remove detections aalready covered

detections/endpoint/detect_autosuid_post_exploitation_tool.yml

@@ -1,61 +0,0 @@
-name: Detect AutoSUID post exploitation tool
-id: 0edd5862-56c9-11ec-b990-acde48001122
-version: 1
-date: '2021-12-06'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: This search, detects Linux post exploitation tool AutoSUID, which is
-  an a tool that searches for SUID executables files in order to escalate privileges.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process = "find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )"
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_autosuid_post_exploitation_tool_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Unless an administrator is using these commands to troubleshoot
-  or audit a system, the execution of these commands should be monitored.
-references:
-- https://attack.mitre.org/matrices/enterprise/linux/
-- https://github.com/IvanGlinkin/AutoSUID
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 90
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
-  impact: 90
-  kill_chain_phases:
-  - Exploitation
-  message: AutoSUID post exploitation tool detected on $dest$
-  mitre_attack_id:
-  - T1069
-  - T1222
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 81
-  security_domain: endpoint

detections/endpoint/detect_linenum_execution.yml

@@ -1,70 +0,0 @@
-name: Detect LinEnum execution
-id: 570e5278-5479-11ec-89c8-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: LinEnum is a bash script that performs discovery commands for accounts,
-  processes, kernel version, applications, services, and uses the information from
-  these commands to present operator with ways of escalating privileges or further
-  exploitation of targeted host.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.process = "grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
-    by Processes.dest Processes.user Processes.parent_process_name Processes.process_current_directory
-    Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  `detect_linenum_execution_filter` '
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Very rare to perform such an extensive grep on a system, however
-  certain monitoring tools can produce similar results. It is important if monitoring
-  tools are in place to verify what is the actual process directory of execution.
-references:
-- https://github.com/rebootuser/LinEnum
-- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 90
-  context:
-  - Source: endpoint
-  - Stage: discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
-  impact: 50
-  kill_chain_phases:
-  - Privilege Escalation
-  message: LinEnum post exploitation tool detectedonn $dest$
-  mitre_attack_id:
-  - T1087
-  - T1069
-  - T1083
-  - T1057
-  - T1518
-  - T1082
-  - T1016
-  - T1033
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 45
-  security_domain: endpoint

detections/endpoint/detect_linpeas_execution.yml

@@ -1,67 +0,0 @@
-name: Detect LinPeas Execution
-id: 4ea6fa10-547c-11ec-a4f9-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto, Eric McGinnis
-type: TTP
-datamodel:
-- Endpoint
-description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script
-  that searches for possible paths to escalate privileges.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process= "grep -Ev ._history.|.bashrc|.bluemix|.cer|.cloudflared|.crt|.csr|.db|.der|.env|.erlang.cookie|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd|.irssi|.jks|.k5login|.kdbx|.key|.keyring|.keystore|.ldaprc|.lesshst|.mozilla|.msmtprc|.ovpn|.p12|.pem|.pfx|.pgp|.plan|.profile|.pypirc|.rdg|.recently-used.xbel|.rhosts|.secrets.mkey|.service|.socket|.sqlite|.sqlite3|.sudo_as_admin_successful|.svn|.swp|.timer|.vault-token|.viminfo|.vnc|.wgetrc" OR Processes.process="find /var/log/ /private/var/log -type f -exec grep -R -a -E -o (25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) {} ;" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid| `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `detect_linpeas_execution_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: This search may produce false positives as it will display
-  many sudo executed processess however, the cve-list within the command line it is
-  a clear indicator, operator is searching for local vulnerabilites.
-references:
-- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
-- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
-- https://attack.mitre.org/matrices/enterprise/linux/
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  confidence: 100
-  context:
-  - Source: endpoint
-  - Stage: discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
-  impact: 90
-  kill_chain_phases:
-  - Exploitation
-  - Privilege Escalation
-  message: LinPEAS post exploitation tool detected on $dest$
-  mitre_attack_id:
-  - T1082
-  - T1083
-  - T1033
-  - T1087
-  - T1046
-  - T1057
-  - T1518
-  - T1033
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 90
-  security_domain: endpoint

tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml

@@ -1,12 +0,0 @@
-name: Detect AutoSUID post exploitation tool Unit Test
-tests:
-- name: Detect AutoSUID post exploitation tool
-  file: endpoint/detect_autosuid_post_exploitation_tool.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: autoSUID.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"

tests/endpoint/detect_linenum_execution.test.yml

@@ -1,12 +0,0 @@
-name: Detect LinEnum execution unit Test
-tests:
-- name: Detect LinEnum execution
-  file: endpoint/detect_linenum_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: LinuxEnumd.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"

tests/endpoint/detect_linpeas_execution.test.yml

@@ -1,12 +0,0 @@
-name: Detect LinPeas Execution Unit Test
-tests:
-- name: Detect LinPeas Execution
-  file: endpoint/detect_linpeas_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: linpeasdataset.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"

tests/endpoint/suspcious_linux_discovery_commands.test.yml

@@ -0,0 +1,12 @@
+name: Suspcious Linux Discovery Commands
+tests:
+- name: Linux Possible Access To Sudoers File
+  file: endpoint/suspcious_linux_discovery_commands.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux