root
435 lines
17 KiB
Bash
Executable File
435 lines
17 KiB
Bash
Executable File
#!/bin/bash
|
|
###############################################################################
|
|
# detect.sh — cold-disk malware detection and family-classification scanner
|
|
#
|
|
# Read-only. Scans a mounted container rootfs (OpenVZ 7 / Incus / extracted
|
|
# tarball) and classifies findings by known family. Runs YARA
|
|
# (/srv/perfctl.yar), chkrootkit, rkhunter, debsums, and static-IoC checks.
|
|
#
|
|
# Usage:
|
|
# ROOTFS=/vz/root/101 ./detect.sh
|
|
# ROOTFS=/var/lib/incus/storage-pools/default/containers/c1/rootfs ./detect.sh
|
|
#
|
|
# Opt-in extras (slow):
|
|
# RUN_CLAMAV=1 ROOTFS=... ./detect.sh
|
|
# RUN_RKHUNTER=0 ROOTFS=... ./detect.sh # skip rkhunter
|
|
#
|
|
# Exit codes:
|
|
# 0 = no evidence of known malware families
|
|
# 1 = suspicious (review recommended)
|
|
# 2 = confirmed infection (see verdict)
|
|
###############################################################################
|
|
set -uo pipefail
|
|
|
|
if [ -z "${ROOTFS:-}" ]; then
|
|
echo "ERROR: ROOTFS is not set." >&2
|
|
echo "Usage: ROOTFS=/path/to/mounted/rootfs $0" >&2
|
|
exit 2
|
|
fi
|
|
if [ ! -d "$ROOTFS" ]; then
|
|
echo "ERROR: ROOTFS='$ROOTFS' is not a directory" >&2
|
|
exit 2
|
|
fi
|
|
|
|
R="$ROOTFS"
|
|
YARA_RULES="${YARA_RULES:-/srv/perfctl.yar}"
|
|
LOG="/var/log/malware-detect-${ROOTFS//\//_}-$(date +%Y%m%d-%H%M%S).log"
|
|
|
|
# opt-in / opt-out scanner controls
|
|
RUN_YARA="${RUN_YARA:-1}"
|
|
RUN_CHKROOTKIT="${RUN_CHKROOTKIT:-1}"
|
|
RUN_RKHUNTER="${RUN_RKHUNTER:-1}"
|
|
RUN_DEBSUMS="${RUN_DEBSUMS:-1}"
|
|
RUN_CLAMAV="${RUN_CLAMAV:-0}"
|
|
|
|
FAMILIES="perfctl xmrig proxyjacking ldpreload_rootkit lkm_rootkit ssh_backdoor generic_compromise"
|
|
declare -A FAMILY_SCORE
|
|
declare -A FAMILY_EVIDENCE
|
|
for f in $FAMILIES; do
|
|
FAMILY_SCORE[$f]=0
|
|
FAMILY_EVIDENCE[$f]=""
|
|
done
|
|
|
|
# ---------- helpers ---------------------------------------------------------
|
|
|
|
log() { echo "[$(date '+%H:%M:%S')] $*" | tee -a "$LOG"; }
|
|
warn() { echo "[$(date '+%H:%M:%S')] WARN: $*" | tee -a "$LOG"; }
|
|
ok() { echo "[$(date '+%H:%M:%S')] OK: $*" | tee -a "$LOG"; }
|
|
hit() { echo "[$(date '+%H:%M:%S')] HIT: $*" | tee -a "$LOG"; }
|
|
|
|
evidence() {
|
|
local family="$1" weight="$2" detail="$3"
|
|
FAMILY_SCORE[$family]=$((FAMILY_SCORE[$family] + weight))
|
|
FAMILY_EVIDENCE[$family]="${FAMILY_EVIDENCE[$family]} [+${weight}] ${detail}"$'\n'
|
|
hit "[$family +$weight] $detail"
|
|
}
|
|
|
|
need() { command -v "$1" >/dev/null 2>&1; }
|
|
|
|
# ---------- preflight -------------------------------------------------------
|
|
|
|
log "=========================================="
|
|
log "malware detect (cold-disk) started"
|
|
log "ROOTFS: $R"
|
|
log "Log: $LOG"
|
|
log "YARA rules: $YARA_RULES"
|
|
log "=========================================="
|
|
|
|
# ---------- PHASE 1 — static IoC file presence ------------------------------
|
|
|
|
log ""
|
|
log "=== PHASE 1: Static IoC file presence ==="
|
|
|
|
for f in \
|
|
"$R/etc/ld.so.preload" \
|
|
"$R/lib/libgcwrap.so" "$R/usr/lib/libgcwrap.so" \
|
|
"$R/lib/libfsnldev.so" "$R/usr/lib/libfsnldev.so" \
|
|
"$R/lib/libfsnkdev.so" "$R/usr/lib/libfsnkdev.so" \
|
|
"$R/lib/libpprocps.so" "$R/usr/lib/libpprocps.so" \
|
|
"$R/dev/shm/libfsnldev.so" \
|
|
"$R/bin/perfcc" "$R/usr/bin/perfcc" \
|
|
"$R/bin/wizlmsh" "$R/usr/bin/wizlmsh" \
|
|
"$R/bin/kkbush" "$R/usr/bin/kkbush" \
|
|
"$R/tmp/.apid" "$R/tmp/gd.sh" "$R/tmp/ccrl" \
|
|
"$R/tmp/kubeupd" "$R/tmp/javax64" "$R/tmp/wttwe" "$R/tmp/smpr" \
|
|
"$R/root/.config/cron/perfcc" \
|
|
; do
|
|
if [ -e "$f" ] || [ -L "$f" ]; then
|
|
evidence perfctl 10 "file present: $f"
|
|
fi
|
|
done
|
|
|
|
for d in "$R/tmp/.xdiag" "$R/tmp/.perf.c" "$R/tmp/.dmesg" \
|
|
"$R/bin/wbin" "$R/bin/.local" "$R/bin/.atmp" \
|
|
"$R/root/.config/cron" "$R/root/.config/traffmonetizer" \
|
|
"$R/var/-nonrpk" "$R/var/.r.rpk"; do
|
|
if [ -d "$d" ]; then
|
|
case "$d" in
|
|
*/traffmonetizer) evidence proxyjacking 8 "dir present: $d" ;;
|
|
*/-nonrpk|*/.r.rpk) evidence proxyjacking 8 "dir present: $d" ;;
|
|
*) evidence perfctl 8 "dir present: $d" ;;
|
|
esac
|
|
fi
|
|
done
|
|
|
|
if [ -f "$R/etc/ld.so.preload" ] && [ -s "$R/etc/ld.so.preload" ]; then
|
|
preload_content=$(cat "$R/etc/ld.so.preload" 2>/dev/null)
|
|
log " ld.so.preload content: $preload_content"
|
|
if echo "$preload_content" | grep -qE 'libgcwrap|libfsnldev|libfsnkdev|libpprocps'; then
|
|
evidence perfctl 15 "ld.so.preload points at known perfctl rootkit"
|
|
elif echo "$preload_content" | grep -qE '^/(tmp|dev/shm|var/tmp|home|opt)/'; then
|
|
evidence ldpreload_rootkit 10 "ld.so.preload points at non-system path: $preload_content"
|
|
fi
|
|
fi
|
|
|
|
ok "static IoC scan done"
|
|
|
|
# ---------- PHASE 2 — YARA scan ---------------------------------------------
|
|
|
|
log ""
|
|
log "=== PHASE 2: YARA scan ==="
|
|
|
|
if [ "$RUN_YARA" = "1" ] && need yara && [ -f "$YARA_RULES" ]; then
|
|
YARA_EXCLUDE="${YARA_EXCLUDE:-\.claude/|\.cache/|\.mozilla/|var/log/|var/backups/|/root/forensics|/share/rkhunter|/share/chkrootkit|/share/clamav}"
|
|
YARA_OUT=$(mktemp)
|
|
YARA_RAW=$(mktemp)
|
|
for p in etc bin sbin usr/bin usr/sbin lib usr/lib lib64 \
|
|
tmp var/tmp dev/shm opt root home var/spool/cron; do
|
|
target="$R/$p"
|
|
[ -e "$target" ] || continue
|
|
timeout 120 yara -r -w -N "$YARA_RULES" "$target" 2>/dev/null >> "$YARA_RAW" || true
|
|
done
|
|
grep -vE "$YARA_EXCLUDE" "$YARA_RAW" > "$YARA_OUT" 2>/dev/null || true
|
|
rm -f "$YARA_RAW"
|
|
|
|
YARA_HITS=$(grep -E '^[A-Za-z_][A-Za-z0-9_]*[[:space:]]+/' "$YARA_OUT" || true)
|
|
|
|
if [ -n "$YARA_HITS" ]; then
|
|
log " yara hits:"
|
|
echo "$YARA_HITS" | tee -a "$LOG"
|
|
log ""
|
|
while IFS= read -r line; do
|
|
rule=$(echo "$line" | awk '{print $1}')
|
|
file=$(echo "$line" | cut -d' ' -f2-)
|
|
case "$rule" in
|
|
perfctl_known_hashes|perfctl_libgcwrap_rootkit|perfctl_perfcc_installer|perfctl_wizlmsh_suid_backdoor)
|
|
evidence perfctl 20 "yara $rule on $file" ;;
|
|
perfctl_known_filenames|perfctl_dropper_paths_in_any_file|perfctl_cron_persistence|perfctl_network_indicators)
|
|
evidence perfctl 12 "yara $rule on $file" ;;
|
|
XMRIG_Monero_Miner|PUA_LNX_XMRIG_CryptoMiner|XMRIG_Monero_Miner_Config)
|
|
evidence xmrig 15 "yara $rule on $file" ;;
|
|
SUSP_XMRIG_String|CoinMiner_Strings|PUA_CryptoMiner_cpuminer|PUA_Crypto_Mining_CommandLine_Indicators|linux_miner_pool_urls)
|
|
evidence xmrig 8 "yara $rule on $file" ;;
|
|
linux_proxyjacking_agents|linux_proxyjacking_container_images)
|
|
evidence proxyjacking 10 "yara $rule on $file" ;;
|
|
linux_ldpreload_rootkit_generic|linux_ldpreload_config_file)
|
|
evidence ldpreload_rootkit 12 "yara $rule on $file" ;;
|
|
linux_ssh_backdoor_authorized_keys_in_binary|linux_pam_credential_stealer)
|
|
evidence ssh_backdoor 12 "yara $rule on $file" ;;
|
|
linux_lkm_rootkit_known_names)
|
|
evidence lkm_rootkit 15 "yara $rule on $file" ;;
|
|
*)
|
|
evidence generic_compromise 5 "yara $rule on $file" ;;
|
|
esac
|
|
done <<< "$YARA_HITS"
|
|
else
|
|
ok "no yara hits"
|
|
fi
|
|
rm -f "$YARA_OUT"
|
|
else
|
|
log " skipped (yara not installed, disabled, or rules file missing)"
|
|
fi
|
|
|
|
# ---------- PHASE 3 — chkrootkit (cold-disk with -r) ------------------------
|
|
|
|
if [ "$RUN_CHKROOTKIT" = "1" ]; then
|
|
log ""
|
|
log "=== PHASE 3: chkrootkit ==="
|
|
if need chkrootkit; then
|
|
CHK_OUT=$(mktemp)
|
|
timeout 300 chkrootkit -r "$R" > "$CHK_OUT" 2>&1 || true
|
|
# match only real hits — "INFECTED" is chkrootkit's positive-finding keyword.
|
|
# Skip descriptive "Searching for suspicious..." progress lines.
|
|
INFECTED=$(grep -E '\bINFECTED\b' "$CHK_OUT" 2>/dev/null | head -40 || true)
|
|
if [ -n "$INFECTED" ]; then
|
|
warn "chkrootkit findings:"
|
|
echo "$INFECTED" | tee -a "$LOG"
|
|
hits=$(echo "$INFECTED" | wc -l)
|
|
if echo "$INFECTED" | grep -qiE 'suckit|adore|kbeast|suterusu|diamorphine|reptile|lrk'; then
|
|
evidence lkm_rootkit 25 "chkrootkit named rootkit"
|
|
fi
|
|
evidence generic_compromise "$((hits > 10 ? 10 : hits))" "chkrootkit: $hits INFECTED lines"
|
|
else
|
|
ok "chkrootkit: no findings"
|
|
fi
|
|
rm -f "$CHK_OUT"
|
|
else
|
|
log " chkrootkit not installed on host — skipping (apt install chkrootkit)"
|
|
fi
|
|
fi
|
|
|
|
# ---------- PHASE 4 — rkhunter (cold-disk with --rootdir) -------------------
|
|
|
|
if [ "$RUN_RKHUNTER" = "1" ]; then
|
|
log ""
|
|
log "=== PHASE 4: rkhunter ==="
|
|
if need rkhunter; then
|
|
RK_OUT=$(mktemp)
|
|
timeout 600 rkhunter --rootdir "$R" --check --sk --nocolors > "$RK_OUT" 2>&1 || true
|
|
# Score only rkhunter lines that BOTH name a rootkit AND carry a
|
|
# positive-finding status ([ Warning ]/[ Found ]/[ Suspect ]/[ Infected ]).
|
|
# rkhunter emits "Diamorphine LKM [ Not found ]" on every run — matching
|
|
# the name alone would false-positive against that progress output.
|
|
RK_NAMED=$(grep -iE '(suckit|adore|kbeast|suterusu|diamorphine|reptile|xzres|maliroot).*\[ *(Warning|Found|Suspect|Infected) *\]' "$RK_OUT" 2>/dev/null | head -10 || true)
|
|
if [ -n "$RK_NAMED" ]; then
|
|
warn "rkhunter named a rootkit with positive status:"
|
|
echo "$RK_NAMED" | tee -a "$LOG"
|
|
evidence lkm_rootkit 25 "rkhunter named rootkit"
|
|
fi
|
|
# Log warning count for analyst context but do not score
|
|
RK_WARN_COUNT=$(grep -cE '\[ *Warning *\]' "$RK_OUT" 2>/dev/null || echo 0)
|
|
log " rkhunter: $RK_WARN_COUNT warning lines (not scored — review $RK_OUT-style output manually)"
|
|
if [ "$RK_WARN_COUNT" -gt 0 ]; then
|
|
grep -E '\[ *Warning *\]' "$RK_OUT" 2>/dev/null | head -20 | tee -a "$LOG" > /dev/null
|
|
fi
|
|
rm -f "$RK_OUT"
|
|
else
|
|
log " rkhunter not installed on host — skipping (apt install rkhunter)"
|
|
fi
|
|
fi
|
|
|
|
# ---------- PHASE 5 — debsums (cold-disk with --root) -----------------------
|
|
|
|
if [ "$RUN_DEBSUMS" = "1" ]; then
|
|
log ""
|
|
log "=== PHASE 5: debsums ==="
|
|
if need debsums; then
|
|
DS_OUT=$(mktemp)
|
|
timeout 300 debsums --root="$R" -c > "$DS_OUT" 2>&1 || true
|
|
if [ -s "$DS_OUT" ]; then
|
|
warn "debsums package-integrity mismatches (trojanized binaries likely):"
|
|
head -30 "$DS_OUT" | tee -a "$LOG"
|
|
hits=$(wc -l < "$DS_OUT")
|
|
if grep -qE '/(top|ldd|lsof|crontab|htop|ps|strace)$' "$DS_OUT"; then
|
|
evidence perfctl 15 "debsums: classic userland tools trojanized (top/ldd/lsof/ps)"
|
|
fi
|
|
evidence generic_compromise "$((hits > 10 ? 10 : hits))" "debsums: $hits package-file mismatches"
|
|
else
|
|
ok "debsums: all package files match"
|
|
fi
|
|
rm -f "$DS_OUT"
|
|
else
|
|
log " debsums not installed on host — skipping (apt install debsums)"
|
|
fi
|
|
fi
|
|
|
|
# ---------- PHASE 6 — persistence string-sweep ------------------------------
|
|
|
|
log ""
|
|
log "=== PHASE 6: Persistence string-sweep ==="
|
|
|
|
SUSP_PATTERN='perfcc\|perfctl\|libgcwrap\|libfsnldev\|libfsnkdev\|libpprocps\|kubeupd\|kkbush\|wizlmsh\|AAZHDE\|FPROF\|A2ZNODE\|ABWTRX\|\.xdiag\|\.perf\.c'
|
|
|
|
for tgt in \
|
|
"$R/root/.bashrc" "$R/root/.bash_profile" "$R/root/.profile" \
|
|
"$R/etc/profile" "$R/etc/bash.bashrc" \
|
|
"$R/etc/rc.local" "$R/etc/crontab" \
|
|
"$R/var/spool/cron/crontabs/root" \
|
|
; do
|
|
[ -f "$tgt" ] || continue
|
|
if grep -qE "$SUSP_PATTERN" "$tgt" 2>/dev/null; then
|
|
evidence perfctl 12 "IoC string in ${tgt#$R}"
|
|
fi
|
|
done
|
|
|
|
for crond in "$R/etc/cron.d" "$R/etc/cron.hourly" "$R/etc/cron.daily" \
|
|
"$R/etc/cron.weekly" "$R/etc/cron.monthly" \
|
|
"$R/etc/systemd/system" "$R/usr/lib/systemd/system" "$R/lib/systemd/system"; do
|
|
[ -d "$crond" ] || continue
|
|
HITS=$(grep -rlE "$SUSP_PATTERN" "$crond" 2>/dev/null | head -10 || true)
|
|
if [ -n "$HITS" ]; then
|
|
while IFS= read -r h; do
|
|
evidence perfctl 10 "IoC string in ${h#$R}"
|
|
done <<< "$HITS"
|
|
fi
|
|
done
|
|
|
|
# hidden SSH keys in system accounts
|
|
if [ -f "$R/etc/passwd" ]; then
|
|
for u in news bin daemon sys lp mail games uucp proxy www-data backup list irc gnats nobody systemd-network; do
|
|
home=$(awk -F: -v u="$u" '$1==u{print $6}' "$R/etc/passwd" 2>/dev/null)
|
|
[ -n "$home" ] && [ -f "$R$home/.ssh/authorized_keys" ] && {
|
|
keys=$(grep -cE '^(ssh-|ecdsa-)' "$R$home/.ssh/authorized_keys" 2>/dev/null || echo 0)
|
|
evidence ssh_backdoor 15 "system account $u has $keys authorized_keys entries"
|
|
}
|
|
done
|
|
fi
|
|
|
|
# trailing-space nologin backdoor
|
|
if [ -f "$R/etc/shells" ]; then
|
|
if grep -qE '^/usr/sbin/nologin +$|^/sbin/nologin +$' "$R/etc/shells" 2>/dev/null; then
|
|
evidence ssh_backdoor 18 "trailing-space nologin backdoor in /etc/shells"
|
|
fi
|
|
fi
|
|
|
|
ok "persistence sweep done"
|
|
|
|
# ---------- PHASE 7 — ClamAV (opt-in, slow) ---------------------------------
|
|
|
|
if [ "$RUN_CLAMAV" = "1" ]; then
|
|
log ""
|
|
log "=== PHASE 7: ClamAV ==="
|
|
if need clamscan; then
|
|
CAV_OUT=$(mktemp)
|
|
timeout 1800 clamscan -ri "$R" \
|
|
--exclude-dir='^'"$R"'/(proc|sys|dev)' \
|
|
> "$CAV_OUT" 2>&1 || true
|
|
INFECTED=$(grep 'FOUND$' "$CAV_OUT" 2>/dev/null | head -40 || true)
|
|
if [ -n "$INFECTED" ]; then
|
|
warn "ClamAV FOUND:"
|
|
echo "$INFECTED" | tee -a "$LOG"
|
|
hits=$(echo "$INFECTED" | wc -l)
|
|
if echo "$INFECTED" | grep -qiE 'xmrig|coinminer|cryptominer'; then
|
|
evidence xmrig 10 "ClamAV miner signature"
|
|
fi
|
|
if echo "$INFECTED" | grep -qiE 'rootkit|backdoor'; then
|
|
evidence generic_compromise 10 "ClamAV rootkit/backdoor signature"
|
|
fi
|
|
evidence generic_compromise "$((hits > 10 ? 10 : hits))" "ClamAV $hits detections"
|
|
else
|
|
ok "ClamAV: no detections"
|
|
fi
|
|
rm -f "$CAV_OUT"
|
|
else
|
|
log " clamscan not installed on host — skipping (apt install clamav)"
|
|
fi
|
|
fi
|
|
|
|
# ---------- VERDICT ---------------------------------------------------------
|
|
|
|
log ""
|
|
log "=========================================="
|
|
log "SCORECARD"
|
|
log "=========================================="
|
|
|
|
TOTAL=0
|
|
BEST_FAMILY=""
|
|
BEST_SCORE=0
|
|
for f in $FAMILIES; do
|
|
s=${FAMILY_SCORE[$f]}
|
|
printf " %-22s %d\n" "$f" "$s" | tee -a "$LOG"
|
|
TOTAL=$((TOTAL + s))
|
|
if [ "$s" -gt "$BEST_SCORE" ]; then
|
|
BEST_SCORE=$s
|
|
BEST_FAMILY=$f
|
|
fi
|
|
done
|
|
|
|
log ""
|
|
log "=========================================="
|
|
log "VERDICT"
|
|
log "=========================================="
|
|
|
|
if [ "$TOTAL" -eq 0 ]; then
|
|
log "NO EVIDENCE OF KNOWN MALWARE FAMILIES DETECTED."
|
|
log " This does NOT prove the rootfs is clean — bespoke/novel malware"
|
|
log " will not match these signatures."
|
|
exit 0
|
|
elif [ "$BEST_SCORE" -ge 30 ]; then
|
|
log "CONFIRMED INFECTION — primary family: $BEST_FAMILY (score=$BEST_SCORE)"
|
|
log ""
|
|
log "Top family evidence:"
|
|
echo -n "${FAMILY_EVIDENCE[$BEST_FAMILY]}" | tee -a "$LOG"
|
|
log ""
|
|
log "Secondary families with non-zero score:"
|
|
for f in $FAMILIES; do
|
|
[ "$f" = "$BEST_FAMILY" ] && continue
|
|
s=${FAMILY_SCORE[$f]}
|
|
[ "$s" -eq 0 ] && continue
|
|
log " $f ($s):"
|
|
echo -n "${FAMILY_EVIDENCE[$f]}" | tee -a "$LOG"
|
|
done
|
|
log ""
|
|
case "$BEST_FAMILY" in
|
|
perfctl)
|
|
log "RECOMMENDED ACTION:"
|
|
log " - run: ROOTFS=$R /srv/clean.sh"
|
|
log " - rotate ALL credentials for the workload in this container"
|
|
log " - review forensic samples after clean.sh"
|
|
;;
|
|
xmrig)
|
|
log "RECOMMENDED ACTION:"
|
|
log " - run: ROOTFS=$R /srv/clean.sh (covers dropper paths + persistence)"
|
|
log " - check for associated rootkit (miners rarely run alone)"
|
|
;;
|
|
proxyjacking)
|
|
log "RECOMMENDED ACTION:"
|
|
log " - run: ROOTFS=$R /srv/clean.sh (removes known proxyjacking dirs)"
|
|
log " - audit /etc/systemd/system and cron for the persistence vector"
|
|
;;
|
|
ldpreload_rootkit|lkm_rootkit)
|
|
log "RECOMMENDED ACTION:"
|
|
log " - run: ROOTFS=$R /srv/clean.sh"
|
|
log " - inspect /root/forensics-* for samples; submit to VirusTotal"
|
|
;;
|
|
ssh_backdoor)
|
|
log "RECOMMENDED ACTION:"
|
|
log " - inspect /etc/shells, system-account .ssh/ dirs"
|
|
log " - rotate keys; audit recent SSH logins from retained journal"
|
|
;;
|
|
esac
|
|
exit 2
|
|
else
|
|
log "SUSPICIOUS — low-confidence signals (score=$TOTAL, top=$BEST_FAMILY @$BEST_SCORE)"
|
|
log ""
|
|
for f in $FAMILIES; do
|
|
s=${FAMILY_SCORE[$f]}
|
|
[ "$s" -eq 0 ] && continue
|
|
log " $f ($s):"
|
|
echo -n "${FAMILY_EVIDENCE[$f]}" | tee -a "$LOG"
|
|
done
|
|
log ""
|
|
log "Recommend manual review of flagged items and/or running with RUN_CLAMAV=1"
|
|
exit 1
|
|
fi
|