From 0800a90171dd0237662690ae745700aac6992075 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 12 Aug 2024 12:45:05 +0200 Subject: [PATCH] linux_auditd_detection --- .../linux_auditd_service_restarted.yml | 69 +++++++++++++++++++ .../endpoint/linux_auditd_stop_services.yml | 67 ++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 detections/endpoint/linux_auditd_service_restarted.yml create mode 100644 detections/endpoint/linux_auditd_stop_services.yml diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml new file mode 100644 index 0000000000..afedced865 --- /dev/null +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -0,0 +1,69 @@ +name: Linux Auditd Service Restarted +id: 8eb3e858-18d3-44a4-a514-52cfa39f154a +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the restarting or re-enabling of services + on Linux systems using the `systemctl` or `service` commands. It leverages data + from Endpoint Detection and Response (EDR) agents, focusing on process and command-line + execution logs. This activity is significant as adversaries may use it to maintain + persistence or execute unauthorized actions. If confirmed malicious, this behavior + could lead to repeated execution of malicious payloads, unauthorized access, or + data destruction. Security analysts should investigate these events to mitigate + risks and prevent further compromise. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where (LIKE(process_exec, + "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "%restart%") + OR LIKE(process_exec, "%reenable%") OR LIKE(process_exec, "%reload%")) | stats count + min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - AwfulShred + - Linux Privilege Escalation + - Linux Living Off The Land + - Data Destruction + - Linux Persistence Techniques + - Scheduled Tasks + - Gomir + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1053.006 + - T1053 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/linux_services_restart/linux_services_restart.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml new file mode 100644 index 0000000000..0f5c062b65 --- /dev/null +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -0,0 +1,67 @@ +name: Linux Auditd Stop Services +id: 43bc9281-753b-4743-b4b7-60af84f085f3 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects attempts to stop or clear a service on + Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, + focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. + This activity is significant as adversaries often terminate security or critical + services to disable defenses or disrupt operations, as seen in malware like Industroyer2. + If confirmed malicious, this could lead to the disabling of security mechanisms, + allowing attackers to persist, escalate privileges, or deploy destructive payloads, + severely impacting system integrity and availability. +data_source: +- Linux Auditd Service Stop +search: '`linux_auditd` type=SERVICE_STOP | stats count min(_time) as firstTime max(_time) + as lastTime by type pid UID comm exe | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_stop_services_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +- https://cert.gov.ua/article/39518 +tags: + analytic_story: + - AwfulShred + - Data Destruction + - Industroyer2 + asset_type: Endpoint + confidence: 70 + impact: 70 + message: a service stop event occured on host. + mitre_attack_id: + - T1489 + observable: + - name: type + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - type + - pid + - UID + - comm + - exe + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log + source: /var/log/audit/audit.log + sourcetype: linux:audit