diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml new file mode 100644 index 0000000000..73a9817d54 --- /dev/null +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -0,0 +1,77 @@ +name: Linux apt-get Privilege Escalation +id: d870ce3b-e796-402f-b2af-cab4da1223f2 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The apt-get is a command line tool for interacting with the Advanced Package Tool (APT) library (a package management system for Linux distributions). + It allows you to search for, install, manage, update, and remove software. The tool does not build software from the source code. + If sudo right is given to the tool for user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt-get*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_apt_get_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/apt-get/ +- https://phoenixnap.com/kb/how-to-use-apt-get-commands +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log + impact: 20 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 10 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml new file mode 100644 index 0000000000..c97f1cddaf --- /dev/null +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -0,0 +1,77 @@ +name: Linux APT Privilege Escalation +id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Advanced Package Tool, more commonly known as APT, is a collection of tools used to install, update, remove, + and otherwise manage software packages on Debian and its derivative operating systems, including Ubuntu and Linux Mint. + If sudo right is given to the tool for user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_apt_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/apt/ +- https://www.digitalocean.com/community/tutorials/what-is-apt +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log + impact: 20 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 10 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 4c427723b9..0b3df8a994 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. + logs with the file name, file path, and process_guid executions from your endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can create this file for automation purposes. Please update the filter macros to remove false positives. diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index b22f70ca9c..dcc13d9d23 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index a0f226f099..5c46d8cf02 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: @@ -31,16 +31,16 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -51,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -64,5 +72,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml new file mode 100644 index 0000000000..0e91760cde --- /dev/null +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Busybox Privilege Escalation +id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides minimalist replacements for most of the utilities you usually find in GNU coreutils, util-linux, etc. + If sudo right is given to BusyBox application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*busybox*" AND Processes.process="*sh*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_busybox_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/busybox/ +- https://man.archlinux.org/man/busybox.1.en +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log + impact: 20 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 10 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml new file mode 100644 index 0000000000..d84c290fd4 --- /dev/null +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux c89 Privilege Escalation +id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The c89 and cc commands compile, assemble, and link-edit C programs; the cxx or c++ command does the same for C++ programs. The c89 command should be used when compiling C programs that are written according to Standard C. + If sudo right is given to c89 application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*c89*" AND Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_c89_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/c89/ +- https://www.ibm.com/docs/en/zos/2.1.0?topic=guide-c89-compiler-invocation-using-host-environment-variables +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml new file mode 100644 index 0000000000..2038ded0d0 --- /dev/null +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux c99 Privilege Escalation +id: e1c6dec5-2249-442d-a1f9-99a4bd228183 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The c99 utility is an interface to the standard C compilation system; it shall accept source code conforming to the ISO C standard. The system conceptually consists of a compiler and link editor. + If sudo right is given to ruby application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*c99*" AND Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_c99_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/c99/ +- https://pubs.opengroup.org/onlinepubs/009604499/utilities/c99.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml new file mode 100644 index 0000000000..eeea676413 --- /dev/null +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Composer Privilege Escalation +id: a3bddf71-6ba3-42ab-a6b2-396929b16d92 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Composer is a tool for dependency management in PHP. It allows you to declare the libraries your project depends on and it will manage (install/update) them for you. + If sudo right is given to tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*composer*" AND Processes.process="*run-script*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_composer_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/composer/ +- https://getcomposer.org/doc/00-intro.md +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log + impact: 20 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 10 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml new file mode 100644 index 0000000000..3e9d9a4ac5 --- /dev/null +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Cpulimit Privilege Escalation +id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: cpulimit is a simple program which attempts to limit the cpu usage of a process (expressed in percentage, not in cpu time). This is useful to control batch jobs, when you don't want them to eat too much cpu. + If sudo right is given to the program for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*cpulimit*" AND Processes.process="*-l*" AND Processes.process="*-f*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_cpulimit_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/cpulimit/ +- http://cpulimit.sourceforge.net/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log + impact: 40 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 20 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml new file mode 100644 index 0000000000..8bc9648820 --- /dev/null +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -0,0 +1,75 @@ +name: Linux Csvtool Privilege Escalation +id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: csvtool is an easy to use command-line tool to work with .CSV files. + If sudo right is given to the tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*csvtool*" AND Processes.process="*call*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_csvtool_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/csvtool/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log + impact: 20 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 10 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index 0978880cdf..5d5b54b728 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: @@ -31,16 +31,16 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 30 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log - impact: 80 + impact: 10 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -51,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -64,5 +72,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 24 + risk_score: 5 security_domain: endpoint diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml new file mode 100644 index 0000000000..e822940a15 --- /dev/null +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Emacs Privilege Escalation +id: 92033cab-1871-483d-a03b-a7ce98665cfc +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: EMACS is a family of text editors that are characterized by their extensibility. + The manual for the most widely used variant, GNU Emacs, describes it as "the extensible, customizable, self-documenting, real-time display editor". + If sudo right is given to EMACS tool for the user, then the user can run special commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*emacs*" AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_emacs_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/emacs/ +- https://en.wikipedia.org/wiki/Emacs +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log + impact: 40 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 20 + security_domain: endpoint diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml new file mode 100644 index 0000000000..ca78952396 --- /dev/null +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Find Privilege Escalation +id: 2ff4e0c2-8256-4143-9c07-1e39c7231111 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Find is a command-line utility that locates files based on some user-specified criteria and either prints the + pathname of each matched object or, if another action is requested, performs that action on each matched object. + If sudo right is given to find utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*find*" AND Processes.process="*-exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_find_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/find/ +- https://en.wikipedia.org/wiki/Find_(Unix) +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log + impact: 10 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 5 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml new file mode 100644 index 0000000000..1c5f21fdc5 --- /dev/null +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -0,0 +1,74 @@ +name: Linux GDB Privilege Escalation +id: 310b7da2-ab52-437f-b1bf-0bd458674308 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: GDB is the acronym for GNU Debugger. This tool helps to debug the programs written in C, C++, Ada, Fortran, etc. The console can be opened using the gdb command on terminal. + If sudo right is given to GDB tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*gdb*" AND Processes.process="*-nx*" AND Processes.process="*-ex*!*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_gdb_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/gdb/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log + impact: 20 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 10 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml new file mode 100644 index 0000000000..b0f19d396f --- /dev/null +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Gem Privilege Escalation +id: 0115482a-5dcb-4bb0-bcca-5d095d224236 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: RubyGems is a package manager for the Ruby programming language that provides a standard format for distributing Ruby programs and libraries (in a self-contained format called a "gem"), + a tool designed to easily manage the installation of gems, and a server for distributing them. + If sudo right is given to GEM utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*gem*open*-e*" AND Processes.process="*-c*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_gem_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/gem/ +- https://en.wikipedia.org/wiki/RubyGems +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log + impact: 20 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 10 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml new file mode 100644 index 0000000000..7af0ed031d --- /dev/null +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -0,0 +1,75 @@ +name: Linux GNU Awk Privilege Escalation +id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: gawk command in Linux is used for pattern scanning and processing language. The awk command requires no compiling and allows the user to use variables, numeric functions, string functions, and logical operators. It is a utility that enables programmers to write tiny and effective programs in the form of statements + that define text patterns that are to be searched for, in a text document and the action that is to be taken when a match is found within a line. + If sudo right is given to gawk tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*gawk*" AND Processes.process="*BEGIN*{system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_gnu_awk_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/gawk/ +- https://www.geeksforgeeks.org/gawk-command-in-linux-with-examples/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml new file mode 100644 index 0000000000..8726cbb5c7 --- /dev/null +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Make Privilege Escalation +id: 80b22836-5091-4944-80ee-f733ac443f4f +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The Linux make command is used to build and maintain groups of programs and files from the source code. In Linux, it is one of the most frequently used commands by the developers. + It assists developers to install and compile many utilities from the terminal. + If sudo right is given to make utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*make*-s*" AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_make_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/make/ +- https://www.javatpoint.com/linux-make-command +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log + impact: 40 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 20 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml new file mode 100644 index 0000000000..9477824818 --- /dev/null +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -0,0 +1,75 @@ +name: Linux MySQL Privilege Escalation +id: c0d810f4-230c-44ea-b703-989da02ff145 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: MySQL is an open-source relational database management system. + Its name is a combination of "My", the name of co-founder Michael Widenius's daughter My, and "SQL", the abbreviation for Structured Query Language. + If sudo right is given to mysql utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*mysql*-e*" AND Processes.process="*\!**" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_mysql_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/mysql/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index 8aacf88865..7777ca5af1 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -17,11 +17,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: - https://gtfobins.github.io/gtfobins/docker/ +- https://en.wikipedia.org/wiki/Node.js tags: analytic_story: - Linux Privilege Escalation @@ -31,7 +32,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation @@ -40,7 +41,7 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -51,6 +52,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -64,5 +73,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 40 security_domain: endpoint diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml new file mode 100644 index 0000000000..6ca28729dd --- /dev/null +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Octave Privilege Escalation +id: 78f7487d-42ce-4f7f-8685-2159b25fb477 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: GNU Octave is a high-level programming language primarily intended for scientific computing and numerical computation. Octave helps in solving linear and nonlinear problems numerically, and for performing other numerical experiments using a language that is mostly compatible with MATLAB. + If sudo right is given to the application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*octave-cli*" AND Processes.process="*--eval*" AND Processes.process="*system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_octave_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/octave/ +- https://en.wikipedia.org/wiki/GNU_Octave +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log + impact: 40 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 20 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml new file mode 100644 index 0000000000..815661fe1e --- /dev/null +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux OpenVPN Privilege Escalation +id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: OpenVPN is a virtual private network system that implements techniques to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It implements both client and server applications. + If sudo right is given to the OpenVPN application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*openvpn*" AND Processes.process="*--dev*" AND Processes.process="*--script-security*" AND Processes.process="*--up*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_openvpn_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/openvpn/ +- https://en.wikipedia.org/wiki/OpenVPN +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml new file mode 100644 index 0000000000..981de3f02b --- /dev/null +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux PHP Privilege Escalation +id: 4fc4c031-e5be-4cc0-8cf9-49f9f507bcb5 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: PHP is a general-purpose scripting language geared toward web development. + It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1994. The PHP reference implementation is now produced by The PHP Group. + If sudo right is given to php application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*php*-r*" AND Processes.process="*system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_php_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/php/ +- https://en.wikipedia.org/wiki/PHP +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml new file mode 100644 index 0000000000..a9b4a0ea77 --- /dev/null +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Puppet Privilege Escalation +id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: In computing, Puppet is a software configuration management tool which includes its own declarative language to describe system configuration. It is a model-driven solution that requires limited programming knowledge to use. + If sudo right is given to the tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*puppet*" AND Processes.process="*apply*" AND Processes.process="*-e*" AND Processes.process="*exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_puppet_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/puppet/ +- https://en.wikipedia.org/wiki/Puppet_(software) +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log + impact: 10 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 5 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml new file mode 100644 index 0000000000..3f98f29155 --- /dev/null +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux RPM Privilege Escalation +id: f8e58a23-cecd-495f-9c65-6c76b4cb9774 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: RPM Package Manager is a free and open-source package management system. The name RPM refers to the .rpm file format and the package manager program itself. + RPM was intended primarily for Linux distributions; the file format is the baseline package format of the Linux Standard Base. + If sudo right is given to rpm utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*rpm*--eval*" AND Processes.process="*lua:os.execute*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_rpm_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/rpm/ +- https://en.wikipedia.org/wiki/RPM_Package_Manager +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml new file mode 100644 index 0000000000..2dbe677e07 --- /dev/null +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -0,0 +1,75 @@ +name: Linux Ruby Privilege Escalation +id: 097b28b5-7004-4d40-a715-7e390501788b +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Ruby is one of the most used and easy to use programming languages. + Ruby is an open-source, object-oriented interpreter that can be installed on a Linux system. + If sudo right is given to ruby application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*ruby*-e*" AND Processes.process="*exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_ruby_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/ruby/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml new file mode 100644 index 0000000000..6d336d41ed --- /dev/null +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -0,0 +1,76 @@ +name: Linux Sqlite3 Privilege Escalation +id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: sqlite3 is a terminal-based front-end to the SQLite library that can evaluate queries interactively and display the results in multiple formats. sqlite3 can also be used within shell scripts and other applications to provide batch processing features. + If sudo right is given to this application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*sqlite3*" AND Processes.process="*.shell*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_sqlite3_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/sqlite3/ +- https://manpages.ubuntu.com/manpages/trusty/en/man1/sqlite3.1.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint + \ No newline at end of file diff --git a/tests/endpoint/linux_apt_get_privilege_escalation.test.yml b/tests/endpoint/linux_apt_get_privilege_escalation.test.yml new file mode 100644 index 0000000000..9829c994f1 --- /dev/null +++ b/tests/endpoint/linux_apt_get_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux apt-get Privilege Escalation Unit Test +tests: +- name: Linux apt-get Privilege Escalation + file: endpoint/linux_apt_get_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_apt_privilege_escalation.test.yml b/tests/endpoint/linux_apt_privilege_escalation.test.yml new file mode 100644 index 0000000000..803e9657d2 --- /dev/null +++ b/tests/endpoint/linux_apt_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux APT Privilege Escalation Unit Test +tests: +- name: Linux APT Privilege Escalation + file: endpoint/linux_apt_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_busybox_privilege_escalation.test.yml b/tests/endpoint/linux_busybox_privilege_escalation.test.yml new file mode 100644 index 0000000000..09e4b5d56d --- /dev/null +++ b/tests/endpoint/linux_busybox_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Busybox Privilege Escalation Unit Test +tests: +- name: Linux Busybox Privilege Escalation + file: endpoint/linux_busybox_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_c89_privilege_escalation.test.yml b/tests/endpoint/linux_c89_privilege_escalation.test.yml new file mode 100644 index 0000000000..45a93c1b62 --- /dev/null +++ b/tests/endpoint/linux_c89_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux c89 Privilege Escalation Unit Test +tests: +- name: Linux c89 Privilege Escalation + file: endpoint/linux_c89_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_c99_privilege_escalation.test.yml b/tests/endpoint/linux_c99_privilege_escalation.test.yml new file mode 100644 index 0000000000..85345a02f6 --- /dev/null +++ b/tests/endpoint/linux_c99_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux c99 Privilege Escalation Unit Test +tests: +- name: Linux c99 Privilege Escalation + file: endpoint/linux_c99_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_composer_privilege_escalation.test.yml b/tests/endpoint/linux_composer_privilege_escalation.test.yml new file mode 100644 index 0000000000..d49e07931c --- /dev/null +++ b/tests/endpoint/linux_composer_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Composer Privilege Escalation Unit Test +tests: +- name: Linux Composer Privilege Escalation + file: endpoint/linux_composer_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_cpulimit_privilege_escalation.test.yml b/tests/endpoint/linux_cpulimit_privilege_escalation.test.yml new file mode 100644 index 0000000000..8a0bc30aff --- /dev/null +++ b/tests/endpoint/linux_cpulimit_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Cpulimit Privilege Escalation Unit Test +tests: +- name: Linux Cpulimit Privilege Escalation + file: endpoint/linux_cpulimit_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_csvtool_privilege_escalation.test.yml b/tests/endpoint/linux_csvtool_privilege_escalation.test.yml new file mode 100644 index 0000000000..43b83fb0e7 --- /dev/null +++ b/tests/endpoint/linux_csvtool_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Csvtool Privilege Escalation Unit Test +tests: +- name: Linux Csvtool Privilege Escalation + file: endpoint/linux_csvtool_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_emacs_privilege_escalation.test.yml b/tests/endpoint/linux_emacs_privilege_escalation.test.yml new file mode 100644 index 0000000000..01fc8c5d48 --- /dev/null +++ b/tests/endpoint/linux_emacs_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Emacs Privilege Escalation Unit Test +tests: +- name: Linux Emacs Privilege Escalation + file: endpoint/linux_emacs_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_find_privilege_escalation.test.yml b/tests/endpoint/linux_find_privilege_escalation.test.yml new file mode 100644 index 0000000000..22d0a7bde6 --- /dev/null +++ b/tests/endpoint/linux_find_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Find Privilege Escalation Unit Test +tests: +- name: Linux Find Privilege Escalation + file: endpoint/linux_find_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_gdb_privilege_escalation.test.yml b/tests/endpoint/linux_gdb_privilege_escalation.test.yml new file mode 100644 index 0000000000..5bb6f2ac5b --- /dev/null +++ b/tests/endpoint/linux_gdb_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux GDB Privilege Escalation Unit Test +tests: +- name: Linux GDB Privilege Escalation + file: endpoint/linux_gdb_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_gem_privilege_escalation.test.yml b/tests/endpoint/linux_gem_privilege_escalation.test.yml new file mode 100644 index 0000000000..549249fdf7 --- /dev/null +++ b/tests/endpoint/linux_gem_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Gem Privilege Escalation Unit Test +tests: +- name: Linux Gem Privilege Escalation + file: endpoint/linux_gem_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_gnu_awk_privilege_escalation.test.yml b/tests/endpoint/linux_gnu_awk_privilege_escalation.test.yml new file mode 100644 index 0000000000..43439e801b --- /dev/null +++ b/tests/endpoint/linux_gnu_awk_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux GNU Awk Privilege Escalation Unit Test +tests: +- name: Linux GNU Awk Privilege Escalation + file: endpoint/linux_gnu_awk_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_make_privilege_escalation.test.yml b/tests/endpoint/linux_make_privilege_escalation.test.yml new file mode 100644 index 0000000000..751c329a4c --- /dev/null +++ b/tests/endpoint/linux_make_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Make Privilege Escalation Unit Test +tests: +- name: Linux Make Privilege Escalation + file: endpoint/linux_make_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_mysql_privilege_escalation.test.yml b/tests/endpoint/linux_mysql_privilege_escalation.test.yml new file mode 100644 index 0000000000..6658a07840 --- /dev/null +++ b/tests/endpoint/linux_mysql_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux MySQL Privilege Escalation Unit Test +tests: +- name: Linux MySQL Privilege Escalation + file: endpoint/linux_mysql_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_octave_privilege_escalation.test.yml b/tests/endpoint/linux_octave_privilege_escalation.test.yml new file mode 100644 index 0000000000..7c7bfe2c20 --- /dev/null +++ b/tests/endpoint/linux_octave_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Octave Privilege Escalation Unit Test +tests: +- name: Linux Octave Privilege Escalation + file: endpoint/linux_octave_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_openvpn_privilege_escalation.test.yml b/tests/endpoint/linux_openvpn_privilege_escalation.test.yml new file mode 100644 index 0000000000..357ff46af6 --- /dev/null +++ b/tests/endpoint/linux_openvpn_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux OpenVPN Privilege Escalation Unit Test +tests: +- name: Linux OpenVPN Privilege Escalation + file: endpoint/linux_openvpn_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_php_privilege_escalation.test.yml b/tests/endpoint/linux_php_privilege_escalation.test.yml new file mode 100644 index 0000000000..c67316e795 --- /dev/null +++ b/tests/endpoint/linux_php_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux PHP Privilege Escalation Unit Test +tests: +- name: Linux PHP Privilege Escalation + file: endpoint/linux_php_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_puppet_privilege_escalation.test.yml b/tests/endpoint/linux_puppet_privilege_escalation.test.yml new file mode 100644 index 0000000000..2f0228e45e --- /dev/null +++ b/tests/endpoint/linux_puppet_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Puppet Privilege Escalation Unit Test +tests: +- name: Linux Puppet Privilege Escalation + file: endpoint/linux_puppet_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_rpm_privilege_escalation.test.yml b/tests/endpoint/linux_rpm_privilege_escalation.test.yml new file mode 100644 index 0000000000..2f725913f2 --- /dev/null +++ b/tests/endpoint/linux_rpm_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux RPM Privilege Escalation Unit Test +tests: +- name: Linux RPM Privilege Escalation + file: endpoint/linux_rpm_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_ruby_privilege_escalation.test.yml b/tests/endpoint/linux_ruby_privilege_escalation.test.yml new file mode 100644 index 0000000000..3357e0f628 --- /dev/null +++ b/tests/endpoint/linux_ruby_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Ruby Privilege Escalation Unit Test +tests: +- name: Linux Ruby Privilege Escalation + file: endpoint/linux_ruby_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_sqlite3_privilege_escalation.test.yml b/tests/endpoint/linux_sqlite3_privilege_escalation.test.yml new file mode 100644 index 0000000000..a2131d172a --- /dev/null +++ b/tests/endpoint/linux_sqlite3_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Sqlite3 Privilege Escalation Unit Test +tests: +- name: Linux Sqlite3 Privilege Escalation + file: endpoint/linux_sqlite3_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true