KimWolf Botnet Takedown: Detecting and Eradicating Linux IoT DDoS Agents

---
title: KimWolf Botnet - Linux Binary Execution from Temp Directories
id: 91f7d2a4-2c4b-4e9c-8a1e-1d5f6b7c8d9e
status: experimental
description: Detects execution of binaries from world-writable directories commonly used by Mirai/KimWolf botnets for payload staging (e.g., /tmp, /var/tmp, /dev/shm).
references:
 - https://attack.mitre.org/techniques/T1055/
author: Security Arsenal
date: 2024/04/25
tags:
 - attack.execution
 - attack.t1059.004
logsource:
 category: process_creation
 product: linux
detection:
  selection:
    Image|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/dev/'
    Image|endswith:
      - '.sh'
      - '.bin'
      - 'arm'
      - 'mips'
      - 'x86'
  filter_legit:
    Image|contains:
      - '/usr/bin/'
      - '/usr/local/bin/'
      - '/opt/'
    ParentImage|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/systemd'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate administrative scripts running from tmp
  - Package manager installations
level: high
---
title: KimWolf Botnet - Potential Botnet Process Names
id: 3e8c1a0b-5d9f-4a2e-9b3c-8d7f6a5b4c3d
status: experimental
description: Detects processes running with names commonly associated with Mirai/KimWolf variants (often generic or randomized, but utilizing specific arch names).
references:
 - https://bleepingcomputer.com/news/security/us-and-canada-arrest-and-charge-suspected-kimwolf-botnet-admin/
author: Security Arsenal
date: 2024/04/25
tags:
 - attack.persistence
 - attack.t1543.001
logsource:
 category: process_creation
 product: linux
detection:
  selection:
    Image|endswith:
      - '/bins.sh'
      - '/kdevtmpfsi'
      - '/kinsing'
      - '/masscan'
      - '/xmrig'
  condition: selection
falsepositives:
  - Legitimate security tools running unauthorized
level: critical

// Hunt for suspicious Linux process execution in temp directories
DeviceProcessEvents  
| where Timestamp > ago(7d) 
| where DeviceOS startswith "Linux" 
| where ProcessCommandLine has "/tmp/" or ProcessCommandLine has "/dev/shm/" 
| where ProcessCommandLine has_any ("wget", "curl", "tftp", "chmod", "./") 
| extend FullPath = tostring(split(ProcessCommandLine, ' ')[1]) 
| where isnotempty(FullPath) 
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, ProcessName, InitiatingProcessFileName, FullPath 
| order by Timestamp desc

-- Hunt for running binaries located in temporary directories (common bot persistence)
SELECT Pid, Name, Exe, Username, Ctime
FROM pslist()
WHERE Exe =~ '^/tmp/.*' 
   OR Exe =~ '^/var/tmp/.*' 
   OR Exe =~ '^/dev/shm/.*'
-- Exclude legitimate shells that might be running legitimately
AND Name NOT IN ('bash', 'sh', 'dash', 'zsh', 'tmux', 'screen')

#!/bin/bash
# Remediation script for suspected KimWolf/Mirai infection on IoT/Linux
# WARNING: Run with caution. This script kills suspicious processes.

LOG_FILE="/var/log/kimwolf_remediation.log"
echo "Starting KimWolf Remediation Scan at $(date)" | tee -a $LOG_FILE

# 1. Identify and kill processes running from /tmp or /dev/shm (excluding known shells)
suspicious_procs=$(ps aux | grep -E '(/tmp/|/dev/shm/|/var/tmp/)' | grep -vE '(grep|bash|sh|dash|zsh)' | awk '{print $2}')

if [ -n "$suspicious_procs" ]; then
    echo "Killing suspicious PIDs: $suspicious_procs" | tee -a $LOG_FILE
    kill -9 $suspicious_procs
else
    echo "No suspicious processes found in temp directories." | tee -a $LOG_FILE
fi

# 2. Remove common persistence mechanisms (Cron)
# Note: This is aggressive. Verify crontab contents before deletion in production.
echo "Scanning for suspicious crontab entries..." | tee -a $LOG_FILE
crontab -l | grep -E '(wget|curl|tftp|chmod|\./)' | tee -a $LOG_FILE
# crontab -l | grep -E '(wget|curl|tftp|chmod|\./)' | crontab - 
# Uncomment above line to automatically remove malicious crontabs

# 3. Clean common binary drop locations
echo "Cleaning suspicious binaries from /tmp, /dev/shm..." | tee -a $LOG_FILE
rm -f /tmp/.mips /tmp/.arm /tmp/.x86 /tmp/*.sh /dev/shm/*

echo "Remediation complete. Please verify device integrity and change passwords." | tee -a $LOG_FILE