Auditbeat use and Problems

[robrankin]

Auditbeat combines the raw audit events into a single event, and in particular events of type=PATH are problematic because:

• There is no structured field that contains the value "PATH"
• Field names (not values) of "path" are created, and do not match the case of the audit event.

The value of PATH is recorded in the ECS field event.original, however this field is not enabled by default, so many, perhaps most, auditbeat installations will not be recording this field.

To include the event.original field you need to configure auditbeat using include_raw_message=true for the audit module.

Assuming event.original is enabled, we then need to use a wildcard search of the event.original field, so all rules need to be modified to use a contains value modifier. This is probably not the right way of doing this, as it would impact all other rule users.

The only way I've managed to get these rules into a usable state with Auditbeat is as follows below.

This seems quite suboptimal, so am wondering if there are better approaches or not?

I've suggested one potential improvement at the end of this post, "Value Modifiers field in config file".

Auditbeat Config

Set:
include_raw_message = true

Rule Changes

Change all type=PATH rules to be:

detection:
    selection:
        type|contains: 'PATH'

Sigmac Configuration File requirements

Set a default field of event.original and then conditionally set specific fields for the SYSCALL and EXECVE types.

fieldmappings:
    type:
      default:
        - event.original
      type=SYSCALL:
        - auditd.message_type
      type=syscall:
        - auditd.message_type
      type=EXECVE:
        - auditd.data.syscall
      type=execve:
        - auditd.data.syscall

Conversion

sigmac -t elastalert \
-c auditbeat-ecs.yml \
--backend-option keyword_field="" rules/linux/auditd/lnx_auditd_alter_bash_profile.yml

Elastalert Rule

Functional ElastAlert rule

alert:
- debug
description: Detects change of user environment. Adversaries can insert code into these files to gain persistence each time a user logs in or opens a new shell.
filter:
- query:
    query_string:
      query: (event.module:auditd AND event.original:*PATH* AND auditd.paths.name:(\/home\/*\/.bashrc OR \/home\/*\/.bash_profile OR \/home\/*\/.profile OR \/etc\/profile OR \/etc\/shells OR \/etc\/bashrc OR \/etc\/csh.cshrc OR \/etc\/csh.login))
index: auditbeat-*
name: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9-Edit-of-.bash_profile-and-.bashrc
priority: 3
realert:
  minutes: 0
type: any

Possible Sigma Improvements

Value Modifiers field in config file

Allow the use of value modifiers in config files. Given the example above, using conditional field mappings, where the value of the field is known, but may not be available in a well parsed structure, allowing a value modifier could be quite useful.

fieldmappings:
    type:
      default:
        - event.original|contains

References

Example Auditbeat events, speifically with type=PATH

https://github.com/elastic/beats/blob/master/auditbeat/module/auditd/testdata/chown.log-expected.json

[nasbench]

This should be resolved by pySigma processing pipelines https://github.com/SigmaHQ/pySigma