From 39f00e42bebb68bc4f24b40c1f3067d0fc9e18c3 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 26 Jan 2023 09:42:46 +0100 Subject: [PATCH 1/3] minor-update-lnx --- detections/endpoint/linux_service_restarted.yml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index 73c8c419da..4e91d98a21 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -6,15 +6,13 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for restarted or re-enable services in linux platform. - This technique can be executed or performed using systemctl or service tool application. - Adversaries may create or modify Windows services to repeatedly execute malicious - payloads as part of persistence. When Windows boots up, it starts programs or applications - called services that perform background system functions. Administrator may also - create a legitimated service for a specific tool or normal application as part of - task or automation, in this scenario it is suggested to look for the service path - of the actual script or executable that register as service and who created the - service for further verification. +description: This analytic looks for restarted or re-enable services in the linux platform. + This technique can be executed or performed using “systemctl” or service tool application. + Adversaries may create or modify Linux services to repeatedly execute malicious payloads as part of persistence. + When the linux host boots up, it starts programs or applications called services that perform background system functions. + Administrator may also create a legitimated service for a specific tool or normal application as part of task or automation, + in this scenario it is suggested to look for the service path of the actual script or executable that registered as service + and who created the service for further verification. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process From af0333c45ce0f2eec590ff6c621b4acc256fc558 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 26 Jan 2023 09:47:38 +0100 Subject: [PATCH 2/3] Update linux_service_restarted.yml --- detections/endpoint/linux_service_restarted.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index 4e91d98a21..0d330ec234 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: This analytic looks for restarted or re-enable services in the linux platform. - This technique can be executed or performed using “systemctl” or service tool application. + This technique can be executed or performed using systemctl or service tool application. Adversaries may create or modify Linux services to repeatedly execute malicious payloads as part of persistence. When the linux host boots up, it starts programs or applications called services that perform background system functions. Administrator may also create a legitimated service for a specific tool or normal application as part of task or automation, From be97f1d620f399a6b431b9765bae3a0593b6291c Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Jan 2023 14:19:15 +0100 Subject: [PATCH 3/3] minor-update-lnx --- .../endpoint/windows_replication_through_removable_media.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index a9ee284978..5c6e457385 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -11,7 +11,7 @@ description: This analytic is developed to detect suspicious executable or scrip even red teamers to replicate or spread in possible removable drives. Back then, WORM malware was popular for this technique where it would drop a copy of itself in the root drive to be able to spread or to have a lateral movement in other network machines. Nowadays, Ransomware like CHAOS ransomware also use this - technique to spread its malicious code in possible removable drives. Thi TTP detection can be a good + technique to spread its malicious code in possible removable drives. This TTP detection can be a good indicator that a process might create a persistence technique or lateral movement of a targeted machine. We suggest checking the process name that creates this event, the file created, user type, and the reason why that executable or scripts are dropped in the root drive.