chores

QueComanTierra/detection/falco_response.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# falco_response.sh: Active response handler for QueComanTierra Falco rules
+#
+# Falco pipes JSON alerts here via program_output.
+# Per-rule actions:
+#   Bash Native TCP Exfiltration       → kill PID + ss --kill socket
+#   Shell Spawning OpenSSL Bulk Enc.   → kill PID (kills openssl + parent shell)
+#   Mass Document Deletion by Shell    → kill PID
+#   Hidden Encrypted Archive in Tmp    → kill PID + remove the .enc file
+#
+# IMPORTANT: runs as root (Falco requirement). Validate PIDs before killing.
+
+set -euo pipefail
+
+LOG="/var/log/falco-response.log"
+ALERT=$(cat)   # full JSON from Falco
+
+log() { echo "$(date -u +%FT%TZ) [RESPONSE] $*" | tee -a "$LOG" >&2; }
+
+rule=$(echo "$ALERT"    | jq -r '.rule')
+pid=$(echo "$ALERT"     | jq -r '.output_fields["proc.pid"] // empty')
+dst_ip=$(echo "$ALERT"  | jq -r '.output_fields["fd.rip"]  // empty')
+dst_port=$(echo "$ALERT"| jq -r '.output_fields["fd.rport"]// empty')
+file=$(echo "$ALERT"    | jq -r '.output_fields["fd.name"] // empty')
+user=$(echo "$ALERT"    | jq -r '.output_fields["user.name"]// empty')
+
+log "RULE='$rule' PID='$pid' USER='$user'"
+
+kill_pid() {
+    local p="$1"
+    # Validate: PID must be numeric and process must still exist
+    [[ "$p" =~ ^[0-9]+$ ]] || { log "PID inválido: $p"; return 1; }
+    [[ -d "/proc/$p" ]]    || { log "PID $p ya no existe"; return 0; }
+    log "KILL -9 $p ($(cat /proc/$p/cmdline | tr '\0' ' '))"
+    kill -9 "$p" && log "PID $p terminado" || log "No se pudo matar $p"
+}
+
+kill_socket() {
+    local ip="$1" port="$2"
+    [[ -n "$ip" && -n "$port" ]] || return 0
+    log "Cerrando socket TCP → $ip:$port"
+    # ss --kill requiere iproute2 >= 5.3
+    ss --kill state established dst "${ip}:${port}" 2>>"$LOG" \
+        && log "Socket $ip:$port cerrado" \
+        || log "ss --kill falló (¿iproute2 < 5.3?)"
+}
+
+case "$rule" in
+    "Bash Native TCP Exfiltration")
+        log "ACCIÓN: matar proceso + cerrar socket"
+        kill_pid "$pid"
+        kill_socket "$dst_ip" "$dst_port"
+        ;;
+
+    "Shell Spawning OpenSSL Bulk Encryption")
+        log "ACCIÓN: matar proceso openssl"
+        kill_pid "$pid"
+        ;;
+
+    "Mass Document Deletion by Shell Process")
+        log "ACCIÓN: matar proceso de borrado masivo"
+        kill_pid "$pid"
+        ;;
+
+    "Hidden Encrypted Archive Staged in Tmp")
+        log "ACCIÓN: matar proceso + eliminar vault"
+        kill_pid "$pid"
+        if [[ -n "$file" && "$file" == /tmp/*.enc && "$file" == /tmp/.* ]]; then
+            log "Eliminando vault cifrado: $file"
+            rm -f "$file" && log "Vault eliminado" || log "No se pudo eliminar $file"
+        fi
+        ;;
+
+    *)
+        log "Regla desconocida, sin acción automática: $rule"
+        ;;
+esac