2

All, I have been googling around for different guides on what files to monitor that people would edit for malicious intent. In my readings so far, i have found the common files people edit. so far i have found:

  1. /etc/hosts
  2. ufw config files
  3. iptables config files
  4. /bin/login

what other files do you guys monitor actively and why?

Thanks in advance! -tsnm

5
  • 1
    Just edit, or also modify? Binaries are commonly overwritten as a means of a backdoor and persistent access.
    – schroeder
    Commented Jun 10, 2013 at 17:42
  • modifying the contents would be the better term. overwriting a file would set off another alert i have created to match MD5 on binaries. Commented Jun 10, 2013 at 17:54
  • MD5 hash data should include file size as MD5 is vulnerablt to length extension attacks (en.wikipedia.org/wiki/Length_extension_attack)
    – this.josh
    Commented Jun 11, 2013 at 7:17
  • @this.josh: Or, you know, he could just use a better hash function.
    – thejh
    Commented Jun 11, 2013 at 9:21
  • i gather md5 and sha1 for each file on the system on clean install and then after the initial configuration that we freeze just so we can have an audit trail. my main concern is narrowing down what files i should monitor from everything to critical files. Commented Jun 11, 2013 at 13:42

1 Answer 1

5

Your best bet is to install a HIPS (Host Intrusion Prevention Application) such as Samhain or AIDE. There are far too many files to monitor and an attacker can (and usually will) try to modify whatever they can. Not to mention there are plenty of people who play/tinker with Linux/BSD/OSX viruses, exploits, and proofs of concepts

EDITED FOR AN EXPLANATION AS TO WHAT TO MONITOR AND WHY

Every system differs, one can follow guidelines, baselines, but at the end of the day, the importance of what to monitor as at the discretion of the systems administrator, the data custodian, and a range of other people, or just one person. On any system I have been an administrator on, it is my function to maintain that system. I prefer to know as much as I can about the entire system.

When I install Host Based Intrusion Prevention, I choose to monitor everything EXCEPT log files. Logfiles change, therefore they'd generate many false positives. As an attacker/pentester, I am aware that many professionals who've followed best practices and guidelines, tend to focus on what they perceive (based on risk) as important. This will usually (and mostly ONLY) include directories where binaries are installed. Under Linux/BSD/Solaris:

/bin/
/sbin/
/usr/sbin/
/usr/bin/
/usr/local/bin/
/usr/local/sbin/
/opt/bin/
/opt/sbin/
/etc/

These are not the only places to store files, to hide programs, etc. For example, knowing these are the "usual suspects" being monitored, I have no time as an attacker shoving something into /usr/lib, /usr/share, /tmp, and so forth. These files are not going to be detected because no application is watching what is occurring.

The time and space to monitor these files/directories is minimal. I would rather be safe than sorry. There may be false positives initially, but this is where you can ween out what are legitimate alerts, and what aren't, building from there.

5
  • thank you. We have one of these HiPS systems installed right now. but we have a small amount of managed systems that i want to add custom monitoring too. Commented Jun 10, 2013 at 19:52
  • Then have a look at AlienVault. It might fit your needs communities.alienvault.com/download.html
    – munkeyoto
    Commented Jun 10, 2013 at 20:34
  • thanks munkeyoto. I have that installed already as well :) this question is strictly about files that we would not want to be altered after the initial configuration. I can monitor them with a snare file monitor and send logs to alienvault, but that doesnt help me narrow down what files i should monitor. Commented Jun 11, 2013 at 13:40
  • The answer to that question is: "Its better to be safe than sorry." I would monitor all, outside of log files (which change often). The space required to do so is minimal. I referenced the proof of concept to give you a sense as to WHY you wanted to monitor everything. The fact that something is on a system renders it important, why chance it.
    – munkeyoto
    Commented Jun 11, 2013 at 14:22
  • Wonderful writeup! thank you very much for taking the time to elaborate on why you are looking at certain files. Commented Jun 11, 2013 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .