LoFP / administrator may disable swapping of devices in a linux host. filter is needed.

Techniques

• T1200

Sample rules

Linux Hardware Addition SwapOff

• source: splunk
• technicques:
  • T1200

Description

The following analytic detects the execution of the “swapoff” command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms.

Detection logic

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
  WHERE Processes.process_name = "swapoff"
  BY Processes.action Processes.dest Processes.original_file_name
     Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
     Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
     Processes.process Processes.process_exec Processes.process_guid
     Processes.process_hash Processes.process_id Processes.process_integrity_level
     Processes.process_name Processes.process_path Processes.user
     Processes.user_id Processes.vendor_product

| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `linux_hardware_addition_swapoff_filter`

Linux Auditd Hardware Addition Swapoff

• source: splunk
• technicques:
  • T1200

Description

The following analytic detects the execution of the “swapoff” command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms.

Detection logic

`linux_auditd` proctitle = "*swapoff*" AND proctitle = "*-a*"
  
| rename host as dest
  
| stats count min(_time) as firstTime max(_time) as lastTime
    BY proctitle dest
  
| `security_content_ctime(firstTime)`
  
| `security_content_ctime(lastTime)`
  
| `linux_auditd_hardware_addition_swapoff_filter`