SID 1:498

Rule Category

INDICATOR-COMPROMISE -- Snort detected a system behavior that suggests the system has been affected by malware. That behavior is known as an Indicator of Compromise (IOC). The symptoms could be a wide range of behaviors, from a suspicious file name to an unusual use of a utility. Symptoms do not guarantee an infection; your network configuration may not be affected by malware, but showing indicators as a result of a normal function. In this case, attackers may be attempting to gain privileges and access other systems, spread influence, and make calls and commands with elevated access. The context of the traffic is important to determine intrusion; traffic from an administration utility performing commands on a user's computer is likely not a compromise, but a user laptop accessing a webserver may indicate intrusion.

Alert Message

INDICATOR-COMPROMISE id check returned root

Rule Explanation

This event is generated by the use of a UNIX "id" command. This may be indicative of post-compromise behavior where the attacker is checking for super user privileges gained by a successful exploit against a vulnerable system. Impact: Serious. An attacker may have gained super user access to the system. Details: This event is generated when a UNIX "id" command is used to confirm the user name of the currently logged in user over an unencrypted connection. This connection can either be a legitimate telnet connection or the result of spawning a remote shell as a consequence of a successful network exploit. The string "uid=0(root)" is an output of an "id" command indicating that the user has "root" privileges. Seeing such a response indicates that some user, connected over the network to a target server, has root privileges. Ease of Attack: Simple. This may be post-attack behavior and can be indicative of the successful exploitation of a vulnerable system.

What To Look For

No information provided

Known Usage

No public information

False Positives

Known false positives, with the described conditions

This rule will generate an event if a legitimate system administrator executes the "id" command over an unencrypted connection to verify the privilege level available to him. This rule may also generate event by viewing the documentation on snort.org or any other security related web site which may contain details on this issue. The web site www.bugtraq.org serves a non-standard HTTP header of the form "X-Mandatory-Snort-Alert: *GOBBLE* uid=65534(nobody) uid=0(root)" browsing this site will generate an event.

Contributors

Original rule writer unknown Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org> Cisco Talos Nigel Houghton Additional false positive information contributed by Arnd Fischer