Repository navigation
Add Linux auditd memfd_create fileless execution detection (T1620) - #4387
vahidmalekk wants to merge 3 commits into
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8993d1b08f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| data_source: | ||
| - Linux Auditd Syscall | ||
| search: |- | ||
| `linux_auditd` type=SYSCALL syscall=memfd_create |
There was a problem hiding this comment.
With the documented Linux Auditd Syscall event shape, this filter returns no memfd events: data_sources/linux_auditd_syscall.yml:70 shows that the lowercase syscall field is numeric (59) while the decoded name is emitted in uppercase SYSCALL (execve). Comparing the lowercase field to memfd_create therefore leaves the analytic silent for data ingested as specified; query SYSCALL=memfd_create (or architecture-aware numeric syscall IDs) instead.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Already addressed - the review ran against the original commit (8993d1b). The current head (aa6cef4) matches both field-case conventions: type=SYSCALL (syscall=memfd_create OR SYSCALL=memfd_create), followed by eval syscall="memfd_create" to normalize for display. So it fires whether the deployment emits the decoded name in the lowercase syscall field or the uppercase SYSCALL field, and how_to_implement documents both.
Details
What does this PR have in it? Screenshots are worth 1000 words 😄
Checklist
<platform>_<mitre att&ck technique>_<short description>nomenclatureNotes For Submitters and Reviewers
buildCI job when it fails will likely show an error about what is failing. You may have a very descriptive error of the specific field(s) in the specific file(s) that is causing an issue. In some cases, its also possible there is an issue with the YAML. Many of these can be caught with the pre-commit hooks if you set them up. These errors will be less descriptive as to what exactly is wrong, but will give you a column and row position in a specific file where the YAML processing breaks. If you're having trouble with this, feel free to add a comment to your PR tagging one of the maintainers and we'll be happy to help troubleshoot it.