1 # rootkit_trojans.txt, (C) 2018 OSSEC Project
2 # Imported from the rootcheck project.
3 # Some entries taken from the chkrootkit project.
5 # Released under the same license as OSSEC.
6 # More details at the LICENSE file included with OSSEC or online
7 # at: https://github.com/ossec/ossec-hids/blob/master/LICENSE
9 # Blank lines and lines starting with '#' are ignored.
11 # Each line must be in the following format:
12 # file_name !string_to_search!Description
14 # Common binaries and public trojan entries
15 ls !bash|^/bin/sh|dev/[^clu]|\.tmp/lsfile|duarawkz|/prof|/security|file\.h!
16 env !bash|^/bin/sh|file\.h|proc\.h|/dev/|^/bin/.*sh!
17 echo !bash|^/bin/sh|file\.h|proc\.h|/dev/[^cl]|^/bin/.*sh!
18 chown !bash|^/bin/sh|file\.h|proc\.h|/dev/[^cl]|^/bin/.*sh!
19 chmod !bash|^/bin/sh|file\.h|proc\.h|/dev/[^cl]|^/bin/.*sh!
20 chgrp !bash|^/bin/sh|file\.h|proc\.h|/dev/[^cl]|^/bin/.*sh!
21 cat !bash|^/bin/sh|file\.h|proc\.h|/dev/[^cl]|^/bin/.*sh!
22 bash !proc\.h|/dev/[0-9]|/dev/[hijkz]!
23 sh !proc\.h|/dev/[0-9]|/dev/[hijkz]!
24 uname !bash|^/bin/sh|file\.h|proc\.h|^/bin/.*sh!
25 date !bash|^/bin/sh|file\.h|proc\.h|/dev/[^cln]|^/bin/.*sh!
26 du !w0rm|/prof|file\.h!
27 df !bash|^/bin/sh|file\.h|proc\.h|/dev/[^clurdv]|^/bin/.*sh!
28 login !elite|SucKIT|xlogin|vejeta|porcao|lets_log|sukasuk!
29 passwd !bash|file\.h|proc\.h|/dev/ttyo|/dev/[A-Z]|/dev/[b-s,uvxz]!
30 mingetty !bash|Dimensioni|pacchetto!
31 chfn !bash|file\.h|proc\.h|/dev/ttyo|/dev/[A-Z]|/dev/[a-s,uvxz]!
32 chsh !bash|file\.h|proc\.h|/dev/ttyo|/dev/[A-Z]|/dev/[a-s,uvxz]!
33 mail !bash|file\.h|proc\.h|/dev/[^nu]!
34 su !/dev/[d-s,abuvxz]|/dev/[A-D]|/dev/[F-Z]|/dev/[0-9]|satori|vejeta|conf\.inv!
35 sudo !satori|vejeta|conf\.inv!
36 crond !/dev/[^nt]|bash!
38 ifconfig !bash|^/bin/sh|/dev/tux|session.null|/dev/[^cludisopt]!
39 diff !bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh!
40 md5sum !bash|^/bin/sh|file\.h|proc\.h|/dev/|^/bin/.*sh!
41 hdparm !bash|/dev/ida!
42 ldd !/dev/[^n]|proc\.h|libshow.so|libproc.a!
44 # Trojan entries for troubleshooting binaries
46 egrep !bash|^/bin/sh|file\.h|proc\.h|/dev/|^/bin/.*sh!
47 find !bash|/dev/[^tnlcs]|/prof|/home/virus|file\.h!
48 lsof !/prof|/dev/[^apcmnfk]|proc\.h|bash|^/bin/sh|/dev/ttyo|/dev/ttyp!
49 netstat !bash|^/bin/sh|/dev/[^aik]|/prof|grep|addr\.h!
50 top !/dev/[^npi3st%]|proc\.h|/prof/!
51 ps !/dev/ttyo|\.1proc|proc\.h|bash|^/bin/sh!
52 tcpdump !bash|^/bin/sh|file\.h|proc\.h|/dev/[^bu]|^/bin/.*sh!
53 pidof !bash|^/bin/sh|file\.h|proc\.h|/dev/[^f]|^/bin/.*sh!
54 fuser !bash|^/bin/sh|file\.h|proc\.h|/dev/[a-dtz]|^/bin/.*sh!
55 w !uname -a|proc\.h|bash!
57 # Trojan entries for common daemons
59 named !bash|blah|/dev/[0-9]|^/bin/sh!
60 inetd !bash|^/bin/sh|file\.h|proc\.h|/dev/[^un%]|^/bin/.*sh!
61 apachectl !bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh!
62 sshd !check_global_passwd|panasonic|satori|vejeta|\.ark|/hash\.zk|bash|/dev[a-s]|/dev[A-Z]/!
63 syslogd !bash|/usr/lib/pt07|/dev/[^cln]]|syslogs\.h|proc\.h!
64 xinetd !bash|file\.h|proc\.h!
65 in.telnetd !cterm100|vt350|VT100|ansi-term|bash|^/bin/sh|/dev[A-R]|/dev/[a-z]/!
66 in.fingerd !bash|^/bin/sh|cterm100|/dev/!
67 identd !bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh!
69 tcpd !bash|proc\.h|p1r0c4|hack|/dev/[^n]!
70 rlogin !p1r0c4|r00t|bash|/dev/[^nt]!
73 killall !/dev/[^t%]|proc\.h|bash|tmp!
74 kill !/dev/[ab,d-k,m-z]|/dev/[F-Z]|/dev/[A-D]|/dev/[0-9]|proc\.h|bash|tmp!
77 /etc/rc.d/rc.sysinit !enyelkmHIDE! enye-sec Rootkit
79 # ZK rootkit (http://honeyblog.org/junkyard/reports/redhat-compromise2.pdf)
80 /etc/sysconfig/console/load.zk !/bin/sh! ZK rootkit
81 /etc/sysconfig/console/load.zk !usr/bin/run! ZK rootkit
83 # Modified /etc/hosts entries
85 # http://blog.tenablesecurity.com/2006/12/detecting_compr.html
86 # http://www.sophos.com/security/analyses/trojbagledll.html
87 # http://www.f-secure.com/v-descs/fantibag_b.shtml
88 /etc/hosts !^[^#]*avp.ch!Anti-virus site on the hosts file
89 /etc/hosts !^[^#]*avp.ru!Anti-virus site on the hosts file
90 /etc/hosts !^[^#]*awaps.net! Anti-virus site on the hosts file
91 /etc/hosts !^[^#]*ca.com! Anti-virus site on the hosts file
92 /etc/hosts !^[^#]*mcafee.com! Anti-virus site on the hosts file
93 /etc/hosts !^[^#]*microsoft.com! Anti-virus site on the hosts file
94 /etc/hosts !^[^#]*f-secure.com! Anti-virus site on the hosts file
95 /etc/hosts !^[^#]*sophos.com! Anti-virus site on the hosts file
96 /etc/hosts !^[^#]*symantec.com! Anti-virus site on the hosts file
97 /etc/hosts !^[^#]*my-etrust.com! Anti-virus site on the hosts file
98 /etc/hosts !^[^#]*nai.com! Anti-virus site on the hosts file
99 /etc/hosts !^[^#]*networkassociates.com! Anti-virus site on the hosts file
100 /etc/hosts !^[^#]*viruslist.ru! Anti-virus site on the hosts file
101 /etc/hosts !^[^#]*kaspersky! Anti-virus site on the hosts file
102 /etc/hosts !^[^#]*symantecliveupdate.com! Anti-virus site on the hosts file
103 /etc/hosts !^[^#]*grisoft.com! Anti-virus site on the hosts file
104 /etc/hosts !^[^#]*clamav.net! Anti-virus site on the hosts file
105 /etc/hosts !^[^#]*bitdefender.com! Anti-virus site on the hosts file
106 /etc/hosts !^[^#]*antivirus.com! Anti-virus site on the hosts file
107 /etc/hosts !^[^#]*sans.org! Security site on the hosts file