LoFP LoFP / custom configuration-management that decrypts cms blobs with an organization key outside /var/lib/waagent. confirm the key path and exclude the specific command line after review.

Techniques

Sample rules

Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation

Description

Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not the Azure Linux Agent certificate under /var/lib/waagent. Adversaries can scrape WireServer certificates, mint a LinuxTransport identity, and decrypt extension protectedSettings with openssl cms -decrypt or smime -decrypt.

Detection logic

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start") and process.name == "openssl" and
(
  (
    process.args in ("cms", "smime") and process.args == "-decrypt"
  ) or
  (
    process.args == "req" and process.args : "*LinuxTransport*"
  )
) and
not process.args like "/var/lib/waagent/*" and
not process.parent.executable like (
  "/usr/sbin/waagent",
  "/usr/bin/waagent"
)