False positive "Trojaned version of file '/bin/diff' detected" on Archlinux #2020

tiiiecherle · 2021-10-24T11:58:33Z

Hey Ossec Team,

with the latest version diffutils 3.8-1 installed ossec reports a trojaned version of a few files.

OSSEC HIDS Notification.
2021 Oct 22 10:22:02

Received From: archvbox->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

Trojaned version of file '/bin/diff' detected. Signature used: 'bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh' (Generic).



--END OF NOTIFICATION



OSSEC HIDS Notification.
2021 Oct 22 10:22:02

Received From: archvbox->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

Trojaned version of file '/sbin/diff' detected. Signature used: 'bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh' (Generic).



--END OF NOTIFICATION



OSSEC HIDS Notification.
2021 Oct 22 10:22:02

Received From: archvbox->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

Trojaned version of file '/usr/bin/diff' detected. Signature used: 'bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh' (Generic).



--END OF NOTIFICATION



OSSEC HIDS Notification.
2021 Oct 22 10:22:02

Received From: archvbox->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

Trojaned version of file '/usr/sbin/diff' detected. Signature used: 'bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh' (Generic).

I opened an issue at the archlinux bug tracker here:
https://bugs.archlinux.org/task/72519#comment203202

When testing the files against virustotal database nothing suspicious is reported and the checksum seems fine.

Changing the diff line in rootkit_trojans.txt to diff !bash|^/bin/sh|file\.h|proc\.h|^/bin/.*sh! solves the reporting.

I assume it is a false positive and after confirming the rootkit_trojans.txt should be changed.

Thanks in advance

The text was updated successfully, but these errors were encountered:

RonV666 · 2021-11-14T16:31:32Z

MKPlato · 2022-09-07T01:46:34Z

Any updates on this issue? The bug still exists now.

/bin/diff returns /dev/full on fedora, so remove the /dev check

ddpbsd · 2022-09-07T14:05:15Z

Please test PR #2062
I think it will handle this.

rileyjnevins · 2022-10-31T19:32:23Z

Just experienced this issue on several Ubuntu hosts of mine:

SedonD · 2022-12-31T15:16:15Z

I agree with the others, we are experiencing this:
(Ubuntu 22.04 server)

Wazuh Alert: 'Host-based anomaly detection event (rootcheck).'

DETAILS
Description: 'Host-based anomaly detection event (rootcheck).' Log: 'Trojaned version of file /usr/bin/diff detected. Signature used: bash ^/bin/sh file/.h proc/.h /dev/[^n] ^/bin/.*sh (Generic).' Rule: '510' location: 'rootcheck'

kamalmjt · 2023-01-01T17:34:28Z

Same problem.

{
"agent": {
"ip": "xxx",
"name": "xxx",
"id": "004"
},
"manager": {
"name": "xxxx"
},
"data": {
"file": "/bin/diff",
"title": "Trojaned version of file detected."
},
"rule": {
"firedtimes": 1,
"mail": false,
"level": 7,
"pci_dss": [
"10.6.1"
],
"description": "Host-based anomaly detection event (rootcheck).",
"groups": [
"ossec",
"rootcheck"
],
"id": "510",
"gdpr": [
"IV_35.7.d"
]
},
"decoder": {
"name": "rootcheck"
},
"full_log": "Trojaned version of file '/bin/diff' detected. Signature used: 'bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh' (Generic).",
"input": {
"type": "log"
},
"@timestamp": "2023-01-01T08:20:04.988Z",
"location": "rootcheck",
"id": "1672561204.10642855",
"timestamp": "2023-01-01T08:20:04.988+0000",
"_id": "nU9qbIUBLJew7AZ0p-A5"
}

Practicalbutterfly5 · 2023-01-12T18:30:53Z

Too many notifications of this

lemogra · 2023-02-03T14:48:31Z

this issus still continues as below
Wazuh Notification.
2023 Feb 03 14:41:32

Received From: siem1->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

fstrube · 2023-02-06T00:51:24Z

I think the issue may be due to a reverence to /dev/full in the diff executable.

# strings /bin/diff | grep /dev/[^n]
/dev/full

I made a change in /var/ossec/etc/shared/rootkit_trojans.txt to the following line to see if that fixes the issue:

-diff        !bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh!
+diff        !bash|^/bin/sh|file\.h|proc\.h|/dev/[^nf]|^/bin/.*sh!

ngisvold · 2023-03-20T00:06:56Z

Any update on this?

ll3N1GmAll · 2023-03-20T08:46:48Z

This is still happening on Linux Mint 21

"timestamp":"2023-03-19T14:54:44.046+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":2,"mail":true,"groups":["ossec","rootcheck"],"gdpr":["IV_35.7.d"]},"agent":{"id":"027","name":"Mint21","ip":"192.168.1.19"},"manager":{"name":"secon-server-wazuh-manager"},"id":"1679237684.3782962","full_log":"Trojaned version of file '/usr/bin/diff' detected. Signature used: 'bash|^/bin/sh|file\.h|proc\.h|/dev/[^n]|^/bin/.*sh' (Generic).","decoder":{"name":"rootcheck"},"data":{"title":"Trojaned version of file detected.","file":"/usr/bin/diff"},"location":"rootcheck"}

Fix issue #2020

ddpbsd · 2023-03-20T13:28:19Z

I never got any responses to the PR, but I've merged it. Hopefully it helps.

fuomag9 · 2023-03-20T16:59:50Z

Still happening to macOS as well

troublestarter · 2023-03-22T22:07:02Z

Happening on Debian 11 with Wazuh v4.3.10

Practicalbutterfly5 · 2023-03-29T01:24:46Z

Wazuh 4.4.0 and still happening ....
Ubuntu 22.04 arm64

serfermorhc · 2023-04-20T15:54:24Z

Same here

y0d4a · 2023-04-26T07:43:18Z

can confirm same, latest ver. of wazuh

pleibling · 2023-05-16T09:12:14Z

Same, Wazuh 4.4.1 and Ubuntu Server minimal 22.04 (all updates).

Any News?

titleistfour · 2023-05-24T16:29:20Z

I have this issue with /usr/bin/mail on RHEL 9 and Wazuh 4.4.1.

gand0rf · 2023-07-21T22:34:17Z

Wanted to leave an update.
wazuh-manager version 4.4.5
wazuh-agent version 4.4.5

Files Indicated:
/bin/diff
/usr/bin/diff

Going to try fstrube edit to rootkit_trojans.txt

iNimbleSloth · 2023-07-25T15:03:09Z

Receiving the same.

wazuh-manager version 4.4.5 running on an Ubuntu 22.04.2 LTS virtual machine.
wazuh-agent version 4.4.5 also running on an Ubuntu 22.04.2 LTS virtual machine (different VM from above).

kayo77 · 2023-08-25T07:47:13Z

Receiving the same.
on Debian 12.1 with wazuh-agent 4.5.0

troublestarter · 2023-08-25T07:51:17Z

I think nobody work on this ...

arf20 · 2023-08-25T14:39:30Z

Getting the same notification on Debian 12, wazuh 4.5.1

33b5e5 · 2023-08-29T08:06:49Z

In lieu of a proper fix, this will silence the alert from Wazuh on Debian/Ubuntu:

sudo vi /var/ossec/etc/rules/local_rules.xml

Add something like:

<group name="rootcheck,ossec,">
  <rule id="510" level="0" overwrite="yes">
    <match>/bin/diff</match>
    <description>Ignore 510 rootcheck on /bin/diff</description>
  </rule>
</group>

Test the changes:

sudo /var/ossec/bin/wazuh-analysisd -t

If it looks good restart:

sudo systemctl restart wazuh-manager.service

troublestarter · 2023-08-29T08:19:17Z

Hi @33b5e5

Thanks for the workaround.

But it disable the check on /bin/diff ?

Should be great if it would work as exepected :)

Thanks again that said

earthyfort · 2023-09-18T02:51:03Z

Is there any news about this?

dibu28 · 2023-09-19T08:49:39Z

vinsk0h · 2023-09-21T18:14:37Z

0xr00tx · 2023-10-03T08:15:00Z

Same issue with Agent v4.5.2 and Debian 12

lpingree · 2023-10-05T20:36:59Z

Seeing this on several of my linux machines.

moivica · 2023-10-06T11:47:28Z

Same issue active - ubuntu 23.04

sjansen1 · 2023-10-10T11:29:06Z

Seeing this on my Proxmox Hosts (based on Debian 12 Bookworm)

edxz101 · 2023-10-16T22:35:31Z

Same issue on Ubuntu 22.04 (at the date).

pld0vr · 2023-10-17T01:18:26Z

Also seeing this

pthoelken · 2023-10-17T11:53:17Z

Still exists, please fix this ugg.

alexeiol · 2023-11-02T15:48:37Z

2 years later this bug is still unfixed! I'm getting the same alert in Debian Bookworm and Ossec v3.7.0:

OSSEC HIDS Notification.
2023 Nov 02 12:18:09

Received From: debianvaio->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

--END OF NOTIFICATION

Looking at the bright size, it is good to know this is a false positive.

ddpbsd · 2023-11-02T19:45:57Z

This has been fixed in tree for a while. I'm kind of regretting it though, it's easy enough to fix with an ignore rule. Right now if diff is trojaned and has a reference to /dev on a non-linux system it won't be caught.
Here's the current definition though:
diff !bash|^/bin/sh|file\.h|proc\.h|^/bin/.*sh!

alexeiol · 2023-11-02T22:36:14Z

This has been fixed in tree for a while. I'm kind of regretting it though, it's easy enough to fix with an ignore rule. Right now if diff is trojaned and has a reference to /dev on a non-linux system it won't be caught. Here's the current definition though: diff !bash|^/bin/sh|file\.h|proc\.h|^/bin/.*sh!

But this "fix" is not really a "fix" because... What if 'diff' ever becomes legitimately infected? People install security software because they have legitimate security concerns. A false positive detection is a bug in the software and that's what should be fixed.

ddpbsd · 2023-11-02T23:56:18Z

How do you expect to check for the presence of /dev but not alert on the presence of /dev?

…

On Thu, Nov 2, 2023 at 6:36 PM alexeiol ***@***.***> wrote: This has been fixed in tree for a while. I'm kind of regretting it though, it's easy enough to fix with an ignore rule. Right now if diff is trojaned and has a reference to /dev on a non-linux system it won't be caught. Here's the current definition though: diff !bash|^/bin/sh|file\.h|proc\.h|^/bin/.*sh! But this "fix" is not really a "fix" because... What if 'diff' ever becomes legitimately infected? People install security software because they have legitimate security concerns. A false positive detection is a bug in the software and that's what should be fixed. — Reply to this email directly, view it on GitHub <#2020 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGAZNNKKJITIUJT5EWU4ZTYCQN6VAVCNFSM5GTMCKYKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCNZZGE3DKNRSG44A> . You are receiving this because you commented.Message ID: ***@***.***>

JackThird · 2023-11-08T10:28:44Z

same here, ubuntu server 22.04, wazuh 4.5.4

moivica · 2023-11-09T07:45:42Z

Same problem: Wazuh v 4.6.0
Ubuntu 23.04

Dmitry-Ge · 2023-11-09T11:40:35Z

Debian 12 , ossec-hids-agent_3.7.0-29672bookworm_amd64.deb - same problem.

jdmedeiros · 2023-11-09T15:43:00Z

Same problem: AWS AL2023
Linux xxxxxxxxxxx 6.1.59-84.139.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Oct 24 20:57:25 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
{"error":0,"data":[{"WAZUH_VERSION":"v4.6.0"},{"WAZUH_REVISION":"40603"},{"WAZUH_TYPE":"server"}]}

markgabrang · 2023-11-10T04:05:25Z

Same on Ubuntu 22.04 hosts, v4.6.0

"decoder": {
  "name": "rootcheck"
},
"id": "1699540605.90066869",
"full_log": "Trojaned version of file '/usr/bin/diff' detected. Signature used: 'bash|^/bin/sh|file\\.h|proc\\.h|/dev/[^n]|^/bin/.*sh' (Generic).",
"timestamp": "2023-11-09T14:36:45.727+0000"

RandomUser0815 · 2023-11-16T21:26:24Z

Same on Ubuntu 22.04, Wazuh v4.5.3

kawaiipantsu · 2023-11-18T15:01:33Z

Bump ... Still issue!

pisarz77 · 2023-11-22T15:54:42Z

same on current debian 12

redrubytech · 2023-11-27T06:42:59Z

Bump. still same issue on Ubuntu 22.04 with Wazuh 4.6

iXvXi · 2023-12-03T01:47:13Z

This is event is on my host wazuh server running Ubuntu 22.04.3 LTS

dariosusman · 2023-12-04T14:31:30Z

This is also happening on Debian Bookworm. I've checked with other installations and the hash is correct.

4de429713337777f44e9ef340176c2f1818c2fcfe0204ab27277595ff97dab77  /bin/diff
# sha256sum /usr/bin/diff
4de429713337777f44e9ef340176c2f1818c2fcfe0204ab27277595ff97dab77  /usr/bin/diff

Relevant Wazuh/OSSEC log:

"full_log": "Trojaned version of file '/usr/bin/diff' detected. Signature used: 'bash|^/bin/sh|file\\.h|proc\\.h|/dev/[^n]|^/bin/.*sh' (Generic).", "decoder": {"name": "rootcheck"}, "data": {"title": "Trojaned version of file detected.", "file": "/usr/bin/diff"}, "location": "rootcheck"

I'm currently using Wazuh 4.7.0.

duckietm · 2023-12-05T10:51:59Z

same here 4.7.0. with ubuntu 22.04

atomicturtle · 2023-12-05T15:15:11Z

This is corrected in the main branch, to update you can use:

OUM users: update your signatures with: oum -u
Manual: copy https://github.com/ossec/ossec-hids/blob/master/src/rootcheck/db/rootkit_trojans.txt to /var/ossec/etc/shared/ on your hub server.
upgrade from source out of master

Nono-m0le mentioned this issue Jul 13, 2022

False positive : Trojaned version of file '/bin/diff' detected on Ubuntu 22 #2057

Open

ddpbsd added a commit to ddpbsd/ossec-hids that referenced this issue Sep 7, 2022

Fix issue ossec#2020

aca813e

/bin/diff returns /dev/full on fedora, so remove the /dev check

ddpbsd added a commit that referenced this issue Mar 20, 2023

Merge pull request #2062 from ddpbsd/issue2020

bf797c7

Fix issue #2020

dimagow mentioned this issue Sep 29, 2023

Trojaned version of file '/bin/diff' detected wazuh/wazuh#19346

Closed

ossec locked as resolved and limited conversation to collaborators Dec 5, 2023

atomicturtle closed this as completed Dec 5, 2023

False positive "Trojaned version of file '/bin/diff' detected" on Archlinux #2020

False positive "Trojaned version of file '/bin/diff' detected" on Archlinux #2020

Comments

tiiiecherle commented Oct 24, 2021 • edited Loading

RonV666 commented Nov 14, 2021

MKPlato commented Sep 7, 2022

ddpbsd commented Sep 7, 2022

rileyjnevins commented Oct 31, 2022

SedonD commented Dec 31, 2022 • edited Loading

kamalmjt commented Jan 1, 2023 • edited Loading

Practicalbutterfly5 commented Jan 12, 2023

lemogra commented Feb 3, 2023

fstrube commented Feb 6, 2023

ngisvold commented Mar 20, 2023

ll3N1GmAll commented Mar 20, 2023

ddpbsd commented Mar 20, 2023

fuomag9 commented Mar 20, 2023

troublestarter commented Mar 22, 2023

Practicalbutterfly5 commented Mar 29, 2023

serfermorhc commented Apr 20, 2023

y0d4a commented Apr 26, 2023

pleibling commented May 16, 2023

titleistfour commented May 24, 2023

gand0rf commented Jul 21, 2023

iNimbleSloth commented Jul 25, 2023

kayo77 commented Aug 25, 2023

troublestarter commented Aug 25, 2023

arf20 commented Aug 25, 2023

33b5e5 commented Aug 29, 2023 • edited Loading

troublestarter commented Aug 29, 2023

earthyfort commented Sep 18, 2023

dibu28 commented Sep 19, 2023 • edited Loading

vinsk0h commented Sep 21, 2023

0xr00tx commented Oct 3, 2023

lpingree commented Oct 5, 2023

moivica commented Oct 6, 2023

sjansen1 commented Oct 10, 2023

edxz101 commented Oct 16, 2023

pld0vr commented Oct 17, 2023

pthoelken commented Oct 17, 2023

alexeiol commented Nov 2, 2023

ddpbsd commented Nov 2, 2023

alexeiol commented Nov 2, 2023

ddpbsd commented Nov 2, 2023 via email

JackThird commented Nov 8, 2023

moivica commented Nov 9, 2023

Dmitry-Ge commented Nov 9, 2023

jdmedeiros commented Nov 9, 2023

markgabrang commented Nov 10, 2023

RandomUser0815 commented Nov 16, 2023 • edited Loading

kawaiipantsu commented Nov 18, 2023

pisarz77 commented Nov 22, 2023

redrubytech commented Nov 27, 2023

iXvXi commented Dec 3, 2023

dariosusman commented Dec 4, 2023 • edited Loading

duckietm commented Dec 5, 2023

atomicturtle commented Dec 5, 2023

tiiiecherle commented Oct 24, 2021 •

edited

Loading

SedonD commented Dec 31, 2022 •

edited

Loading

kamalmjt commented Jan 1, 2023 •

edited

Loading

33b5e5 commented Aug 29, 2023 •

edited

Loading

dibu28 commented Sep 19, 2023 •

edited

Loading

RandomUser0815 commented Nov 16, 2023 •

edited

Loading

dariosusman commented Dec 4, 2023 •

edited

Loading