Quasar Linux RAT (QLNX): Detection, Forensics, and Hardening for Linux DevOps

---
title: Linux Fileless Process Execution
id: 8a4c2d1e-5f6a-4b7c-9e1d-2f3a4b5c6d7e
status: experimental
description: Detects processes where the executable path indicates the file has been deleted from disk, a common technique for fileless malware like QLNX.
references:
 - https://securityaffairs.com/191898/malware/quasar-linux-rat-qlnx-a-fileless-linux-implant-built-for-stealth-and-persistence.html
author: Security Arsenal
date: 2025/04/09
tags:
 - attack.defense_evasion
 - attack.t1055
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    exe|contains: '(deleted)'
  condition: selection
falsepositives:
  - Legitimate updates where packages were replaced during execution (rare)
level: high
---
title: Linux Dev Tool Spawning Shell
id: 9b5d3e2f-6a7b-5c8d-0f2e-3g4h5i6j7k8l
status: experimental
description: Detects suspicious child processes (shells) spawned by common development tools (npm, pip, git), which may indicate a supply chain or trojanized package attack.
references:
 - https://securityaffairs.com/191898/malware/quasar-linux-rat-qlnx-a-fileless-linux-implant-built-for-stealth-and-persistence.html
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    parentImage|endswith:
      - '/npm'
      - '/pip'
      - '/pip3'
      - '/git'
    imageName|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
  condition: selection
falsepositives:
  - Legitimate build scripts executing shell commands
level: medium
---
title: Linux Systemd Persistence in Temp Directory
id: 1c2b3a4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects systemd units pointing to executables in temporary directories (/tmp, /dev/shm), a common persistence mechanism for Linux RATs.
references:
 - https://attack.mitre.org/techniques/T1543/002/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.persistence
  - attack.t1543.002
logsource:
  product: linux
  category: file_event
detection:
  selection:
    targetpath|startswith: '/etc/systemd/system/'
    targetpath|endswith: '.service'
  filter:
    notargetpath|contains: 
      - '/bin/'
      - '/sbin/'
      - '/usr/'
      - '/opt/'
  condition: selection and not filter
falsepositives:
  - Administrator creating custom test services (rare in prod)
level: high

// Hunt for fileless processes (exe path contains deleted)
// Ingestion via DeviceProcessEvents (Defender for Endpoints) or Syslog
DeviceProcessEvents  
| where Timestamp > ago(7d)
| where FolderPath contains "(deleted)" 
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend AlertDetails = "Fileless execution detected - process running from deleted path"

// Union with suspicious network connections from dev tools
| union (DeviceNetworkEvents  
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("npm", "pip", "node", "python", "unknown")
| where RemotePort in (443, 80, 8080) or RemoteIPType == "External"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend AlertDetails = "Suspicious network activity from dev tool")
| order by Timestamp desc

-- Hunt for Fileless Processes and Persistence Mechanisms
SELECT 
  Pid, 
  Name, 
  Exe, 
  CommandLine, 
  Cwd,
  Username
FROM pslist()
WHERE Exe =~ '(deleted)'

-- Check for ld.so.preload persistence (often used for stealth)
SELECT 
  FullPath,
  Size,
  Mode,
  Mtime
FROM glob(globs='/etc/ld.so.preload')

-- Enumerate Systemd services pointing to non-standard locations
SELECT 
  Name, 
  Description, 
  ExecStart, 
  SourcePath
FROM systemd_unit_list()
WHERE ExecStart =~ '/tmp/' OR ExecStart =~ '/dev/shm/'

#!/bin/bash

# Security Arsenal - Linux Threat Hunting & Remediation Script
# Usage: sudo ./hunt_qlnx.sh

echo "[*] Starting QLNX/Linux RAT Hunt..."

# 1. Check for processes with deleted executables (Fileless Indicator)
echo "[+] Checking for fileless processes (deleted exe)..."
for pid in $(ls -1 /proc | grep -E "^[0-9]+$"); do
  if [ -L "/proc/$pid/exe" ]; then
    exe_path=$(readlink /proc/$pid/exe)
    if [[ "$exe_path" == *"(deleted)"* ]]; then
      cmd=$(cat /proc/$pid/cmdline | tr '\0' ' ')
      echo "ALERT: PID $pid is running with deleted binary: $exe_path"
      echo "Command: $cmd"
    fi
  fi
done

# 2. Check for ld.so.preload tampering
echo "\n[+] Checking /etc/ld.so.preload..."
if [ -s /etc/ld.so.preload ]; then
  echo "ALERT: /etc/ld.so.preload exists and is not empty. Contents:"
  cat /etc/ld.so.preload
else
  echo "No suspicious preload detected."
fi

# 3. Audit Systemd user and system services for obscure paths
echo "\n[+] Auditing Systemd services for /tmp or /dev/shm references..."
systemctl list-units --all --type=service --no-legend | awk '{print $1}' | while read unit; do
  # Get the ExecStart path
  exec_path=$(systemctl show -p ExecStart "$unit" 2>/dev/null | cut -d= -f2- | awk '{print $1}')
  if [[ "$exec_path" == *"/tmp"* ]] || [[ "$exec_path" == *"/dev/shm"* ]]; then
    echo "ALERT: Suspicious Service $unit pointing to $exec_path"
  fi
done

# 4. Check for suspicious Cron jobs
echo "\n[+] Checking Cron jobs..."
for user in $(cut -f1 -d: /etc/passwd); do
  crontab -u $user -l 2>/dev/null | grep -v "^#" | while read line; do
    if [[ "$line" == *"/tmp"* ]] || [[ "$line" == *"curl"* ]] || [[ "$line" == *"wget"* ]] || [[ "$line" == *"bash -i"* ]]; then
      echo "ALERT: Suspicious Cron in $user: $line"
    fi
  done
done

echo "[*] Hunt complete. Review alerts above."