Project-LION-Longcheer-Integrated-Overlay-Network-Virtualizaci-n-pKVM-y-SystemUI/VQL-Artifact.yaml at main · lexs201992-gif/Project-LION-Longcheer-Integrated-Overlay-Network-Virtualizaci-n-pKVM-y-SystemUI · GitHub
//blob/show" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
lexs201992-gif
Project-LION-Longcheer-Integrated-Overlay-Network-Virtualizaci-n-pKVM-y-SystemUI
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
FilesExpand file tree
main
/VQL-Artifact.yaml
Copy path
Blame<br>More file actions
Blame<br>More file actions
Latest commit
History<br>History<br>History
53 lines (48 loc) · 1.55 KB
main
/VQL-Artifact.yaml
Copy path
Top
File metadata and controls<br>Code
Blame
53 lines (48 loc) · 1.55 KB
Raw<br>Copy raw file<br>Download raw file
Open symbols panelEdit and raw actions
10<br>11<br>12<br>13<br>14<br>15<br>16<br>17<br>18<br>19<br>20<br>21<br>22<br>23<br>24<br>25<br>26<br>27<br>28<br>29<br>30<br>31<br>32<br>33<br>34<br>35<br>36<br>37<br>38<br>39<br>40<br>41<br>42<br>43<br>44<br>45<br>46<br>47<br>48<br>49<br>50<br>51<br>52<br>53
name: Custom.Detect.Longcheer.LION.Kernel.Compromise
description: Detecta indicadores de compromiso del kernel relacionados con Project LION (WireGuard, nd_pmem, MACsec) en dispositivos Android/Unisoc.
author: Alex de la Cruz (lexs201992-gif)
parameters:
- name: DeviceType
default: "Android_Unisoc_T606"
queries:
- name: Check_Kernel_Modules_and_Drivers
query: |
SELECT
Process,
Module,
Status,
"Kernel Module Compromise" as DetectionType
FROM proc_modules()
WHERE Module =~ "wireguard|nd_pmem|macsec|cdc_ncm|cdc_ether"
- name: Check_Dmesg_for_Rescue_Party_Abuse
query: |
SELECT
Line,
"Remote Rescue Vector Detected" as DetectionType
FROM dmesg()
WHERE Line =~ "WireGuard 1.0.0 loaded|nd_pmem|namespace 0.0|macsec|tun0|tap0|qogirl6"
- name: Check_Network_Interfaces_Anomalies
query: |
SELECT
Name,
State,
"Anomalous Tunnel Interface" as DetectionType
FROM ifconfig()
WHERE Name =~ "tun0|wg0" AND State =~ "UP"
- name: Check_Persistent_Memory_Namespaces
query: |
SELECT
Device,
Namespace,
"Persistent Memory Abuse Detected" as DetectionType
FROM ndctl_list_namespaces()
WHERE Namespace =~ "0.0" OR Device =~ "nd_pmem"
- name: Check_Longcheer_Sidebar_Process
query: |
SELECT
pid,
name,
cmdline,
"LION Sidebar Process Detected" as DetectionType
FROM pslist()
WHERE name =~ "com.longcheer.sidebar|com.longcheer.SarControl"
You can’t perform that action at this time.