ARMR Process Rule
Support for API Protect was added to this rule in ARMR 2.9. Please see the API Protect Directives page in the ARMR documentation for information on how to configure this rule for API endpoint protection.
Overview
The ARMR process rule can be used to control the access that an application has for executing external processes on the server. This is useful to prevent unauthorized attempts at process forking.
When (Event)
To control access to executables using the ARMR process rule the user must specify the execute declaration.
execute
A parameter must be supplied to the execute declaration to determine the executable(s) that the ARMR process rule will control access to.
Both Unix and Windows filesystem paths are supportedThis parameter takes the form of a list of one or more quoted-strings indicating specifically targeted executables.
Each string represented in the parameter can be:
-
a single executable or directory name - the agent will control access to any executable or directory on the filesystem that matches the given name
-
an absolute path to a specific executable or directory
The wildcard character (*) is supported anywhere in the executable name or path:
-
only one wildcard character can be used with each path
-
the wildcard will only wildcard a single directory
-
the wildcard can be used to specify all executables with a specific prefix
-
the wildcard character specified on its own represents all executables and directories on the filesystem |
Then (Action)
There are three supported actions for the ARMR process rule: protect, detect and allow.
| protect | All attempts to fork a process are blocked. If configured, a log message is generated with details of the event. |
| detect | Monitoring mode: the application behaves as normal. A log message is generated with details of all attempts to fork a process. A log message must be specified with this action. |
| allow | Can be used to allow access to execute specific processes which are a subset of protected executables covered by an ARMR process rule in protect mode. |
As part of the action statement, the user may optionally specify the parameter stacktrace: “full”. When this parameter is specified, the stacktrace of the location of the attempted exploit is included in the security log entry.
Examples
All examples of the ARMR process rule are given for both Unix and Windows style filesystem paths, where appropriate.
In the following example, we define an ARMR process rule that prevents forking of all processes inside a specific directory.
Unix
app("Process forking mod"):
requires(version: ARMR/2.7)
process("Protect executable in a specific directory"):
execute("/tmp/*")
protect(message: "denying attempt to execute processes inside specific directory", severity: 10)
endprocess
endapp
Windows
app("Process forking mod"):
requires(version: ARMR/2.7)
process("Protect executable in a specific directory"):
execute("C:\\Windows\\*")
protect(message: "denying attempt to execute processes inside specific directory", severity: 10)
endprocess
endapp
Logging
Unix
<9>1 2021-03-29T11:44:30.233+01:00 userX_system java 15891 - - CEF:0|ARMR:ARMR|ARMR|2.7|Protect executable in a specific directory|Execute Rule|Very-High|rt=Mar 29 2021 11:44:30.232 +0100 dvchost=userX_system procid=15891 appVersion=1 ruleType=process securityFeature=process act=protect msg=denying attempt to execute processes inside specific directory path=/tmp/myscript.sh commandLine=myscript.sh scriptArg
Windows
<9>1 2021-03-29T11:47:50.278+01:00 userX_system java 13286 - - CEF:0|ARMR:ARMR|ARMR|2.7|Protect executable in a specific directory|Execute Rule|Very-High|rt=Mar 29 2021 11:47:50.278 +0100 dvchost=userX_system procid=13286 appVersion=1 ruleType=process securityFeature=process act=protect msg=denying attempt to execute processes inside specific directory path=C:\\Windows\\myscript.bat commandLine=myscript.bat scriptArg
Further Examples
As above, with the stacktrace also logged
Unix
app("Process forking mod - with stacktrace"):
requires(version: ARMR/2.7)
process("Protect executable in a specific directory"):
execute("/tmp/*")
protect(message: "denying attempt to execute processes inside specific directory", severity: 10, stacktrace: "full")
endprocess
endapp
Windows
app("Process forking mod - with stacktrace"):
requires(version: ARMR/2.7)
process("Protect executable in a specific directory"):
execute("C:\\Windows\\*")
protect(message: "denying attempt to execute processes inside specific directory", severity: 10, stacktrace: "full")
endprocess
endapp
Logging
Unix
<9>1 2021-03-29T11:48:42.789+01:00 userX_system java 15891 - - CEF:0|ARMR:ARMR|ARMR|2.7|Protect executable in a specific directory|Execute Rule|Very-High|rt=Mar 29 2021 11:48:42.787 +0100 dvchost=userX_system procid=15891 appVersion=1 ruleType=process securityFeature=process act=protect msg=denying attempt to execute processes inside specific directory stacktrace=com.waratek.spiracle.file.FileExecServlet.executeRequest(FileExecServlet.java:78)\ncom.waratek.spiracle.file.FileExecServlet.doPost(FileExecServlet.java:70)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:650)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:731)\nsun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\nsun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)\nsun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\nsun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\norg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:442)\norg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1082)\norg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:623)\norg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:748) path=/tmp/myscript.sh commandLine=/tmp/myscript.sh scriptArg
Windows
<9>1 2021-03-29T11:52:52.759+01:00 userX_system java 15844 - - CEF:0|ARMR:ARMR|ARMR|2.7|Protect executable in a specific directory|Execute Rule|Very-High|rt=Mar 29 2021 11:52:52.759 +0100 dvchost=userX_system procid=15844 appVersion=1 ruleType=process securityFeature=process act=protect msg=denying attempt to execute processes inside specific directory stacktrace=com.waratek.spiracle.file.FileExecServlet.executeRequest(FileExecServlet.java:78)\ncom.waratek.spiracle.file.FileExecServlet.doPost(FileExecServlet.java:70)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:650)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:731)\nsun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\nsun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)\nsun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\nsun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\norg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:442)\norg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1082)\norg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:623)\norg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:748) path=C:\\Windows\\myscript.bat commandLine=myscript.bat scriptArg
Prevent forking a specific process
Unix
app("Process forking mod 2"):
requires(version: ARMR/2.7)
process("Prevent forking a specific process"):
execute("/tmp/myscript.sh")
protect(message: "denying attempt to execute specific process", severity: High)
endprocess
endapp
Windows
app("Process forking mod 2"):
requires(version: ARMR/2.7)
process("Prevent forking a specific process"):
execute("C:\\Windows\\myscript.bat")
protect(message: "denying attempt to execute specific process", severity: High)
endprocess
endapp
Detect forking any process with a specific name
Unix
app("Process forking mod 3"):
requires(version: ARMR/2.7)
process("Detect all attempts to execute myscript.sh"):
execute("myscript.sh")
detect(message: "myscript.sh file executed", severity: Low)
endprocess
endapp
Windows
app("Process forking mod 3"):
requires(version: ARMR/2.7)
process("Detect all attempts to execute myscript.bat"):
execute("myscript.bat")
detect(message: "myscript.bat file executed", severity: Low)
endprocess
endapp
Prevent forking all processes, except allow specific process
Unix
app("Process forking mod 4"):
requires(version: ARMR/2.7)
process("Prevent all process forking"):
execute("*")
protect(message: "denying attempt to execute any external process", severity: 7)
endprocess
process("Allow forking of specific process"):
execute("/tmp/myscript.sh")
allow(message: "allowing specific exectuable", severity: 3)
endprocess
endapp
Windows
app("Process forking mod 4"):
requires(version: ARMR/2.7)
process("Prevent all process forking"):
execute("*")
protect(message: "denying attempt to execute any external process", severity: 7)
endprocess
process("Allow forking of specific process"):
execute("C:\\Windows\\myscript.bat")
allow(message: "allowing specific exectuable", severity: 3)
endprocess
endapp
Logging On/Off Example
In the following example, logging is switched ON in the protect rule by the inclusion of the protect action message attribute. As the message attribute is defined as an empty string (""), a default message will be included in the security event msg extension. The allow rule allows forking of the specified process. Logging is switched OFF in the allow rule by the omission of the action message attribute.
app("Process forking mod 5"):
requires(version: ARMR/2.7)
process("Prevent all process forking. Logging ON"):
execute("*")
protect(message: "", severity: 7)
endprocess
process("Allow forking of specific process. Logging OFF"):
execute("/tmp/myscript.sh")
allow(severity: 3)
endprocess
endapp