linux_auditd_detection

detections/endpoint/linux_auditd_service_restarted.yml

@@ -0,0 +1,69 @@
+name: Linux Auditd Service Restarted
+id: 8eb3e858-18d3-44a4-a514-52cfa39f154a
+version: 1
+date: '2024-08-09'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the restarting or re-enabling of services
+  on Linux systems using the `systemctl` or `service` commands. It leverages data
+  from Endpoint Detection and Response (EDR) agents, focusing on process and command-line
+  execution logs. This activity is significant as adversaries may use it to maintain
+  persistence or execute unauthorized actions. If confirmed malicious, this behavior
+  could lead to repeated execution of malicious payloads, unauthorized access, or
+  data destruction. Security analysts should investigate these events to mitigate
+  risks and prevent further compromise.
+data_source:
+- Linux Auditd Proctitle
+search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where (LIKE(process_exec,
+  "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "%restart%")
+  OR LIKE(process_exec, "%reenable%") OR LIKE(process_exec, "%reload%")) | stats count
+  min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process complete command-line executions.
+  These logs must be processed using the appropriate Splunk Technology Add-ons that
+  are specific to the EDR product. Use the Splunk Common Information Model (CIM) to
+  normalize the field names and speed up the data modeling process.
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+references:
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - AwfulShred
+  - Linux Privilege Escalation
+  - Linux Living Off The Land
+  - Data Destruction
+  - Linux Persistence Techniques
+  - Scheduled Tasks
+  - Gomir
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: $process_exec$ event occurred on host.
+  mitre_attack_id:
+  - T1053.006
+  - T1053
+  observable:
+  - name: process_exec
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - proctitle
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/linux_services_restart/linux_services_restart.log
+    source: /var/log/audit/audit.log
+    sourcetype: linux:audit

detections/endpoint/linux_auditd_stop_services.yml

@@ -0,0 +1,67 @@
+name: Linux Auditd Stop Services
+id: 43bc9281-753b-4743-b4b7-60af84f085f3
+version: 1
+date: '2024-08-09'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+description: The following analytic detects attempts to stop or clear a service on
+  Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents,
+  focusing on processes like "systemctl," "service," and "svcadm" executing stop commands.
+  This activity is significant as adversaries often terminate security or critical
+  services to disable defenses or disrupt operations, as seen in malware like Industroyer2.
+  If confirmed malicious, this could lead to the disabling of security mechanisms,
+  allowing attackers to persist, escalate privileges, or deploy destructive payloads,
+  severely impacting system integrity and availability.
+data_source:
+- Linux Auditd Service Stop
+search: '`linux_auditd` type=SERVICE_STOP | stats count min(_time) as firstTime max(_time)
+  as lastTime by type pid UID comm exe | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `linux_auditd_stop_services_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process complete command-line executions.
+  These logs must be processed using the appropriate Splunk Technology Add-ons that
+  are specific to the EDR product. Use the Splunk Common Information Model (CIM) to
+  normalize the field names and speed up the data modeling process.
+known_false_positives: Administrator or network operator can use this application
+  for automation purposes. Please update the filter macros to remove false positives.
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+- https://cert.gov.ua/article/39518
+tags:
+  analytic_story:
+  - AwfulShred
+  - Data Destruction
+  - Industroyer2
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: a service stop event occured on host.
+  mitre_attack_id:
+  - T1489
+  observable:
+  - name: type
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - type
+  - pid
+  - UID
+  - comm
+  - exe
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log
+    source: /var/log/audit/audit.log
+    sourcetype: linux:audit