[Bug] Tampering of Bash Command-Line History

[rubinatorz]

Describe the bug
The "Tampering of Bash Command-Line History" rule has logic to detect the use of commands: export, set, unset and history. These specific commands are bash shell builtins, which doesn't start a process, while the rule checks for process start/process_started events. Those builtin commands are also not logged by the Elastic agent. When performing tests for this rule, and executing those specific commands with their matchting arguments doesn't trigger alerts for this rule (other commands covered by the rule do trigger alerts).

To Reproduce
Steps to reproduce the behavior:

1. Execute one of the commands export, set, unset, history with the matchting arguments covered in the rule. Like: set +o history
2. Check events and alerts being logged.
3. No event is logged and no alert is triggered.

Expected behavior
As far as I know Elastic doesn't log bash shell builtin commands. And as those builtin command doesn't start a process, no alerts are triggered. So I wonder why the rule tries to detect these commands. Is there a way to make Elastic trigger on those builtin commands? The only way I could think of is using bash -c "command". But that's not obvious and not covering adversary behaviour using it directly in bash.

Desktop (please complete the following information):

• OS: Linux
• Version: any

[Aegrah]

Hi @rubinatorz, we are aware of this; and you are right, when using shell built-ins, no telemetry is generated. We do see this rule triggering often, though, as malware will commonly use the executables on the box, rather than shell built-ins. For example, the shell builtin echo will not trigger an exec and is therefore not logged, while /bin/echo is a process on its own, which will trigger.

The same goes for other shell built-ins. We are tracking this, but I do not have any specifics related to when we can expect to close this gap.

[rubinatorz]

hi @Aegrah

Thanks for your quick reply! For the echo command there is indeed a binary on disk, but for these ones: history, set, unset and export, these are only available as builtin and not as binary.

$ where echo
echo: shell built-in command
/usr/bin/echo
/bin/echo

$where export
export: shell reserved word
export: shell built-in command

$where history
history: shell built-in command

$where set
set: shell built-in command

$where unset
unset: shell built-in command

Good to hear that you are aware of this. Very curious about the developments on this topic.

Thanks!