Auditd y Falco para Detección de Malware en Linux

La telemetría que Linux no genera por defecto

TL;DR: Auditd y Falco son herramientas esenciales que suplen la falta de telemetría de seguridad nativa en sistemas Linux. A diferencia de Windows que usa Sysmon, un Linux básico no registra ejecuciones de comandos por defecto, haciendo necesario el uso de reglas de auditoría de syscalls. Se recomienda implementar configuraciones específicas de persistencia y ejecución para garantizar una detección efectiva de malware.

A diferencia de Windows (donde Sysmon y Event Log proporcionan telemetría rica por defecto), Linux genera logs mínimos de seguridad sin configuración adicional. Un Linux vanilla solo registra logins en auth.log y mensajes del kernel en syslog. No registra qué comandos se ejecutaron, qué archivos se modificaron, ni qué conexiones de red se establecieron.

Auditd y Falco llenan ese vacío. Auditd es la solución nativa del kernel. Falco es la solución moderna basada en eBPF. Ambos son esenciales para detectar malware en servidores Linux.

Auditd: el framework de auditoría del kernel

Arquitectura

Kernel (syscalls) → kauditd → auditd (daemon) → audit.log
                                    ↓
                              audisp (dispatcher)
                                    ↓
                         ┌──────────┼──────────┐
                         │          │          │
                    syslog     SIEM plugin   custom

Configuración: /etc/audit/audit.rules

Las reglas de auditd se configuran en /etc/audit/rules.d/ o /etc/audit/audit.rules. Formato:

-a [action,filter] -S [syscall] -F [field=value] -k [key_name]
-w [path] -p [permissions] -k [key_name]

Reglas esenciales para detección de malware

# === EJECUCION DE COMANDOS ===
# Monitorizar execve (toda ejecucion de programas)
-a always,exit -F arch=b64 -S execve -k exec_cmd

# === PERSISTENCIA ===
# Crontab modifications
-w /var/spool/cron/ -p wa -k cron_modify
-w /etc/crontab -p wa -k cron_modify
-w /etc/cron.d/ -p wa -k cron_modify

# Systemd service files
-w /etc/systemd/system/ -p wa -k systemd_persist
-w /usr/lib/systemd/system/ -p wa -k systemd_persist

# SSH authorized_keys
-w /root/.ssh/authorized_keys -p wa -k ssh_keys
-w /home/ -p wa -k user_files

# Init scripts
-w /etc/rc.local -p wa -k init_persist
-w /etc/init.d/ -p wa -k init_persist

# LD_PRELOAD
-w /etc/ld.so.preload -p wa -k ld_preload
-w /etc/ld.so.conf -p wa -k ld_config

# === CREDENCIALES ===
# Password files
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/sudoers -p wa -k sudoers_modify

# === KERNEL MODULES ===
-a always,exit -F arch=b64 -S init_module -S finit_module -k module_load
-a always,exit -F arch=b64 -S delete_module -k module_unload
-w /sbin/insmod -p x -k module_tools
-w /sbin/modprobe -p x -k module_tools

# === RED ===
# Conexiones de red
-a always,exit -F arch=b64 -S connect -k network_connect
-a always,exit -F arch=b64 -S socket -F a0=2 -F a1=3 -k raw_socket

# === eBPF ===
-a always,exit -F arch=b64 -S bpf -k ebpf_activity

# === ARCHIVOS SENSIBLES ===
-w /etc/hosts -p wa -k hosts_modify
-w /etc/resolv.conf -p wa -k dns_modify

# === PROCESOS ===
-a always,exit -F arch=b64 -S ptrace -k ptrace_activity
-a always,exit -F arch=b64 -S process_vm_readv -k process_memory_read

Lectura de logs auditd

# Ver eventos recientes
ausearch -ts recent

# Buscar por key
ausearch -k cron_modify
ausearch -k ssh_keys
ausearch -k module_load

# Buscar por tipo de evento
ausearch -m EXECVE          # Ejecuciones de comandos
ausearch -m SYSCALL -sc connect   # Conexiones de red

# Formato legible
aureport -x --summary       # Resumen de ejecuciones
aureport -f --summary       # Resumen de accesos a archivos
aureport --login --summary  # Resumen de logins

Falco: runtime security con eBPF

Arquitectura

Kernel (syscalls) → eBPF probes → Falco engine → Rules evaluation → Alerts
                                                         ↓
                                                  ┌──────┼──────┐
                                                  │      │      │
                                               stdout  syslog  webhook
                                                              (Slack, PagerDuty)

Instalación

# Debian/Ubuntu
curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] https://download.falco.org/packages/deb stable main" | sudo tee /etc/apt/sources.list.d/falcosecurity.list
sudo apt update && sudo apt install falco

# Kubernetes (Helm)
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco

Reglas Falco para detección de malware

# === SHELL EN CONTENEDOR ===
- rule: Terminal Shell in Container
  desc: A shell was spawned in a container with an attached terminal
  condition: >
    spawned_process and container and proc.tty != 0 and
    proc.name in (bash, sh, zsh, dash, ksh)
  output: >
    Shell with terminal in container
    (user=%user.name container=%container.name image=%container.image.repository
     shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty)
  priority: NOTICE

# === CRYPTOMINER ===
- rule: Detect Cryptocurrency Miner
  desc: Detects execution of known cryptocurrency mining software
  condition: >
    spawned_process and
    (proc.name in (xmrig, minerd, cpuminer, ccminer, cgminer) or
     proc.cmdline contains "stratum+tcp" or
     proc.cmdline contains "stratum+ssl" or
     proc.cmdline contains "pool.minexmr" or
     proc.cmdline contains "moneroocean" or
     proc.cmdline contains "randomx")
  output: >
    Cryptocurrency miner detected
    (user=%user.name command=%proc.cmdline container=%container.name)
  priority: CRITICAL

# === REVERSE SHELL ===
- rule: Reverse Shell Detected
  desc: Detects reverse shell patterns
  condition: >
    spawned_process and
    ((proc.name = bash and proc.cmdline contains "/dev/tcp") or
     (proc.name = python and proc.cmdline contains "socket" and proc.cmdline contains "connect") or
     (proc.name = perl and proc.cmdline contains "socket") or
     (proc.name = nc and proc.cmdline contains "-e") or
     (proc.name = ncat and proc.cmdline contains "--exec"))
  output: >
    Reverse shell detected (user=%user.name command=%proc.cmdline
    container=%container.name)
  priority: CRITICAL

# === PERSISTENCIA ===
- rule: Crontab Modified
  desc: Crontab file was modified
  condition: >
    open_write and
    (fd.name startswith /var/spool/cron or
     fd.name startswith /etc/cron or
     fd.name = /etc/crontab)
  output: >
    Crontab modified (user=%user.name file=%fd.name command=%proc.cmdline)
  priority: WARNING

- rule: SSH Authorized Keys Modified
  desc: SSH authorized_keys file was modified
  condition: >
    open_write and fd.name endswith authorized_keys
  output: >
    SSH authorized_keys modified (user=%user.name file=%fd.name
    command=%proc.cmdline)
  priority: HIGH

# === ROOTKIT ===
- rule: Kernel Module Loaded
  desc: A kernel module was loaded
  condition: >
    spawned_process and
    (proc.name in (insmod, modprobe) or
     evt.type in (init_module, finit_module))
  output: >
    Kernel module loaded (user=%user.name command=%proc.cmdline)
  priority: HIGH

# === CREDENTIAL ACCESS ===
- rule: Sensitive File Read
  desc: A sensitive file was read by a non-standard process
  condition: >
    open_read and
    fd.name in (/etc/shadow, /etc/gshadow) and
    not proc.name in (login, su, sudo, sshd, passwd, chpasswd, useradd, groupadd)
  output: >
    Sensitive file read (user=%user.name file=%fd.name process=%proc.name
    command=%proc.cmdline)
  priority: HIGH

# === DOWNLOAD AND EXECUTE ===
- rule: Download and Execute Pattern
  desc: File downloaded and made executable
  condition: >
    spawned_process and
    proc.name in (curl, wget) and
    (proc.cmdline contains "/tmp/" or
     proc.cmdline contains "/dev/shm/" or
     proc.cmdline contains "/var/tmp/")
  output: >
    Download to temp directory (user=%user.name command=%proc.cmdline
    container=%container.name)
  priority: HIGH

# === PRIVILEGE ESCALATION ===
- rule: Setuid Binary Execution
  desc: A setuid binary was executed
  condition: >
    spawned_process and proc.is_exe_upper_layer and
    user.uid != 0 and proc.pname != sudo
  output: >
    Setuid binary execution (user=%user.name command=%proc.cmdline)
  priority: NOTICE

Integración con SIEM

Auditd con Wazuh

Wazuh parsea logs de auditd nativamente:

<!-- /var/ossec/etc/ossec.conf -->
<localfile>
  <log_format>audit</log_format>
  <location>/var/log/audit/audit.log</location>
</localfile>

Falco con Elastic

# falco.yaml: output a syslog
syslog_output:
  enabled: true

# O output a HTTP (para Logstash/Elastic)
http_output:
  enabled: true
  url: "http://elastic:9200/falco/_doc"

Falco con Slack/PagerDuty

# falcosidekick: router de alertas
# helm install falcosidekick falcosecurity/falcosidekick \
#   --set config.slack.webhookurl="https://hooks.slack.com/..." \
#   --set config.pagerduty.routingKey="..."

Comparativa: auditd vs Falco

Aspecto	auditd	Falco
Base	Kernel audit framework (nativo)	eBPF (moderno)
Instalación	Pre-instalado en la mayoría de distros	Requiere instalación
Container awareness	No (ve PIDs del host)	Sí (container name, image, namespace)
Reglas	Bajo nivel (syscalls, paths)	Alto nivel (semántico: "shell in container")
Rendimiento	Medio (overhead por syscall)	Bajo-Medio (eBPF es eficiente)
Curva de aprendizaje	Alta	Media
Kubernetes support	Limitado	Excelente
Respuesta automática	No (solo logging)	Sí (con Falcosidekick + response actions)
Coste	Gratuito (built-in)	Gratuito (CNCF open source)

Mapeo MITRE ATT&CK: detección por herramienta

Técnica ATT&CK	auditd rule key	Falco rule
T1059.004 (Unix Shell)	exec_cmd	Terminal Shell in Container
T1053.003 (Cron)	cron_modify	Crontab Modified
T1098.004 (SSH Keys)	ssh_keys	SSH Authorized Keys Modified
T1543.002 (Systemd)	systemd_persist	(custom rule needed)
T1547.006 (Kernel Modules)	module_load	Kernel Module Loaded
T1496 (Cryptomining)	(network_connect + exec_cmd)	Detect Cryptocurrency Miner
T1014 (Rootkit)	module_load, ld_preload	Kernel Module Loaded
T1552 (Credentials)	identity	Sensitive File Read

---

Fuentes y referencias

• Linux Audit. "auditd Documentation." Linux man pages.
• Red Hat. "Linux Audit System Reference." Red Hat Documentation.
• Falco. "The Cloud-Native Runtime Security Tool." https://falco.org/
• CNCF. "Falco: CNCF Graduated Project." Cloud Native Computing Foundation.
• Sysdig. "Falco Rules Reference." Sysdig Documentation.
• Wazuh. "Auditd Integration." Wazuh Documentation.
• MITRE ATT&CK. "Linux Matrix." https://attack.mitre.org/matrices/enterprise/linux/
• CIS. "CIS Benchmark for Linux: Audit Configuration." CIS Benchmarks.