Expand Process data model to include environment variables
ForensicITGuy opened this issue · comments
Proposed Change
The proposed change is to extend the Process data model to include environment variables set for a process at the time of execution. This could be included as a field in the Process model.
Justification
The justification is to monitor for process injection via LD_PRELOAD environment variables. A sample analytic for this would be:
SELECT process_envs.pid as source_process_id, process_envs.key as environment_variable_key, process_envs.value as environment_variable_value, processes.name as source_process, processes.path as file_path, processes.cmdline as source_process_commandline, processes.cwd as current_working_directory, 'T1055' as event_attack_id, 'Process Injection' as event_attack_technique, 'Defense Evasion, Privilege Escalation' as event_attack_tactic FROM process_envs join processes USING (pid) WHERE key = 'LD_PRELOAD';
@ForensicITGuy do you have any example events that contain environment variables? Also, looks like this is only captured by a few sensors at the moment, such as OSquery, is that right?
Hey @ikiril01, sorry I should've responded sooner. OSquery is the only sensor I know of so far that will retrieve environment variable information (maybe also Velociraptor). In this case I don't think it's even continuously monitoring (unlike the eventing tables), but is query-based only. The only use case I have for environment vars so far would be hunting for process injection via LD_PRELOAD.
https://cybersecurity.att.com/blogs/labs-research/hunting-for-linux-library-injection-with-osquery
@ForensicITGuy no worries! Thanks for the clarification. One other question we've had about capturing environment variables is with regards to inheritance - i.e., since a child process can inherit env vars from its parent, is this something we need to explicitly identify or not? Although this might be a bit of a moot point, since CAR's current process object doesn't cleanly distinguish between parent/child processes.
From the continuous monitoring/detection perspective, I don't think it matters as much. If we're doing live forensics it might matter, but dead box forensics won't have as much use.
I will say that a parent/child relationship would be useful in a larger model outside of just environment variables to enable suspicious process relationships (winword.exe > PowerShell) for example.
Added via 0b1ca90