Arch Linux AUR Compromise: Supply Chain Attack Distributing Rootkits and Infostealers

---
title: Potential AUR Supply Chain Compromise - Suspicious Makepkg Network Activity
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects makepkg or AUR helper processes establishing network connections, typical of malicious build scripts fetching payloads.
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1195.002
logsource:
  product: linux
  category: network_connection
detection:
  selection:
    ParentImage|endswith:
      - '/makepkg'
      - '/yay'
      - '/paru'
    Initiated: true
  condition: selection
falsepositives:
  - Legitimate package sources downloading dependencies (rare for AUR)
level: high
---
title: Linux Rootkit Infostealer - Suspicious SSH/Config Access
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects processes reading sensitive .ssh or config files immediately following package installation activity.
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1059.001
logsource:
  product: linux
  category: process_creation
detection:
  selector_parent:
    ParentImage|endswith:
      - '/pacman'
      - '/makepkg'
      - '/yay'
      - '/paru'
  selector_access:
    CommandLine|contains:
      - '/.ssh/'
      - '.aws/credentials'
      - '.config/gcloud'
  condition: selector_parent and selector_access
falsepositives:
  - Post-install scripts legitimately setting up keys (low volume)
level: critical

let AURHelpers = dynamic(["yay", "paru", "makepkg", "pacman"]);
Syslog
| where ProcessName in (AURHelpers) or SyslogMessage has_any (AURHelpers)
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(1d) 
    | where ProcessCommandLine has_any ("/root/", ".ssh/", ".aws/", "id_rsa") 
    | where InitiatingProcessFileName in (AURHelpers)
) on Computer
| project TimeGenerated, Computer, InitiatingProcessFileName, ProcessCommandLine, FileName

-- Hunt for processes with suspicious binary paths hidden from standard listings
SELECT Pid, Name, Exe, Username, CommandLine
FROM pslist()
WHERE Exe NOT IN ("/usr/bin", "/bin", "/sbin", "/usr/sbin")
  AND Exe =~ "/tmp/" OR Exe =~ "/var/tmp/" 
  AND Name NOT IN ("systemd", "bash", "sh", "zsh")

-- Hunt for recently modified AUR package directories (indicators of compromise)
SELECT FullPath, Mode, Size, Mtime, Atime
FROM glob(globs="/var/cache/pacman/pkg/*")
WHERE Mtime > now() - 24h
  AND Mode =~ "rwxrwxrwx" -- Suspicious permissions on cached packages

#!/bin/bash

# Audit AUR packages for recent changes
echo "[+] Auditing recently installed AUR packages (foreign packages)..."
pacman -Qm --date | head -n 50

# Check for hidden modules or suspicious kernel objects
echo "[+] Checking for loaded kernel modules (rootkit check)..."
lsmod | grep -v "^Module" | while read module rest; do
  modinfo "$module" 2>/dev/null | grep -q "description:" || echo "Suspicious module: $module (no description)"
done

# Scan for common infostealer persistence locations
echo "[+] Scanning for suspicious cron jobs..."
crontab -l 2>/dev/null | grep -v "^#" | grep -v "^$"

# Check for rogue systemd units
if [ -d /etc/systemd/system ]; then
  echo "[+] Checking for recently created systemd units..."
  find /etc/systemd/system -name "*.service" -mtime -2 -exec ls -la {} \;
fi

echo "[+] Checking for unauthorized SSH keys in root..."
if [ -f /root/.ssh/authorized_keys ]; then
  cat /root/.ssh/authorized_keys
fi

echo "[+] ACTION REQUIRED: Review the list of 'pacman -Qm' packages against the official Arch Linux security advisory."