Auditd y Falco para Detección de Malware en Linux

La telemetría que Linux no genera por defecto

A diferencia de Windows (donde Sysmon y Event Log proporcionan telemetría rica por defecto), Linux genera logs mínimos de seguridad sin configuración adicional. Un Linux vanilla solo registra logins en auth.log y mensajes del kernel en syslog. No registra qué comandos se ejecutaron, qué archivos se modificaron, ni qué conexiones de red se establecieron.

Auditd y Falco llenan ese vacío. Auditd es la solución nativa del kernel. Falco es la solución moderna basada en eBPF. Ambos son esenciales para detectar malware en servidores Linux.

Auditd: el framework de auditoría del kernel

Arquitectura

Kernel (syscalls) → kauditd → auditd (daemon) → audit.log
                                    ↓
                              audisp (dispatcher)
                                    ↓
                         ┌──────────┼──────────┐
                         │          │          │
                    syslog     SIEM plugin   custom

Configuración: /etc/audit/audit.rules

Las reglas de auditd se configuran en /etc/audit/rules.d/ o /etc/audit/audit.rules. Formato:

-a [action,filter] -S [syscall] -F [field=value] -k [key_name]
-w [path] -p [permissions] -k [key_name]

Reglas esenciales para detección de malware

# === EJECUCION DE COMANDOS ===
# Monitorizar execve (toda ejecucion de programas)
-a always,exit -F arch=b64 -S execve -k exec_cmd

# === PERSISTENCIA ===
# Crontab modifications
-w /var/spool/cron/ -p wa -k cron_modify
-w /etc/crontab -p wa -k cron_modify
-w /etc/cron.d/ -p wa -k cron_modify

# Systemd service files
-w /etc/systemd/system/ -p wa -k systemd_persist
-w /usr/lib/systemd/system/ -p wa -k systemd_persist

# SSH authorized_keys
-w /root/.ssh/authorized_keys -p wa -k ssh_keys
-w /home/ -p wa -k user_files

# Init scripts
-w /etc/rc.local -p wa -k init_persist
-w /etc/init.d/ -p wa -k init_persist

# LD_PRELOAD
-w /etc/ld.so.preload -p wa -k ld_preload
-w /etc/ld.so.conf -p wa -k ld_config

# === CREDENCIALES ===
# Password files
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/sudoers -p wa -k sudoers_modify

# === KERNEL MODULES ===
-a always,exit -F arch=b64 -S init_module -S finit_module -k module_load
-a always,exit -F arch=b64 -S delete_module -k module_unload
-w /sbin/insmod -p x -k module_tools
-w /sbin/modprobe -p x -k module_tools

# === RED ===
# Conexiones de red
-a always,exit -F arch=b64 -S connect -k network_connect
-a always,exit -F arch=b64 -S socket -F a0=2 -F a1=3 -k raw_socket

# === eBPF ===
-a always,exit -F arch=b64 -S bpf -k ebpf_activity

# === ARCHIVOS SENSIBLES ===
-w /etc/hosts -p wa -k hosts_modify
-w /etc/resolv.conf -p wa -k dns_modify

# === PROCESOS ===
-a always,exit -F arch=b64 -S ptrace -k ptrace_activity
-a always,exit -F arch=b64 -S process_vm_readv -k process_memory_read

Lectura de logs auditd

# Ver eventos recientes
ausearch -ts recent

# Buscar por key
ausearch -k cron_modify
ausearch -k ssh_keys
ausearch -k module_load

# Buscar por tipo de evento
ausearch -m EXECVE          # Ejecuciones de comandos
ausearch -m SYSCALL -sc connect   # Conexiones de red

# Formato legible
aureport -x --summary       # Resumen de ejecuciones
aureport -f --summary       # Resumen de accesos a archivos
aureport --login --summary  # Resumen de logins

Falco: runtime security con eBPF

Arquitectura

Kernel (syscalls) → eBPF probes → Falco engine → Rules evaluation → Alerts
                                                         ↓
                                                  ┌──────┼──────┐
                                                  │      │      │
                                               stdout  syslog  webhook
                                                              (Slack, PagerDuty)

Instalación

# Debian/Ubuntu
curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] https://download.falco.org/packages/deb stable main" | sudo tee /etc/apt/sources.list.d/falcosecurity.list
sudo apt update && sudo apt install falco

# Kubernetes (Helm)
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco

Reglas Falco para detección de malware

# === SHELL EN CONTENEDOR ===
- rule: Terminal Shell in Container
  desc: A shell was spawned in a container with an attached terminal
  condition: >
    spawned_process and container and proc.tty != 0 and
    proc.name in (bash, sh, zsh, dash, ksh)
  output: >
    Shell with terminal in container
    (user=%user.name container=%container.name image=%container.image.repository
     shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty)
  priority: NOTICE

# === CRYPTOMINER ===
- rule: Detect Cryptocurrency Miner
  desc: Detects execution of known cryptocurrency mining software
  condition: >
    spawned_process and
    (proc.name in (xmrig, minerd, cpuminer, ccminer, cgminer) or
     proc.cmdline contains "stratum+tcp" or
     proc.cmdline contains "stratum+ssl" or
     proc.cmdline contains "pool.minexmr" or
     proc.cmdline contains "moneroocean" or
     proc.cmdline contains "randomx")
  output: >
    Cryptocurrency miner detected
    (user=%user.name command=%proc.cmdline container=%container.name)
  priority: CRITICAL

# === REVERSE SHELL ===
- rule: Reverse Shell Detected
  desc: Detects reverse shell patterns
  condition: >
    spawned_process and
    ((proc.name = bash and proc.cmdline contains "/dev/tcp") or
     (proc.name = python and proc.cmdline contains "socket" and proc.cmdline contains "connect") or
     (proc.name = perl and proc.cmdline contains "socket") or
     (proc.name = nc and proc.cmdline contains "-e") or
     (proc.name = ncat and proc.cmdline contains "--exec"))
  output: >
    Reverse shell detected (user=%user.name command=%proc.cmdline
    container=%container.name)
  priority: CRITICAL

# === PERSISTENCIA ===
- rule: Crontab Modified
  desc: Crontab file was modified
  condition: >
    open_write and
    (fd.name startswith /var/spool/cron or
     fd.name startswith /etc/cron or
     fd.name = /etc/crontab)
  output: >
    Crontab modified (user=%user.name file=%fd.name command=%proc.cmdline)
  priority: WARNING

- rule: SSH Authorized Keys Modified
  desc: SSH authorized_keys file was modified
  condition: >
    open_write and fd.name endswith authorized_keys
  output: >
    SSH authorized_keys modified (user=%user.name file=%fd.name
    command=%proc.cmdline)
  priority: HIGH

# === ROOTKIT ===
- rule: Kernel Module Loaded
  desc: A kernel module was loaded
  condition: >
    spawned_process and
    (proc.name in (insmod, modprobe) or
     evt.type in (init_module, finit_module))
  output: >
    Kernel module loaded (user=%user.name command=%proc.cmdline)
  priority: HIGH

# === CREDENTIAL ACCESS ===
- rule: Sensitive File Read
  desc: A sensitive file was read by a non-standard process
  condition: >
    open_read and
    fd.name in (/etc/shadow, /etc/gshadow) and
    not proc.name in (login, su, sudo, sshd, passwd, chpasswd, useradd, groupadd)
  output: >
    Sensitive file read (user=%user.name file=%fd.name process=%proc.name
    command=%proc.cmdline)
  priority: HIGH

# === DOWNLOAD AND EXECUTE ===
- rule: Download and Execute Pattern
  desc: File downloaded and made executable
  condition: >
    spawned_process and
    proc.name in (curl, wget) and
    (proc.cmdline contains "/tmp/" or
     proc.cmdline contains "/dev/shm/" or
     proc.cmdline contains "/var/tmp/")
  output: >
    Download to temp directory (user=%user.name command=%proc.cmdline
    container=%container.name)
  priority: HIGH

# === PRIVILEGE ESCALATION ===
- rule: Setuid Binary Execution
  desc: A setuid binary was executed
  condition: >
    spawned_process and proc.is_exe_upper_layer and
    user.uid != 0 and proc.pname != sudo
  output: >
    Setuid binary execution (user=%user.name command=%proc.cmdline)
  priority: NOTICE

Integración con SIEM

Auditd con Wazuh

Wazuh parsea logs de auditd nativamente:

<!-- /var/ossec/etc/ossec.conf -->
<localfile>
  <log_format>audit</log_format>
  <location>/var/log/audit/audit.log</location>
</localfile>

Falco con Elastic

# falco.yaml: output a syslog
syslog_output:
  enabled: true

# O output a HTTP (para Logstash/Elastic)
http_output:
  enabled: true
  url: "http://elastic:9200/falco/_doc"

Falco con Slack/PagerDuty

# falcosidekick: router de alertas
# helm install falcosidekick falcosecurity/falcosidekick \
#   --set config.slack.webhookurl="https://hooks.slack.com/..." \
#   --set config.pagerduty.routingKey="..."

Comparativa: auditd vs Falco

Aspecto	auditd	Falco
Base	Kernel audit framework (nativo)	eBPF (moderno)
Instalación	Pre-instalado en la mayoría de distros	Requiere instalación
Container awareness	No (ve PIDs del host)	Sí (container name, image, namespace)
Reglas	Bajo nivel (syscalls, paths)	Alto nivel (semántico: "shell in container")
Rendimiento	Medio (overhead por syscall)	Bajo-Medio (eBPF es eficiente)
Curva de aprendizaje	Alta	Media
Kubernetes support	Limitado	Excelente
Respuesta automática	No (solo logging)	Sí (con Falcosidekick + response actions)
Coste	Gratuito (built-in)	Gratuito (CNCF open source)

Mapeo MITRE ATT&CK: detección por herramienta

Técnica ATT&CK	auditd rule key	Falco rule
T1059.004 (Unix Shell)	exec_cmd	Terminal Shell in Container
T1053.003 (Cron)	cron_modify	Crontab Modified
T1098.004 (SSH Keys)	ssh_keys	SSH Authorized Keys Modified
T1543.002 (Systemd)	systemd_persist	(custom rule needed)
T1547.006 (Kernel Modules)	module_load	Kernel Module Loaded
T1496 (Cryptomining)	(network_connect + exec_cmd)	Detect Cryptocurrency Miner
T1014 (Rootkit)	module_load, ld_preload	Kernel Module Loaded
T1552 (Credentials)	identity	Sensitive File Read

---

Fuentes y referencias

• Linux Audit. "auditd Documentation." Linux man pages.
• Red Hat. "Linux Audit System Reference." Red Hat Documentation.
• Falco. "The Cloud-Native Runtime Security Tool." https://falco.org/
• CNCF. "Falco: CNCF Graduated Project." Cloud Native Computing Foundation.
• Sysdig. "Falco Rules Reference." Sysdig Documentation.
• Wazuh. "Auditd Integration." Wazuh Documentation.
• MITRE ATT&CK. "Linux Matrix." https://attack.mitre.org/matrices/enterprise/linux/
• CIS. "CIS Benchmark for Linux: Audit Configuration." CIS Benchmarks.