Catch a process tree that every binary in it is signed

applied · 80 min · Objective 4.5

Task

Generate a living-off-the-land process chain on your own VM using only legitimate system tools, show that file-based detection has nothing to say about it, and then write the behavioural rule that does.

Steps

  1. Enable process auditing so parentage and command lines are recorded: add auditctl rules for execve, or enable the equivalent.
  2. Build the chain using only shipped tools: a shell spawns an interpreter, which spawns a network client, which writes a file. Every binary in it is a legitimate part of the OS.
  3. Confirm the file-based view is clean: hash each binary in the chain and verify each is the unmodified package version.
  4. Now extract the behavioural evidence: pull the execve records and reconstruct the parent-child chain with full command lines.
  5. Write /tmp/behaviour.py: it reads the audit records and alerts on a chain where an interpreter is the child of a non-interactive parent and is itself the parent of a network client.
  6. Test it against your chain and against ordinary activity, and record in /tmp/lotl.md why the hash check was useless and what the rule keyed on instead.

Verify

sudo auditctl -l | grep -c execve
sudo ausearch -m EXECVE 2>/dev/null | grep -c "argc"
python3 /tmp/behaviour.py | grep -ci "alert"
python3 - <<'PY'
import subprocess
out=subprocess.run(['python3','/tmp/behaviour.py'],capture_output=True,text=True).stdout
alerts=out.lower().count('alert')
print('behavioural alerts:',alerts)
assert alerts>=1, 'the chain was not detected - check the audit rules are loaded'
PY
grep -ciE "signed|hash|parent|chain" /tmp/lotl.md

The assertion requires the behavioural rule to fire on a chain in which every executable is legitimate and correctly signed. That is the entire point: the hash check passes, the signature check passes, and the only thing that is wrong is the shape of the tree.

Notes

This is what EDR does and why signature antivirus structurally cannot. The detection keyed on relationships — who spawned whom, with what arguments — and not on any property of the files involved, which is why it survives an attacker using nothing but the tools already present.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.