Atomic Arch — Arch Linux AUR Supply-Chain Attack (Rust Infostealer + eBPF Rootkit)

Looks for: an AUR build chain — makepkg/yay/paru/git as ancestor — where a compiler (cargo/rustc/cc) or its child reaches out to the network or a downloader. Accomplishes: the core build-time execution signal for Atomic Arch.

// HUNT: AUR build tooling spawning compiler that spawns network/downloader child
// MITRE: T1195.001, T1195.002, T1059.004 | CONF: high  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 (Linux) with command line + parent lineage
// FALSE POSITIVES: legitimate Rust crate builds that fetch deps via cargo/curl
// TUNING: scope to interactive dev hosts; baseline normal cargo-fetch parents; alert on curl/wget/nc under a build tree
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/i event_platform=Lin
| ParentBaseFileName=/^(makepkg|yay|paru|pacman|git|bash|sh)$/i
| ImageFileName=/\/(cargo|rustc|cc|gcc|clang|curl|wget|nc|ncat|bun|node|npm)$/i
| childNet := if(ImageFileName=/\/(curl|wget|nc|ncat)$/i, 1, 0)
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, childNet], limit=200)
| sort(@timestamp, order=desc)

Looks for: a binary executed out of an AUR build / package-helper cache / tmp path, especially one matching the src/hooks/deps drop location. FP: legitimate build artifacts run during testing — pair with Q1/Q3 lineage.

// HUNT: ELF executed from AUR build / cache / tmp dir (dropper exec, e.g. src/hooks/deps)
// MITRE: T1059.004, T1195.002 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 (Linux) with ImageFileName path
// FALSE POSITIVES: legit compiled binaries run from a build/test tree
// TUNING: prioritise paths matching src/hooks/deps; correlate with build parent (Q1)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/i event_platform=Lin
| ImageFileName=/(\/src\/hooks\/deps|\/\.cache\/(yay|paru|makepkg)\/|\/tmp\/[^\/]*\/src\/|\/pkg\/|\/build\/)/i
| ParentBaseFileName=/^(makepkg|yay|paru|pacman|bash|sh|cargo|rustc|cc)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: a build/dropper process touching SSH keys or cloud/dev credential files, or running a shell that cat/env-harvests secrets. Accomplishes: catches the credential-access stage independent of network egress.

// HUNT: build/dropper process reading SSH/cloud/dev credential files or env secrets
// MITRE: T1552.001, T1552.004 | CONF: high  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 (Linux) command line; file-read telemetry if available
// FALSE POSITIVES: legit tooling reading ~/.npmrc / ~/.aws during normal builds
// TUNING: weight ~/.ssh and cloud cred reads under a makepkg/cargo build tree; allow-list CI agents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/i event_platform=Lin
| CommandLine=/(\.ssh\/(id_|authorized_|known_)|\.aws\/credentials|\.config\/gcloud|\.kube\/config|\.npmrc|\.docker\/config|\.netrc|printenv|\benv\b)/i
| ParentBaseFileName=/^(makepkg|yay|paru|cargo|rustc|cc|bash|sh|deps)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: Tor exec, a loopback SOCKS proxy connect (9050/9150), or an upload to temp.sh originating from a process in a build lineage. FP: developers who legitimately run Tor — allow-list. Tor over loopback hides the true dst, so the proxy connect is the tell.

// HUNT: Tor / loopback-SOCKS proxy egress or temp.sh exfil from a dev endpoint
// MITRE: T1071, T1090, T1041 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 + NetworkConnectIP4 / DnsRequest (Linux)
// FALSE POSITIVES: legitimate Tor users; tools that POST to temp.sh
// TUNING: allow-list sanctioned Tor/proxy users; alert when the connecting proc has a build ancestor
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|NetworkConnectIP4|DnsRequest/i event_platform=Lin
| tor := if(ImageFileName=/\/tor$/i OR CommandLine=/\.onion|socks5|9050|9150/i, 1, 0)
| tmp := if(DomainName=/temp\.sh$/i OR CommandLine=/temp\.sh/i, 1, 0)
| tor=1 OR tmp=1
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, DomainName, RemoteAddressIP4, RemotePort], limit=200)
| sort(@timestamp, order=desc)

Looks for: a process writing or enabling a systemd unit (system or user scope) — the Restart=always persistence the stealer installs. Accomplishes: high-fidelity persistence detection with little benign baseline for a build-tree parent.

// HUNT: systemd unit creation/enable by a build/cache/dropper process (Restart=always persistence)
// MITRE: T1543.002 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 (Linux) command line; file-write telemetry if available
// FALSE POSITIVES: legit installers using systemctl enable — rare under a makepkg/deps parent
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/i event_platform=Lin
| CommandLine=/(systemctl\s+(enable|--user\s+enable)|\/etc\/systemd\/system\/|\.config\/systemd\/user\/|Restart=always)/i
| ParentBaseFileName=/^(makepkg|yay|paru|cargo|rustc|cc|bash|sh|deps)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: BPF program loading (bpftool prog load, libbpf-driven binaries, references to BPF_PROG_LOAD or the rootkit map names) by a process that is not a known system/observability tool. FP: falcon-sensor, systemd, observability agents — allow-list. ⚠ kernel BPF events not always emitted — confirm with Native N3

// HUNT: eBPF program load / pinned rootkit maps by a non-system process
// MITRE: T1014 | CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2 (Linux); kernel BPF telemetry where available (confirm via N3)
// FALSE POSITIVES: falcon-sensor, systemd, cilium/observability agents loading BPF legitimately
// TUNING: allow-list known BPF loaders by ImageFileName; alert on build-tree or /tmp parents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/i event_platform=Lin
| CommandLine=/(bpftool\s+prog\s+load|BPF_PROG_LOAD|bpf_prog_load|hidden_pids|hidden_names|hidden_inodes|\/sys\/fs\/bpf\/)/i
| ImageFileName!=/\/(falcon-sensor|falconctl|systemd|cilium-agent|tetragon)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: the exact known infostealer hash, or the build-output strings (atomic-lockfile, js-digest, src/hooks/deps) on the command line / image path. Accomplishes: a fast atomic sweep — perishable, so run alongside the behavioral hunts.

// HUNT: known Atomic Arch payload hash / build-string atomic match
// MITRE: T1195.002, T1059.004 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 (Linux) with SHA256HashData / ImageFileName / CommandLine
// FALSE POSITIVES: very low — hash is the specific sample; strings are distinctive
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/i event_platform=Lin
| SHA256HashData=/6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b/i
   OR CommandLine=/(atomic-lockfile|js-digest|src\/hooks\/deps)/i
   OR ImageFileName=/(atomic-lockfile|js-digest|src\/hooks\/deps)/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)