<commit_before>#############
# Definitions
#############

# File actions
- macro: write
  condition: (syscall.type=write and fd.type in (file, directory))
- macro: read
  condition: (syscall.type=read and evt.dir=> and fd.type in (file, directory))
- macro: rename
  condition: syscall.type = rename
- macro: mkdir
  condition: syscall.type = mkdir
- macro: remove
  condition: syscall.type in (remove, rmdir, unlink, unlink_at)

- macro: modify
  condition: rename or mkdir or remove


# File categories
- macro: terminal_file_fd
  condition: fd.name=/dev/ptmx or fd.directory=/dev/pts
- macro: bin_dir
  condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)

- macro: bin_dir_mkdir
  condition: evt.arg[0] contains /bin or evt.arg[0] contains /sbin or evt.arg[0] contains /usr/bin or evt.arg[0] contains /usr/sbin
- macro: bin_dir_rename
  condition: evt.arg[1] contains /bin or evt.arg[1] contains /sbin or evt.arg[1] contains /usr/bin or evt.arg[1] contains /usr/sbin

- macro: etc_dir
  condition: fd.directory contains /etc

- macro: ubuntu_so_dirs
  condition: fd.directory contains /lib/x86_64-linux-gnu or fd.directory contains /usr/lib/x86_64-linux-gnu or fd.directory contains /usr/lib/sudo
- macro: centos_so_dirs
  condition: fd.directory contains /lib64 or fd.directory contains /user/lib64 or fd.directory contains /usr/libexec

- macro: coreutils_binaries
  condition: >
    proc.name in (truncate, sha1sum, numfmt, fmt, fold, uniq, cut, who,
    groups, csplit, sort, expand, printf, printenv, unlink, tee, chcon, stat,
    basename, split, nice, yes, whoami, sha224sum, hostid, users, stdbuf,
    base64, unexpand, cksum, od, paste, nproc, pathchk, sha256sum, wc, test,
    comm, arch, du, factor, sha512sum, md5sum, tr, runcon, env, dirname,
    tsort, join, shuf, install, logname, pinky, nohup, expr, pr, tty, timeout,
    tail, [, seq, sha384sum, nl, head, id, mkfifo, sum, dircolors, ptx, shred,
    tac, link, chroot, vdir, chown, touch, ls, dd, uname, true, pwd, date,
    chgrp, chmod, mktemp, cat, mknod, sync, ln, false, rm, mv, cp, echo,
    readlink, sleep, stty, mkdir, df, dir, rmdir, touch)
- macro: adduser_binaries
  condition: proc.name in (adduser, deluser, addgroup, delgroup)
- macro: login_binaries
  condition: proc.name in (bin, login, su, sbin, nologin, bin, faillog, lastlog, newgrp, sg)

# dpkg -L passwd | grep bin | xargs -L 1 basename | tr "\\n" ","
- macro: passwd_binaries
  condition: >
    proc.name in (sbin, shadowconfig, sbin, grpck, pwunconv, grpconv, pwck,
    groupmod, vipw, pwconv, useradd, newusers, cppw, chpasswd, usermod,
    groupadd, groupdel, grpunconv, chgpasswd, userdel, bin, chage, chsh,
    gpasswd, chfn, expiry, passwd, vigr, cpgr)

# repoquery -l shadow-utils | grep bin | xargs -L 1 basename | tr "\\n" ","
- macro: shadowutils_binaries
  condition: >
    proc.name in (chage, gpasswd, lastlog, newgrp, sg, adduser, chpasswd,
    groupadd, groupdel, groupmems, groupmod, grpck, grpconv, grpunconv,
    newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod, vigr, vipw)

- macro: system_binaries
  condition: coreutils_binaries or adduser_binaries or login_binaries or passwd_binaries or shadowutils_binaries

- macro: sensitive_files
  condition: fd.name contains /etc/passwd or fd.name = /etc/sudoers or fd.directory = /etc/sudoers.d or fd.directory = /etc/pam.d or fd.name = /etc/pam.conf


# Network
- macro: inbound
  condition: (syscall.type=listen and evt.dir=>) or (syscall.type=accept and evt.dir=<)
- macro: outbound
  condition: ((syscall.type=connect and evt.dir=<) or (syscall.type=sendto and evt.dir=>)) and (fd.typechar=4 or fd.typechar=6)

- macro: ssh_port
  condition: fd.lport=22

# Ssh
- macro: ssh_error_message
  condition: evt.arg.data contains "Invalid user" or evt.arg.data contains "preauth"

# System
- macro: modules
  condition: syscall.type in (delete_module, init_module)
- macro: container
  condition: container.id != host
- macro: interactive
  condition: (proc.aname=sshd and proc.name != sshd) or proc.name=systemd-logind
- macro: syslog
  condition: fd.name = /dev/log
- macro: not_cron
  condition: proc.name != cron

# System users that should never log into a system. Consider adding your own
# service users (e.g. 'apache' or 'mysqld') here.
- macro: system_users
  condition: user.name in (bin, daemon, games, lp, mail, nobody, sshd, sync, uucp, www-data)


#######
# Rules
#######

# Don't write to binary dirs
- condition: evt.dir = > and write and bin_dir
  output: "Write to bin dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Don't write to /etc
- condition: evt.dir = > and write and etc_dir
  output: "Write to etc dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Don't read 'sensitive' files
- condition: read and not proc.name in (sshd, sudo, su) and not_cron and sensitive_files
  output: "Read sensitive file (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Don't modify binary dirs
- condition: modify and (bin_dir_rename or bin_dir_mkdir)
  output: "Modify bin dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Don't load shared objects coming from unexpected places
- condition: read and fd.name contains .so and not (ubuntu_so_dirs or centos_so_dirs)
  output: "Loaded .so from unexpected dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Attempts to access things that shouldn't be
- condition: evt.res = EACCES
  output: "System call returned EACCESS (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: INFO<commit_msg>Modify existing rules to not use ignored syscalls.<commit_after>#############
# Definitions
#############

# File actions


# Currently disabled as read/write are ignored syscalls. The nearly
# similar open_write/open_read check for files being opened for
# reading/writing.
# - macro: write
#   condition: (syscall.type=write and fd.type in (file, directory))
# - macro: read
#   condition: (syscall.type=read and evt.dir=> and fd.type in (file, directory))

- macro: open_write
  condition: >
    (evt.type=open or evt.type=openat) and
    fd.typechar='f' and
    (evt.arg.flags contains O_WRONLY or
    evt.arg.flags contains O_RDWR or
    evt.arg.flags contains O_CREAT or
    evt.arg.flags contains O_TRUNC)
- macro: open_read
  condition: >
    (evt.type=open or evt.type=openat) and
    fd.typechar='f' and
    (evt.arg.flags contains O_RDONLY or
    evt.arg.flags contains O_RDWR)

- macro: rename
  condition: syscall.type = rename
- macro: mkdir
  condition: syscall.type = mkdir
- macro: remove
  condition: syscall.type in (remove, rmdir, unlink, unlink_at)

- macro: modify
  condition: rename or mkdir or remove


# File categories
- macro: terminal_file_fd
  condition: fd.name=/dev/ptmx or fd.directory=/dev/pts
- macro: bin_dir
  condition: fd.directory in (/bin, /sbin, /usr/bin, /usr/sbin)

- macro: bin_dir_mkdir
  condition: evt.arg[0] contains /bin or evt.arg[0] contains /sbin or evt.arg[0] contains /usr/bin or evt.arg[0] contains /usr/sbin
- macro: bin_dir_rename
  condition: evt.arg[1] contains /bin or evt.arg[1] contains /sbin or evt.arg[1] contains /usr/bin or evt.arg[1] contains /usr/sbin

- macro: etc_dir
  condition: fd.directory contains /etc

- macro: ubuntu_so_dirs
  condition: fd.directory contains /lib/x86_64-linux-gnu or fd.directory contains /usr/lib/x86_64-linux-gnu or fd.directory contains /usr/lib/sudo
- macro: centos_so_dirs
  condition: fd.directory contains /lib64 or fd.directory contains /user/lib64 or fd.directory contains /usr/libexec

- macro: coreutils_binaries
  condition: >
    proc.name in (truncate, sha1sum, numfmt, fmt, fold, uniq, cut, who,
    groups, csplit, sort, expand, printf, printenv, unlink, tee, chcon, stat,
    basename, split, nice, yes, whoami, sha224sum, hostid, users, stdbuf,
    base64, unexpand, cksum, od, paste, nproc, pathchk, sha256sum, wc, test,
    comm, arch, du, factor, sha512sum, md5sum, tr, runcon, env, dirname,
    tsort, join, shuf, install, logname, pinky, nohup, expr, pr, tty, timeout,
    tail, [, seq, sha384sum, nl, head, id, mkfifo, sum, dircolors, ptx, shred,
    tac, link, chroot, vdir, chown, touch, ls, dd, uname, true, pwd, date,
    chgrp, chmod, mktemp, cat, mknod, sync, ln, false, rm, mv, cp, echo,
    readlink, sleep, stty, mkdir, df, dir, rmdir, touch)
- macro: adduser_binaries
  condition: proc.name in (adduser, deluser, addgroup, delgroup)
- macro: login_binaries
  condition: proc.name in (bin, login, su, sbin, nologin, bin, faillog, lastlog, newgrp, sg)

# dpkg -L passwd | grep bin | xargs -L 1 basename | tr "\\n" ","
- macro: passwd_binaries
  condition: >
    proc.name in (sbin, shadowconfig, sbin, grpck, pwunconv, grpconv, pwck,
    groupmod, vipw, pwconv, useradd, newusers, cppw, chpasswd, usermod,
    groupadd, groupdel, grpunconv, chgpasswd, userdel, bin, chage, chsh,
    gpasswd, chfn, expiry, passwd, vigr, cpgr)

# repoquery -l shadow-utils | grep bin | xargs -L 1 basename | tr "\\n" ","
- macro: shadowutils_binaries
  condition: >
    proc.name in (chage, gpasswd, lastlog, newgrp, sg, adduser, chpasswd,
    groupadd, groupdel, groupmems, groupmod, grpck, grpconv, grpunconv,
    newusers, pwck, pwconv, pwunconv, useradd, userdel, usermod, vigr, vipw)

- macro: system_binaries
  condition: coreutils_binaries or adduser_binaries or login_binaries or passwd_binaries or shadowutils_binaries

- macro: sensitive_files
  condition: fd.name contains /etc/passwd or fd.name = /etc/sudoers or fd.directory = /etc/sudoers.d or fd.directory = /etc/pam.d or fd.name = /etc/pam.conf


# Network
- macro: inbound
  condition: (syscall.type=listen and evt.dir=>) or (syscall.type=accept and evt.dir=<)

# Currently sendto is an ignored syscall, otherwise this could also check for (syscall.type=sendto and evt.dir=>)
- macro: outbound
  condition: syscall.type=connect and evt.dir=< and (fd.typechar=4 or fd.typechar=6)

- macro: ssh_port
  condition: fd.lport=22

# Ssh
- macro: ssh_error_message
  condition: evt.arg.data contains "Invalid user" or evt.arg.data contains "preauth"

# System
- macro: modules
  condition: syscall.type in (delete_module, init_module)
- macro: container
  condition: container.id != host
- macro: interactive
  condition: (proc.aname=sshd and proc.name != sshd) or proc.name=systemd-logind
- macro: syslog
  condition: fd.name = /dev/log
- macro: not_cron
  condition: proc.name != cron

# System users that should never log into a system. Consider adding your own
# service users (e.g. 'apache' or 'mysqld') here.
- macro: system_users
  condition: user.name in (bin, daemon, games, lp, mail, nobody, sshd, sync, uucp, www-data)


#######
# Rules
#######

# Don't write to binary dirs
- condition: evt.dir = > and open_write and bin_dir
  output: "Write to bin dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Don't write to /etc
- condition: evt.dir = > and open_write and etc_dir
  output: "Write to etc dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Don't read 'sensitive' files
- condition: open_read and not proc.name in (sshd, sudo, su) and not_cron and sensitive_files
  output: "Read sensitive file (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Don't modify binary dirs
- condition: modify and (bin_dir_rename or bin_dir_mkdir)
  output: "Modify bin dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Don't load shared objects coming from unexpected places
- condition: open_read and fd.name contains .so and not (ubuntu_so_dirs or centos_so_dirs)
  output: "Loaded .so from unexpected dir (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: WARNING

# Attempts to access things that shouldn't be
- condition: evt.res = EACCES
  output: "System call returned EACCESS (%user.name %proc.name %evt.dir %evt.type %evt.args %fd.name)"
  priority: INFO
{'fraction_non_alphanumeric': 0.1253615403685646, 'fraction_numerical': 0.006941575076439964, 'mean_word_length': 4.059364548494983, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 21, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '318155', 'n_tokens_mistral': 4408, 'n_tokens_neox': 4325, 'n_words': 1365}