admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-08-26 10:01:48 -07:00
committed by GitHub
parent 2c685dd106 19b3efc01a
commit 22c7650bed
49 changed files with 1995 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_apt_get_privilege_escalation.yml
+77
View File
@@ -0,0 +1,77 @@
name: Linux apt-get Privilege Escalation
id: d870ce3b-e796-402f-b2af-cab4da1223f2
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The apt-get is a command line tool for interacting with the Advanced Package Tool (APT) library (a package management system for Linux distributions).
It allows you to search for, install, manage, update, and remove software. The tool does not build software from the source code.
If sudo right is given to the tool for user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt-get*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_apt_get_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/apt-get/
- https://phoenixnap.com/kb/how-to-use-apt-get-commands
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log
impact: 20
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 10
security_domain: endpoint
detections/endpoint/linux_apt_privilege_escalation.yml
+77
View File
@@ -0,0 +1,77 @@
name: Linux APT Privilege Escalation
id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: Advanced Package Tool, more commonly known as APT, is a collection of tools used to install, update, remove,
and otherwise manage software packages on Debian and its derivative operating systems, including Ubuntu and Linux Mint.
If sudo right is given to the tool for user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_apt_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/apt/
- https://www.digitalocean.com/community/tutorials/what-is-apt
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log
impact: 20
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 10
security_domain: endpoint
detections/endpoint/linux_at_allow_config_file_creation.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the file name, file path, and process_guid executions from your endpoints.
logs with the file name, file path, and process_guid executions from your endpoints into the Endpoint datamodel.
If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can create this file for
automation purposes. Please update the filter macros to remove false positives.
detections/endpoint/linux_at_application_execution.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
| `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: Administrator or network operator can use this application
for automation purposes. Please update the filter macros to remove false positives.
detections/endpoint/linux_awk_privilege_escalation.yml
+13 -5
View File
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
@@ -31,16 +31,16 @@ tags:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log
impact: 80
impact: 60
kill_chain_phases:
- Exploitation
message: A commandline $process$ with process $process_name$ on $dest$
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
@@ -51,6 +51,14 @@ tags:
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -64,5 +72,5 @@ tags:
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 72
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_busybox_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Busybox Privilege Escalation
id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides minimalist replacements for most of the utilities you usually find in GNU coreutils, util-linux, etc.
If sudo right is given to BusyBox application for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*busybox*" AND Processes.process="*sh*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_busybox_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/busybox/
- https://man.archlinux.org/man/busybox.1.en
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log
impact: 20
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 10
security_domain: endpoint
detections/endpoint/linux_c89_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux c89 Privilege Escalation
id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The c89 and cc commands compile, assemble, and link-edit C programs; the cxx or c++ command does the same for C++ programs. The c89 command should be used when compiling C programs that are written according to Standard C.
If sudo right is given to c89 application for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*c89*" AND Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_c89_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/c89/
- https://www.ibm.com/docs/en/zos/2.1.0?topic=guide-c89-compiler-invocation-using-host-environment-variables
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_c99_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux c99 Privilege Escalation
id: e1c6dec5-2249-442d-a1f9-99a4bd228183
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The c99 utility is an interface to the standard C compilation system; it shall accept source code conforming to the ISO C standard. The system conceptually consists of a compiler and link editor.
If sudo right is given to ruby application for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*c99*" AND Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_c99_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/c99/
- https://pubs.opengroup.org/onlinepubs/009604499/utilities/c99.html
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_composer_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Composer Privilege Escalation
id: a3bddf71-6ba3-42ab-a6b2-396929b16d92
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: Composer is a tool for dependency management in PHP. It allows you to declare the libraries your project depends on and it will manage (install/update) them for you.
If sudo right is given to tool for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*composer*" AND Processes.process="*run-script*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_composer_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/composer/
- https://getcomposer.org/doc/00-intro.md
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log
impact: 20
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 10
security_domain: endpoint
detections/endpoint/linux_cpulimit_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Cpulimit Privilege Escalation
id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: cpulimit is a simple program which attempts to limit the cpu usage of a process (expressed in percentage, not in cpu time). This is useful to control batch jobs, when you don't want them to eat too much cpu.
If sudo right is given to the program for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*cpulimit*" AND Processes.process="*-l*" AND Processes.process="*-f*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_cpulimit_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/cpulimit/
- http://cpulimit.sourceforge.net/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log
impact: 40
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 20
security_domain: endpoint
detections/endpoint/linux_csvtool_privilege_escalation.yml
+75
View File
@@ -0,0 +1,75 @@
name: Linux Csvtool Privilege Escalation
id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: csvtool is an easy to use command-line tool to work with .CSV files.
If sudo right is given to the tool for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*csvtool*" AND Processes.process="*call*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_csvtool_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/csvtool/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log
impact: 20
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 10
security_domain: endpoint
detections/endpoint/linux_docker_privilege_escalation.yml
+13 -5
View File
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
@@ -31,16 +31,16 @@ tags:
- CIS 3
- CIS 5
- CIS 16
confidence: 30
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log
impact: 80
impact: 10
kill_chain_phases:
- Exploitation
message: A commandline $process$ with process $process_name$ on $dest$
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
@@ -51,6 +51,14 @@ tags:
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -64,5 +72,5 @@ tags:
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 24
risk_score: 5
security_domain: endpoint
detections/endpoint/linux_emacs_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Emacs Privilege Escalation
id: 92033cab-1871-483d-a03b-a7ce98665cfc
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: EMACS is a family of text editors that are characterized by their extensibility.
The manual for the most widely used variant, GNU Emacs, describes it as "the extensible, customizable, self-documenting, real-time display editor".
If sudo right is given to EMACS tool for the user, then the user can run special commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*emacs*" AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_emacs_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/emacs/
- https://en.wikipedia.org/wiki/Emacs
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log
impact: 40
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 20
security_domain: endpoint
detections/endpoint/linux_find_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Find Privilege Escalation
id: 2ff4e0c2-8256-4143-9c07-1e39c7231111
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: Find is a command-line utility that locates files based on some user-specified criteria and either prints the
pathname of each matched object or, if another action is requested, performs that action on each matched object.
If sudo right is given to find utility for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*find*" AND Processes.process="*-exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_find_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
- https://gtfobins.github.io/gtfobins/find/
- https://en.wikipedia.org/wiki/Find_(Unix)
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log
impact: 10
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 5
security_domain: endpoint
detections/endpoint/linux_gdb_privilege_escalation.yml
+74
View File
@@ -0,0 +1,74 @@
name: Linux GDB Privilege Escalation
id: 310b7da2-ab52-437f-b1bf-0bd458674308
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: GDB is the acronym for GNU Debugger. This tool helps to debug the programs written in C, C++, Ada, Fortran, etc. The console can be opened using the gdb command on terminal.
If sudo right is given to GDB tool for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*gdb*" AND Processes.process="*-nx*" AND Processes.process="*-ex*!*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_gdb_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/gdb/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log
impact: 20
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 10
security_domain: endpoint
detections/endpoint/linux_gem_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Gem Privilege Escalation
id: 0115482a-5dcb-4bb0-bcca-5d095d224236
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: RubyGems is a package manager for the Ruby programming language that provides a standard format for distributing Ruby programs and libraries (in a self-contained format called a "gem"),
a tool designed to easily manage the installation of gems, and a server for distributing them.
If sudo right is given to GEM utility for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*gem*open*-e*" AND Processes.process="*-c*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_gem_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/gem/
- https://en.wikipedia.org/wiki/RubyGems
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log
impact: 20
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 10
security_domain: endpoint
detections/endpoint/linux_gnu_awk_privilege_escalation.yml
+75
View File
@@ -0,0 +1,75 @@
name: Linux GNU Awk Privilege Escalation
id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: gawk command in Linux is used for pattern scanning and processing language. The awk command requires no compiling and allows the user to use variables, numeric functions, string functions, and logical operators. It is a utility that enables programmers to write tiny and effective programs in the form of statements
that define text patterns that are to be searched for, in a text document and the action that is to be taken when a match is found within a line.
If sudo right is given to gawk tool for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*gawk*" AND Processes.process="*BEGIN*{system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_gnu_awk_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/gawk/
- https://www.geeksforgeeks.org/gawk-command-in-linux-with-examples/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_make_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Make Privilege Escalation
id: 80b22836-5091-4944-80ee-f733ac443f4f
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The Linux make command is used to build and maintain groups of programs and files from the source code. In Linux, it is one of the most frequently used commands by the developers.
It assists developers to install and compile many utilities from the terminal.
If sudo right is given to make utility for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*make*-s*" AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_make_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/make/
- https://www.javatpoint.com/linux-make-command
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log
impact: 40
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 20
security_domain: endpoint
detections/endpoint/linux_mysql_privilege_escalation.yml
+75
View File
@@ -0,0 +1,75 @@
name: Linux MySQL Privilege Escalation
id: c0d810f4-230c-44ea-b703-989da02ff145
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: MySQL is an open-source relational database management system.
Its name is a combination of "My", the name of co-founder Michael Widenius's daughter My, and "SQL", the abbreviation for Structured Query Language.
If sudo right is given to mysql utility for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*mysql*-e*" AND Processes.process="*\!**" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_mysql_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
- https://gtfobins.github.io/gtfobins/mysql/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_node_privilege_escalation.yml
+13 -4
View File
@@ -17,11 +17,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
- https://gtfobins.github.io/gtfobins/docker/
- https://en.wikipedia.org/wiki/Node.js
tags:
analytic_story:
- Linux Privilege Escalation
@@ -31,7 +32,7 @@ tags:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
@@ -40,7 +41,7 @@ tags:
impact: 80
kill_chain_phases:
- Exploitation
message: A commandline $process$ with process $process_name$ on $dest$
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
@@ -51,6 +52,14 @@ tags:
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -64,5 +73,5 @@ tags:
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 72
risk_score: 40
security_domain: endpoint
detections/endpoint/linux_octave_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Octave Privilege Escalation
id: 78f7487d-42ce-4f7f-8685-2159b25fb477
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: GNU Octave is a high-level programming language primarily intended for scientific computing and numerical computation. Octave helps in solving linear and nonlinear problems numerically, and for performing other numerical experiments using a language that is mostly compatible with MATLAB.
If sudo right is given to the application for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*octave-cli*" AND Processes.process="*--eval*" AND Processes.process="*system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_octave_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/octave/
- https://en.wikipedia.org/wiki/GNU_Octave
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log
impact: 40
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 20
security_domain: endpoint
detections/endpoint/linux_openvpn_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux OpenVPN Privilege Escalation
id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: OpenVPN is a virtual private network system that implements techniques to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It implements both client and server applications.
If sudo right is given to the OpenVPN application for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*openvpn*" AND Processes.process="*--dev*" AND Processes.process="*--script-security*" AND Processes.process="*--up*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_openvpn_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/openvpn/
- https://en.wikipedia.org/wiki/OpenVPN
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_php_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux PHP Privilege Escalation
id: 4fc4c031-e5be-4cc0-8cf9-49f9f507bcb5
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: PHP is a general-purpose scripting language geared toward web development.
It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1994. The PHP reference implementation is now produced by The PHP Group.
If sudo right is given to php application for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*php*-r*" AND Processes.process="*system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_php_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/php/
- https://en.wikipedia.org/wiki/PHP
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_puppet_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Puppet Privilege Escalation
id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: In computing, Puppet is a software configuration management tool which includes its own declarative language to describe system configuration. It is a model-driven solution that requires limited programming knowledge to use.
If sudo right is given to the tool for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*puppet*" AND Processes.process="*apply*" AND Processes.process="*-e*" AND Processes.process="*exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_puppet_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/puppet/
- https://en.wikipedia.org/wiki/Puppet_(software)
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log
impact: 10
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 5
security_domain: endpoint
detections/endpoint/linux_rpm_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux RPM Privilege Escalation
id: f8e58a23-cecd-495f-9c65-6c76b4cb9774
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: RPM Package Manager is a free and open-source package management system. The name RPM refers to the .rpm file format and the package manager program itself.
RPM was intended primarily for Linux distributions; the file format is the baseline package format of the Linux Standard Base.
If sudo right is given to rpm utility for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*rpm*--eval*" AND Processes.process="*lua:os.execute*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_rpm_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
- https://gtfobins.github.io/gtfobins/rpm/
- https://en.wikipedia.org/wiki/RPM_Package_Manager
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_ruby_privilege_escalation.yml
+75
View File
@@ -0,0 +1,75 @@
name: Linux Ruby Privilege Escalation
id: 097b28b5-7004-4d40-a715-7e390501788b
version: 1
date: '2022-08-09'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: Ruby is one of the most used and easy to use programming languages.
Ruby is an open-source, object-oriented interpreter that can be installed on a Linux system.
If sudo right is given to ruby application for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*ruby*-e*" AND Processes.process="*exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_ruby_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
- https://gtfobins.github.io/gtfobins/ruby/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
detections/endpoint/linux_sqlite3_privilege_escalation.yml
+76
View File
@@ -0,0 +1,76 @@
name: Linux Sqlite3 Privilege Escalation
id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1
version: 1
date: '2022-08-11'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: sqlite3 is a terminal-based front-end to the SQLite library that can evaluate queries interactively and display the results in multiple formats. sqlite3 can also be used within shell scripts and other applications to provide batch processing features.
If sudo right is given to this application for the user, then the user can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*sqlite3*" AND Processes.process="*.shell*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_sqlite3_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives may be present, filter as needed.
references:
- https://gtfobins.github.io/gtfobins/sqlite3/
- https://manpages.ubuntu.com/manpages/trusty/en/man1/sqlite3.1.html
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 30
security_domain: endpoint
tests/endpoint/linux_apt_get_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux apt-get Privilege Escalation Unit Test
tests:
- name: Linux apt-get Privilege Escalation
file: endpoint/linux_apt_get_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_apt_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux APT Privilege Escalation Unit Test
tests:
- name: Linux APT Privilege Escalation
file: endpoint/linux_apt_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_busybox_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Busybox Privilege Escalation Unit Test
tests:
- name: Linux Busybox Privilege Escalation
file: endpoint/linux_busybox_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_c89_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux c89 Privilege Escalation Unit Test
tests:
- name: Linux c89 Privilege Escalation
file: endpoint/linux_c89_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_c99_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux c99 Privilege Escalation Unit Test
tests:
- name: Linux c99 Privilege Escalation
file: endpoint/linux_c99_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_composer_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Composer Privilege Escalation Unit Test
tests:
- name: Linux Composer Privilege Escalation
file: endpoint/linux_composer_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_cpulimit_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Cpulimit Privilege Escalation Unit Test
tests:
- name: Linux Cpulimit Privilege Escalation
file: endpoint/linux_cpulimit_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_csvtool_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Csvtool Privilege Escalation Unit Test
tests:
- name: Linux Csvtool Privilege Escalation
file: endpoint/linux_csvtool_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_emacs_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Emacs Privilege Escalation Unit Test
tests:
- name: Linux Emacs Privilege Escalation
file: endpoint/linux_emacs_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_find_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Find Privilege Escalation Unit Test
tests:
- name: Linux Find Privilege Escalation
file: endpoint/linux_find_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_gdb_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux GDB Privilege Escalation Unit Test
tests:
- name: Linux GDB Privilege Escalation
file: endpoint/linux_gdb_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_gem_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Gem Privilege Escalation Unit Test
tests:
- name: Linux Gem Privilege Escalation
file: endpoint/linux_gem_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_gnu_awk_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux GNU Awk Privilege Escalation Unit Test
tests:
- name: Linux GNU Awk Privilege Escalation
file: endpoint/linux_gnu_awk_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_make_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Make Privilege Escalation Unit Test
tests:
- name: Linux Make Privilege Escalation
file: endpoint/linux_make_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_mysql_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux MySQL Privilege Escalation Unit Test
tests:
- name: Linux MySQL Privilege Escalation
file: endpoint/linux_mysql_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_octave_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Octave Privilege Escalation Unit Test
tests:
- name: Linux Octave Privilege Escalation
file: endpoint/linux_octave_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_openvpn_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux OpenVPN Privilege Escalation Unit Test
tests:
- name: Linux OpenVPN Privilege Escalation
file: endpoint/linux_openvpn_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_php_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux PHP Privilege Escalation Unit Test
tests:
- name: Linux PHP Privilege Escalation
file: endpoint/linux_php_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_puppet_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Puppet Privilege Escalation Unit Test
tests:
- name: Linux Puppet Privilege Escalation
file: endpoint/linux_puppet_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_rpm_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux RPM Privilege Escalation Unit Test
tests:
- name: Linux RPM Privilege Escalation
file: endpoint/linux_rpm_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_ruby_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Ruby Privilege Escalation Unit Test
tests:
- name: Linux Ruby Privilege Escalation
file: endpoint/linux_ruby_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_sqlite3_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Sqlite3 Privilege Escalation Unit Test
tests:
- name: Linux Sqlite3 Privilege Escalation
file: endpoint/linux_sqlite3_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true