 @@ const struct skeletonkey_module af_unix_gc_module = {
.mitigate = NULL,
.cleanup = af_unix_gc_cleanup,
.detect_auditd = af_unix_gc_auditd,
.detect_sigma = NULL,
.detect_yara = NULL,
.detect_falco = NULL,
.detect_sigma = af_unix_gc_sigma,
.detect_yara = af_unix_gc_yara,
.detect_falco = af_unix_gc_falco,
.opsec_notes = "Two-threaded race: Thread A creates socketpair(AF_UNIX) with SCM_RIGHTS cycle then close; Thread B drives independent SCM_RIGHTS traffic on a held pair. ~5s budget (30s with --full-chain). msg_msg kmalloc-512 spray tagged 'SKELETONKEYU'. Writes /tmp/skeletonkey-af_unix_gc.log with empirical stats. Audit-visible via socketpair(AF_UNIX) + sendmsg(SCM_RIGHTS) + msgsnd triple. Dmesg may show UAF KASAN if kernel vulnerable. Cleanup callback unlinks the log.",
};