TTY Log Forensics: Turning Honeypot Attacker Keystrokes Into Production SSH Defense

---
title: Linux Post-SSH-Login Download Cradle Execution
id: 3f8c2a91-7b44-4e1d-9c62-a1b5d8e4f210
status: experimental
description: Detects chained download-and-execute commands typical of botnet enrollment and malware staging observed in SSH honeypot TTY logs after successful login.
references:
  - https://isc.sans.edu/diary/rss/33396
  - https://attack.mitre.org/techniques/T1105/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'wget http'
      - 'curl http'
      - 'curl -O '
      - 'wget -q '
  chaining:
    CommandLine|contains:
      - 'chmod +x'
      - 'chmod 777'
      - 'chmod 755'
  tmp_paths:
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/run/'
  condition: selection and (chaining or tmp_paths)
falsepositives:
  - Legitimate software deployment scripts in /tmp during provisioning
  - Configuration management tools (Ansible, Chef) pulling scripts
level: high
---
title: Linux Shell History Tampering After Interactive Login
id: 91d4e7b2-3c58-4f0a-b6d1-2e8a9f5c7341
status: experimental
description: Detects attempts to clear or disable shell command history, a common anti-forensics behavior observed in attacker TTY sessions on compromised Linux hosts.
references:
  - https://isc.sans.edu/diary/rss/33396
  - https://attack.mitre.org/techniques/T1070/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1070.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_clear:
    CommandLine|contains:
      - 'history -c'
      - 'history -cw'
  selection_unset:
    CommandLine|contains:
      - 'unset HISTFILE'
      - 'export HISTFILE=/dev/null'
      - 'HISTFILESIZE=0'
      - 'HISTSIZE=0'
  selection_delete:
    CommandLine|contains:
      - '.bash_history'
      - '.zsh_history'
  condition: selection_clear or selection_unset or selection_delete
falsepositives:
  - Privacy-conscious administrators (rare; investigate context)
  - Some CI/CD cleanup scripts
level: medium
---
title: Rapid Reconnaissance Command Burst in Linux Session
id: b6a1d4e8-2f97-4c35-8d0a-5e3b7c9f8216
status: experimental
description: Detects the classic environment-fingerprinting command sequence (uname, cpuinfo, whoami) seen in the first seconds of automated and manual attacker SSH sessions in honeypot TTY logs. Tune thresholds to your environment.
references:
  - https://isc.sans.edu/diary/rss/33396
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1082/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1082
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'uname -a'
      - 'cat /proc/cpuinfo'
      - 'cat /etc/issue'
      - 'lscpu'
      - 'nproc'
  condition: selection
falsepositives:
  - Monitoring agents and inventory tools (filter by parent process and service accounts)
  - Legitimate admin troubleshooting — correlate with unusual source IPs and non-standard hours
level: low

// Hunt for post-SSH-login download cradles and history tampering in Syslog data
// Assumes Linux auth.log/auditd forwarded to Sentinel via Syslog/CEF connector
let Lookback = 7d;
let SuspiciousCmds = dynamic(["wget http", "curl http", "curl -O", "chmod +x", "history -c", "unset HISTFILE", ".bash_history", "uname -a", "cat /proc/cpuinfo"]);
Syslog
| where TimeGenerated > ago(Lookback)
| where Facility in ("auth", "authpriv", "local0", "user") or ProcessName in ("sshd", "sudo", "bash", "sh", "auditd")
| extend SyslogMsg = tostring(SyslogMessage)
| where SyslogMsg has_any (SuspiciousCmds)
| extend MatchedCmd = extract(@"(wget http[^\s]*|curl http[^\s]*|curl -O|chmod \+x|history -c|unset HISTFILE|uname -a|cat /proc/cpuinfo)", 0, SyslogMsg)
| summarize CommandCount = count(), Commands = make_set(MatchedCmd), Hosts = make_set(Computer) by Computer, ProcessName, bin(TimeGenerated, 5m)
| where CommandCount >= 2
| sort by TimeGenerated desc;

// Correlate successful SSH logins with subsequent suspicious activity window
let Lookback = 7d;
Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName == "sshd"
| where SyslogMessage has "Accepted password" or SyslogMessage has "Accepted publickey"
| extend SrcIP = extract(@"from ([0-9\.]+)", 1, tostring(SyslogMessage))
| extend AuthUser = extract(@"for (?:invalid user )?([a-zA-Z0-9_\-\.]+) from", 1, tostring(SyslogMessage))
| summarize LoginCount = count(), SourceIPs = make_set(SrcIP), Users = make_set(AuthUser) by Computer, bin(TimeGenerated, 1h)
| where LoginCount > 0
| join kind=leftouter (
    Syslog
    | where TimeGenerated > ago(Lookback)
    | where SyslogMessage has_any ("wget", "curl", "chmod", "history -c", "/dev/shm")
    | summarize SuspiciousActivity = count() by Computer, bin(TimeGenerated, 1h)
) on Computer, TimeGenerated
| where SuspiciousActivity > 0
| project TimeGenerated, Computer, LoginCount, SourceIPs, Users, SuspiciousActivity
| sort by SuspiciousActivity desc;

-- Hunt for post-login staging artifacts and history tampering on Linux endpoints
-- Deploy via Velociraptor hunt across Linux fleet

-- Artifact 1: Executable files recently dropped into common staging directories
SELECT FullPath, Size, Mtime, Ctime,
       Mode
FROM glob(globs=['/tmp/*', '/dev/shm/*', '/var/run/*', '/var/tmp/*'])
WHERE Mode =~ 'x'
  AND Mtime > now() - 604800
ORDER BY Mtime DESC

-- Artifact 2: Truncated or recently deleted shell histories (anti-forensics indicator)
SELECT FullPath, Size, Mtime
FROM glob(globs=['/root/.bash_history', '/home/*/.bash_history', '/home/*/.zsh_history'])
WHERE Size < 100 OR Mtime > now() - 86400

-- Artifact 3: Processes spawned from staging directories (live execution check)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '/tmp/|/dev/shm/|/var/run/'
   OR CommandLine =~ 'wget http|curl http|/dev/shm/'

-- Artifact 4: Newly added SSH authorized_keys (persistence check)
SELECT FullPath, Size, Mtime
FROM glob(globs=['/root/.ssh/authorized_keys', '/home/*/.ssh/authorized_keys'])
WHERE Mtime > now() - 604800

#!/bin/bash
# Security Arsenal - Linux SSH Post-Compromise Visibility & Hardening Script
# Purpose: Enable TTY auditing, forward auth telemetry, and verify SSH hardening
# Tested on: RHEL 8/9, Ubuntu 20.04/22.04/24.04 (adjust paths as needed)
# Run as root. Review before deploying to production.

set -euo pipefail
echo "=== [1/6] Enabling pam_tty_audit for all users ==="
# TTY keystroke auditing via PAM - captures interactive session input into auditd
if [ -f /etc/pam.d/system-auth ]; then  # RHEL-family
    grep -q pam_tty_audit /etc/pam.d/system-auth || \
      sed -i '/pam_unix.so/a session required pam_tty_audit.so enable=*' /etc/pam.d/password-auth /etc/pam.d/system-auth
fi
if [ -f /etc/pam.d/common-session ]; then  # Debian-family
    grep -q pam_tty_audit /etc/pam.d/common-session || \
      echo "session required pam_tty_audit.so enable=*" >> /etc/pam.d/common-session
fi

echo "=== [2/6] Installing/starting auditd ==="
if command -v apt-get >/dev/null; then
    apt-get update -qq && apt-get install -y auditd audispd-plugins
elif command -v dnf >/dev/null; then
    dnf install -y audit audit-libs
fi
systemctl enable --now auditd

echo "=== [3/6] Adding audit rules for execve, staging dirs, and history tampering ==="
cat > /etc/audit/rules.d/90-post-exploitation.rules <<'EOF'
# Log all execve calls (process execution)
-a always,exit -F arch=b64 -S execve -k proc_exec
-a always,exit -F arch=b32 -S execve -k proc_exec
# Watch common malware staging directories
-w /tmp -p wa -k staging_tmp
-w /dev/shm -p wa -k staging_devshm
-w /var/tmp -p wa -k staging_vartmp
# Watch shell history and SSH key files
-w /root/.bash_history -p wa -k history_tamper
-w /root/.ssh/authorized_keys -p wa -k ssh_persistence
EOF
augenrules --load && systemctl restart auditd

echo "=== [4/6] Verifying SSH hardening baseline ==="
SSHD_CFG=/etc/ssh/sshd_config
echo "-- PasswordAuthentication: $(sshd -T 2>/dev/null | grep -i passwordauthentication || echo 'CHECK MANUALLY')"
echo "-- PermitRootLogin:        $(sshd -T 2>/dev/null | grep -i permitrootlogin || echo 'CHECK MANUALLY')"
# Enforce key-only auth and disable direct root login (uncomment after confirming key access works)
# sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' $SSHD_CFG
# sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' $SSHD_CFG
# systemctl reload sshd

echo "=== [5/6] Verifying log forwarding (Syslog -> SIEM) ==="
if systemctl is-active --quiet rsyslog; then
    echo "rsyslog active. Confirm remote forwarding stanza exists:"
    grep -rE '^[^#]*(@@?|\*\.\*)' /etc/rsyslog.conf /etc/rsyslog.d/ 2>/dev/null || \
      echo "WARNING: No remote syslog forwarding configured - auth.log and audit logs stay local!"
else
    echo "WARNING: rsyslog not running"
fi

echo "=== [6/6] Quick exposure check ==="
echo "Listening SSH sockets:"
ss -tlnp | grep -E ':22\b' || echo "No SSH on port 22 (verify alternate ports)"
echo ""
echo "DONE. Validate: run 'aureport -tty' and 'ausearch -k proc_exec' after next login session."