forensicnomicon 0.2.2

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

use crate::threat_intel::signals::*;

/// A string pattern baked into Father-class rootkit binaries that survives stripping.
pub struct ElfStringPattern {
    /// Literal substring to search in ELF sections (.rodata, .data.rel.ro, etc.).
    pub pattern: &'static str,
    pub description: &'static str,
    /// Relative suspicion weight; sum across matches for a quick pre-score.
    pub weight: u32,
}

/// Strings characteristic of Father-class (and derived) LD_PRELOAD rootkits found
/// in `.rodata` regardless of library name or strip state.
///
/// Sources: Father (github.com/mav8557/Father), Jynx2, Azazel source analysis.
pub const FATHER_CLASS_ELF_PATTERNS: &[ElfStringPattern] = &[
    ElfStringPattern {
        pattern: "UID:%d:",
        description: "Father PAM hook format string — logs credentials as 'UID:N:user:pass'",
        weight: 90,
    },
    ElfStringPattern {
        pattern: "silly.txt",
        description: "Father default credential log filename baked into the binary",
        weight: 85,
    },
    ElfStringPattern {
        pattern: "/tmp/.ICE",
        description: "Father/Jynx staging directory prefix in /tmp",
        weight: 70,
    },
    ElfStringPattern {
        pattern: "libprocesshider",
        description: "Process-hider library self-identifier string",
        weight: 80,
    },
    ElfStringPattern {
        pattern: "MAGIC_GID",
        description: "Jynx2 magic GID constant used to exclude root kit processes from hiding",
        weight: 75,
    },
];

pub struct HookSymbol {
    pub name: &'static str,
    /// Signal ID from `threat_intel/signals.rs` emitted when this symbol is found.
    pub emits_signal: &'static str,
    pub mitre_technique: &'static str,
}

pub const ROOTKIT_HOOK_SYMBOLS: &[HookSymbol] = &[
    HookSymbol {
        name: "readdir",
        emits_signal: ELF_HOOKS_PROCESS_HIDING,
        mitre_technique: "T1014",
    },
    HookSymbol {
        name: "readdir64",
        emits_signal: ELF_HOOKS_PROCESS_HIDING,
        mitre_technique: "T1014",
    },
    HookSymbol {
        name: "getdents",
        emits_signal: ELF_HOOKS_PROCESS_HIDING,
        mitre_technique: "T1014",
    },
    HookSymbol {
        name: "getdents64",
        emits_signal: ELF_HOOKS_PROCESS_HIDING,
        mitre_technique: "T1014",
    },
    HookSymbol {
        name: "openat",
        emits_signal: ELF_HOOKS_FILE_HIDING,
        mitre_technique: "T1564.001",
    },
    HookSymbol {
        name: "stat",
        emits_signal: ELF_HOOKS_FILE_HIDING,
        mitre_technique: "T1564.001",
    },
    HookSymbol {
        name: "lstat",
        emits_signal: ELF_HOOKS_FILE_HIDING,
        mitre_technique: "T1564.001",
    },
    HookSymbol {
        name: "access",
        emits_signal: ELF_HOOKS_FILE_HIDING,
        mitre_technique: "T1564.001",
    },
    HookSymbol {
        name: "pam_get_item",
        emits_signal: ELF_HOOKS_PAM_CREDENTIAL,
        mitre_technique: "T1556.003",
    },
    HookSymbol {
        name: "pam_authenticate",
        emits_signal: ELF_HOOKS_PAM_CREDENTIAL,
        mitre_technique: "T1556.003",
    },
    HookSymbol {
        name: "pam_open_session",
        emits_signal: ELF_HOOKS_PAM_CREDENTIAL,
        mitre_technique: "T1556.003",
    },
    HookSymbol {
        name: "recvfrom",
        emits_signal: ELF_HOOKS_NETWORK_HIDING,
        mitre_technique: "T1014",
    },
    HookSymbol {
        name: "recvmsg",
        emits_signal: ELF_HOOKS_NETWORK_HIDING,
        mitre_technique: "T1014",
    },
    HookSymbol {
        name: "getuid",
        emits_signal: ELF_HOOKS_UID_SPOOFING,
        mitre_technique: "T1548",
    },
    HookSymbol {
        name: "geteuid",
        emits_signal: ELF_HOOKS_UID_SPOOFING,
        mitre_technique: "T1548",
    },
    HookSymbol {
        name: "getpwuid",
        emits_signal: ELF_HOOKS_UID_SPOOFING,
        mitre_technique: "T1548",
    },
    HookSymbol {
        name: "write",
        emits_signal: ELF_HOOKS_IO_INTERCEPTION,
        mitre_technique: "T1056.001",
    },
];