From 51693e4ba5546775fc064ccf4bd4a014063e3b24 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Wed, 10 Aug 2022 06:58:54 -0400 Subject: [PATCH 1/7] Add T1548.003 --- .../linux_emacs_privilege_escalation.yml | 67 +++++++++++++++++++ .../linux_find_privilege_escalation.yml | 67 +++++++++++++++++++ .../linux_gdb_privilege_escalation.yml | 66 ++++++++++++++++++ .../linux_gem_privilege_escalation.yml | 67 +++++++++++++++++++ .../linux_gnu_awk_privilege_escalation.yml | 66 ++++++++++++++++++ .../linux_make_privilege_escalation.yml | 67 +++++++++++++++++++ .../linux_mysql_privilege_escalation.yml | 67 +++++++++++++++++++ .../linux_php_privilege_escalation.yml | 67 +++++++++++++++++++ .../linux_rpm_privilege_escalation.yml | 67 +++++++++++++++++++ .../linux_ruby_privilege_escalation.yml | 67 +++++++++++++++++++ .../linux_emacs_privilege_escalation.test.yml | 13 ++++ .../linux_find_privilege_escalation.test.yml | 13 ++++ .../linux_gdb_privilege_escalation.test.yml | 13 ++++ .../linux_gem_privilege_escalation.test.yml | 13 ++++ ...inux_gnu_awk_privilege_escalation.test.yml | 13 ++++ .../linux_make_privilege_escalation.test.yml | 13 ++++ .../linux_mysql_privilege_escalation.test.yml | 13 ++++ .../linux_php_privilege_escalation.test.yml | 13 ++++ .../linux_rpm_privilege_escalation.test.yml | 13 ++++ .../linux_ruby_privilege_escalation.test.yml | 13 ++++ 20 files changed, 798 insertions(+) create mode 100644 detections/endpoint/linux_emacs_privilege_escalation.yml create mode 100644 detections/endpoint/linux_find_privilege_escalation.yml create mode 100644 detections/endpoint/linux_gdb_privilege_escalation.yml create mode 100644 detections/endpoint/linux_gem_privilege_escalation.yml create mode 100644 detections/endpoint/linux_gnu_awk_privilege_escalation.yml create mode 100644 detections/endpoint/linux_make_privilege_escalation.yml create mode 100644 detections/endpoint/linux_mysql_privilege_escalation.yml create mode 100644 detections/endpoint/linux_php_privilege_escalation.yml create mode 100644 detections/endpoint/linux_rpm_privilege_escalation.yml create mode 100644 detections/endpoint/linux_ruby_privilege_escalation.yml create mode 100644 tests/endpoint/linux_emacs_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_find_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_gdb_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_gem_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_gnu_awk_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_make_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_mysql_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_php_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_rpm_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_ruby_privilege_escalation.test.yml diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml new file mode 100644 index 0000000000..f843f51621 --- /dev/null +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Emacs Privilege Escalation +id: 92033cab-1871-483d-a03b-a7ce98665cfc +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: EMACS is a family of text editors that are characterized by their extensibility. + The manual for the most widely used variant, GNU Emacs, describes it as "the extensible, customizable, self-documenting, real-time display editor". + If sudo right is given to EMACS tool for the user, then the user can run special commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*emacs*" AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_emacs_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/emacs/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml new file mode 100644 index 0000000000..fba72a7282 --- /dev/null +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Find Privilege Escalation +id: 2ff4e0c2-8256-4143-9c07-1e39c7231111 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Find is a command-line utility that locates files based on some user-specified criteria and either prints the + pathname of each matched object or, if another action is requested, performs that action on each matched object. + If sudo right is given to find utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*find*" AND Processes.process="*-exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_find_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/find/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml new file mode 100644 index 0000000000..7a823fd4cc --- /dev/null +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -0,0 +1,66 @@ +name: Linux GDB Privilege Escalation +id: 310b7da2-ab52-437f-b1bf-0bd458674308 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: GDB is the acronym for GNU Debugger. This tool helps to debug the programs written in C, C++, Ada, Fortran, etc. The console can be opened using the gdb command on terminal. + If sudo right is given to GDB tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*gdb*" AND Processes.process="*-nx*" AND Processes.process="*-ex*!*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_gdb_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/gdb/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml new file mode 100644 index 0000000000..683df05816 --- /dev/null +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Gem Privilege Escalation +id: 0115482a-5dcb-4bb0-bcca-5d095d224236 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: RubyGems is a package manager for the Ruby programming language that provides a standard format for distributing Ruby programs and libraries (in a self-contained format called a "gem"), + a tool designed to easily manage the installation of gems, and a server for distributing them. + If sudo right is given to GEM utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*gem*open*-e*" AND Processes.process="*-c*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_gem_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/gem/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml new file mode 100644 index 0000000000..05d43d3090 --- /dev/null +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -0,0 +1,66 @@ +name: Linux GNU Awk Privilege Escalation +id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: gawk command in Linux is used for pattern scanning and processing language. The awk command requires no compiling and allows the user to use variables, numeric functions, string functions, and logical operators. It is a utility that enables programmers to write tiny and effective programs in the form of statements + that define text patterns that are to be searched for, in a text document and the action that is to be taken when a match is found within a line. + If sudo right is given to gawk tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*gawk*" AND Processes.process="*BEGIN*{system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_gnu_awk_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/gawk/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml new file mode 100644 index 0000000000..a5a2f677f2 --- /dev/null +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Make Privilege Escalation +id: 80b22836-5091-4944-80ee-f733ac443f4f +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The Linux make command is used to build and maintain groups of programs and files from the source code. In Linux, it is one of the most frequently used commands by the developers. + It assists developers to install and compile many utilities from the terminal. + If sudo right is given to make utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*make*-s*" AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_make_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/make/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml new file mode 100644 index 0000000000..aba8ccd221 --- /dev/null +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux MySQL Privilege Escalation +id: c0d810f4-230c-44ea-b703-989da02ff145 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: MySQL is an open-source relational database management system. + Its name is a combination of "My", the name of co-founder Michael Widenius's daughter My, and "SQL", the abbreviation for Structured Query Language. + If sudo right is given to mysql utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*mysql*-e*" AND Processes.process="*\!**" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_mysql_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/mysql/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml new file mode 100644 index 0000000000..145b91a016 --- /dev/null +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux PHP Privilege Escalation +id: 4fc4c031-e5be-4cc0-8cf9-49f9f507bcb5 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: PHP is a general-purpose scripting language geared toward web development. + It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1994. The PHP reference implementation is now produced by The PHP Group. + If sudo right is given to php application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*php*-r*" AND Processes.process="*system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_php_privilege_escalation_filter`' +hhow_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/php/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml new file mode 100644 index 0000000000..91db232e16 --- /dev/null +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux RPM Privilege Escalation +id: f8e58a23-cecd-495f-9c65-6c76b4cb9774 +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: RPM Package Manager is a free and open-source package management system. The name RPM refers to the .rpm file format and the package manager program itself. + RPM was intended primarily for Linux distributions; the file format is the baseline package format of the Linux Standard Base. + If sudo right is given to rpm utility for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*rpm*--eval*" AND Processes.process="*lua:os.execute*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_rpm_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/rpm/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml new file mode 100644 index 0000000000..339fb7ebbb --- /dev/null +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Ruby Privilege Escalation +id: 097b28b5-7004-4d40-a715-7e390501788b +version: 1 +date: '2022-08-09' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Ruby is one of the most used and easy to use programming languages. + Ruby is an open-source, object-oriented interpreter that can be installed on a Linux system. + If sudo right is given to ruby application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*ruby*-e*" AND Processes.process="*exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_ruby_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/ruby/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/linux_emacs_privilege_escalation.test.yml b/tests/endpoint/linux_emacs_privilege_escalation.test.yml new file mode 100644 index 0000000000..01fc8c5d48 --- /dev/null +++ b/tests/endpoint/linux_emacs_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Emacs Privilege Escalation Unit Test +tests: +- name: Linux Emacs Privilege Escalation + file: endpoint/linux_emacs_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_find_privilege_escalation.test.yml b/tests/endpoint/linux_find_privilege_escalation.test.yml new file mode 100644 index 0000000000..22d0a7bde6 --- /dev/null +++ b/tests/endpoint/linux_find_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Find Privilege Escalation Unit Test +tests: +- name: Linux Find Privilege Escalation + file: endpoint/linux_find_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_gdb_privilege_escalation.test.yml b/tests/endpoint/linux_gdb_privilege_escalation.test.yml new file mode 100644 index 0000000000..5bb6f2ac5b --- /dev/null +++ b/tests/endpoint/linux_gdb_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux GDB Privilege Escalation Unit Test +tests: +- name: Linux GDB Privilege Escalation + file: endpoint/linux_gdb_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_gem_privilege_escalation.test.yml b/tests/endpoint/linux_gem_privilege_escalation.test.yml new file mode 100644 index 0000000000..549249fdf7 --- /dev/null +++ b/tests/endpoint/linux_gem_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Gem Privilege Escalation Unit Test +tests: +- name: Linux Gem Privilege Escalation + file: endpoint/linux_gem_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_gnu_awk_privilege_escalation.test.yml b/tests/endpoint/linux_gnu_awk_privilege_escalation.test.yml new file mode 100644 index 0000000000..43439e801b --- /dev/null +++ b/tests/endpoint/linux_gnu_awk_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux GNU Awk Privilege Escalation Unit Test +tests: +- name: Linux GNU Awk Privilege Escalation + file: endpoint/linux_gnu_awk_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_make_privilege_escalation.test.yml b/tests/endpoint/linux_make_privilege_escalation.test.yml new file mode 100644 index 0000000000..751c329a4c --- /dev/null +++ b/tests/endpoint/linux_make_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Make Privilege Escalation Unit Test +tests: +- name: Linux Make Privilege Escalation + file: endpoint/linux_make_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_mysql_privilege_escalation.test.yml b/tests/endpoint/linux_mysql_privilege_escalation.test.yml new file mode 100644 index 0000000000..6658a07840 --- /dev/null +++ b/tests/endpoint/linux_mysql_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux MySQL Privilege Escalation Unit Test +tests: +- name: Linux MySQL Privilege Escalation + file: endpoint/linux_mysql_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_php_privilege_escalation.test.yml b/tests/endpoint/linux_php_privilege_escalation.test.yml new file mode 100644 index 0000000000..c67316e795 --- /dev/null +++ b/tests/endpoint/linux_php_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux PHP Privilege Escalation Unit Test +tests: +- name: Linux PHP Privilege Escalation + file: endpoint/linux_php_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_rpm_privilege_escalation.test.yml b/tests/endpoint/linux_rpm_privilege_escalation.test.yml new file mode 100644 index 0000000000..2f725913f2 --- /dev/null +++ b/tests/endpoint/linux_rpm_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux RPM Privilege Escalation Unit Test +tests: +- name: Linux RPM Privilege Escalation + file: endpoint/linux_rpm_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_ruby_privilege_escalation.test.yml b/tests/endpoint/linux_ruby_privilege_escalation.test.yml new file mode 100644 index 0000000000..3357e0f628 --- /dev/null +++ b/tests/endpoint/linux_ruby_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Ruby Privilege Escalation Unit Test +tests: +- name: Linux Ruby Privilege Escalation + file: endpoint/linux_ruby_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true From 17a88a6d37b5a0135e477c220afaace3500af7ae Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Wed, 10 Aug 2022 07:05:56 -0400 Subject: [PATCH 2/7] Update detection --- detections/endpoint/linux_php_privilege_escalation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index 145b91a016..2eb88d67d4 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_php_privilege_escalation_filter`' -hhow_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. From bed8043fe899f5edb48b5d2547f031c5e1b94606 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Fri, 12 Aug 2022 07:27:16 -0400 Subject: [PATCH 3/7] Add 12 More detections (T1548) --- .../linux_apt_get_privilege_escalation.yml | 68 +++++++++++++++++++ .../linux_apt_privilege_escalation.yml | 68 +++++++++++++++++++ .../linux_busybox_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_c89_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_c99_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_composer_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_cpulimit_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_csvtool_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_octave_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_openvpn_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_puppet_privilege_escalation.yml | 67 ++++++++++++++++++ .../linux_sqlite3_privilege_escalation.yml | 67 ++++++++++++++++++ ...inux_apt_get_privilege_escalation.test.yml | 13 ++++ .../linux_apt_privilege_escalation.test.yml | 13 ++++ ...inux_busybox_privilege_escalation.test.yml | 13 ++++ .../linux_c89_privilege_escalation.test.yml | 13 ++++ .../linux_c99_privilege_escalation.test.yml | 13 ++++ ...nux_composer_privilege_escalation.test.yml | 13 ++++ ...nux_cpulimit_privilege_escalation.test.yml | 13 ++++ ...inux_csvtool_privilege_escalation.test.yml | 13 ++++ ...linux_octave_privilege_escalation.test.yml | 13 ++++ ...inux_openvpn_privilege_escalation.test.yml | 13 ++++ ...linux_puppet_privilege_escalation.test.yml | 13 ++++ ...inux_sqlite3_privilege_escalation.test.yml | 13 ++++ 24 files changed, 962 insertions(+) create mode 100644 detections/endpoint/linux_apt_get_privilege_escalation.yml create mode 100644 detections/endpoint/linux_apt_privilege_escalation.yml create mode 100644 detections/endpoint/linux_busybox_privilege_escalation.yml create mode 100644 detections/endpoint/linux_c89_privilege_escalation.yml create mode 100644 detections/endpoint/linux_c99_privilege_escalation.yml create mode 100644 detections/endpoint/linux_composer_privilege_escalation.yml create mode 100644 detections/endpoint/linux_cpulimit_privilege_escalation.yml create mode 100644 detections/endpoint/linux_csvtool_privilege_escalation.yml create mode 100644 detections/endpoint/linux_octave_privilege_escalation.yml create mode 100644 detections/endpoint/linux_openvpn_privilege_escalation.yml create mode 100644 detections/endpoint/linux_puppet_privilege_escalation.yml create mode 100644 detections/endpoint/linux_sqlite3_privilege_escalation.yml create mode 100644 tests/endpoint/linux_apt_get_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_apt_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_busybox_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_c89_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_c99_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_composer_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_cpulimit_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_csvtool_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_octave_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_openvpn_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_puppet_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_sqlite3_privilege_escalation.test.yml diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml new file mode 100644 index 0000000000..9d19762fa5 --- /dev/null +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux apt-get Privilege Escalation +id: d870ce3b-e796-402f-b2af-cab4da1223f2 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: apt-get is a command line tool for interacting with the Advanced Package Tool (APT) library (a package management system for Linux distributions). + It allows you to search for, install, manage, update, and remove software. The tool does not build software from the source code. + If sudo right is given to the tool for user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt-get*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_apt_get_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/apt-get/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml new file mode 100644 index 0000000000..428ff084df --- /dev/null +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux APT Privilege Escalation +id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Advanced Package Tool, more commonly known as APT, is a collection of tools used to install, update, remove, + and otherwise manage software packages on Debian and its derivative operating systems, including Ubuntu and Linux Mint. + If sudo right is given to the tool for user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_apt_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/apt/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml new file mode 100644 index 0000000000..f6c5107fcd --- /dev/null +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Busybox Privilege Escalation +id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides minimalist replacements for most of the utilities you usually find in GNU coreutils, util-linux, etc. + If sudo right is given to BusyBox application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*busybox*" AND Processes.process="*sh*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_busybox_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/busybox/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml new file mode 100644 index 0000000000..9cf7bda18b --- /dev/null +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux c89 Privilege Escalation +id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The c89 and cc commands compile, assemble, and link-edit C programs; the cxx or c++ command does the same for C++ programs. The c89 command should be used when compiling C programs that are written according to Standard C. + If sudo right is given to c89 application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*c89*" AND Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_c89_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/c89/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml new file mode 100644 index 0000000000..6a4eb12d66 --- /dev/null +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux c99 Privilege Escalation +id: e1c6dec5-2249-442d-a1f9-99a4bd228183 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The c99 utility is an interface to the standard C compilation system; it shall accept source code conforming to the ISO C standard. The system conceptually consists of a compiler and link editor. + If sudo right is given to ruby application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*c99*" AND Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_c99_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/c99/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml new file mode 100644 index 0000000000..52d1d09cd7 --- /dev/null +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Composer Privilege Escalation +id: a3bddf71-6ba3-42ab-a6b2-396929b16d92 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Composer is a tool for dependency management in PHP. It allows you to declare the libraries your project depends on and it will manage (install/update) them for you. + If sudo right is given to tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*composer*" AND Processes.process="*run-script*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_composer_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/composer/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml new file mode 100644 index 0000000000..c7c9a1ca7e --- /dev/null +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Cpulimit Privilege Escalation +id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: cpulimit is a simple program which attempts to limit the cpu usage of a process (expressed in percentage, not in cpu time). This is useful to control batch jobs, when you don't want them to eat too much cpu. + If sudo right is given to the program for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*cpulimit*" AND Processes.process="*-l*" AND Processes.process="*-f*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_cpulimit_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/cpulimit/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml new file mode 100644 index 0000000000..8c1f1b8af7 --- /dev/null +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Csvtool Privilege Escalation +id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: csvtool is an easy to use command-line tool to work with .CSV files. + If sudo right is given to the tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*csvtool*" AND Processes.process="*call*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_csvtool_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/csvtool/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml new file mode 100644 index 0000000000..3c24919fa2 --- /dev/null +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Octave Privilege Escalation +id: 78f7487d-42ce-4f7f-8685-2159b25fb477 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: GNU Octave is a high-level programming language primarily intended for scientific computing and numerical computation. Octave helps in solving linear and nonlinear problems numerically, and for performing other numerical experiments using a language that is mostly compatible with MATLAB. + If sudo right is given to the application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*openvpn*" AND Processes.process="*--dev*" AND Processes.process="*--script-security*" AND Processes.process="*--up*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_octave_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/octave/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml new file mode 100644 index 0000000000..47c8393837 --- /dev/null +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux OpenVPN Privilege Escalation +id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: OpenVPN is a virtual private network system that implements techniques to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It implements both client and server applications. + If sudo right is given to the OpenVPN application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*openvpn*" AND Processes.process="*--dev*" AND Processes.process="*--script-security*" AND Processes.process="*--up*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_openvpn_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/openvpn/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml new file mode 100644 index 0000000000..a4970ab658 --- /dev/null +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Puppet Privilege Escalation +id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: In computing, Puppet is a software configuration management tool which includes its own declarative language to describe system configuration. It is a model-driven solution that requires limited programming knowledge to use. + If sudo right is given to the tool for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*puppet*" AND Processes.process="*apply*" AND Processes.process="*-e*" AND Processes.process="*exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_puppet_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/puppet/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml new file mode 100644 index 0000000000..b70ff47da6 --- /dev/null +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -0,0 +1,67 @@ +name: Linux Sqlite3 Privilege Escalation +id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1 +version: 1 +date: '2022-08-11' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: sqlite3 is a terminal-based front-end to the SQLite library that can evaluate queries interactively and display the results in multiple formats. sqlite3 can also be used within shell scripts and other applications to provide batch processing features. + If sudo right is given to this application for the user, then the user can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*sqlite3*" AND Processes.process="*.shell*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_sqlite3_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives may be present, filter as needed. +references: +- https://gtfobins.github.io/gtfobins/sqlite3/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint + \ No newline at end of file diff --git a/tests/endpoint/linux_apt_get_privilege_escalation.test.yml b/tests/endpoint/linux_apt_get_privilege_escalation.test.yml new file mode 100644 index 0000000000..9829c994f1 --- /dev/null +++ b/tests/endpoint/linux_apt_get_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux apt-get Privilege Escalation Unit Test +tests: +- name: Linux apt-get Privilege Escalation + file: endpoint/linux_apt_get_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_apt_privilege_escalation.test.yml b/tests/endpoint/linux_apt_privilege_escalation.test.yml new file mode 100644 index 0000000000..803e9657d2 --- /dev/null +++ b/tests/endpoint/linux_apt_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux APT Privilege Escalation Unit Test +tests: +- name: Linux APT Privilege Escalation + file: endpoint/linux_apt_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_busybox_privilege_escalation.test.yml b/tests/endpoint/linux_busybox_privilege_escalation.test.yml new file mode 100644 index 0000000000..09e4b5d56d --- /dev/null +++ b/tests/endpoint/linux_busybox_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Busybox Privilege Escalation Unit Test +tests: +- name: Linux Busybox Privilege Escalation + file: endpoint/linux_busybox_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_c89_privilege_escalation.test.yml b/tests/endpoint/linux_c89_privilege_escalation.test.yml new file mode 100644 index 0000000000..45a93c1b62 --- /dev/null +++ b/tests/endpoint/linux_c89_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux c89 Privilege Escalation Unit Test +tests: +- name: Linux c89 Privilege Escalation + file: endpoint/linux_c89_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_c99_privilege_escalation.test.yml b/tests/endpoint/linux_c99_privilege_escalation.test.yml new file mode 100644 index 0000000000..85345a02f6 --- /dev/null +++ b/tests/endpoint/linux_c99_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux c99 Privilege Escalation Unit Test +tests: +- name: Linux c99 Privilege Escalation + file: endpoint/linux_c99_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_composer_privilege_escalation.test.yml b/tests/endpoint/linux_composer_privilege_escalation.test.yml new file mode 100644 index 0000000000..d49e07931c --- /dev/null +++ b/tests/endpoint/linux_composer_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Composer Privilege Escalation Unit Test +tests: +- name: Linux Composer Privilege Escalation + file: endpoint/linux_composer_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_cpulimit_privilege_escalation.test.yml b/tests/endpoint/linux_cpulimit_privilege_escalation.test.yml new file mode 100644 index 0000000000..8a0bc30aff --- /dev/null +++ b/tests/endpoint/linux_cpulimit_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Cpulimit Privilege Escalation Unit Test +tests: +- name: Linux Cpulimit Privilege Escalation + file: endpoint/linux_cpulimit_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_csvtool_privilege_escalation.test.yml b/tests/endpoint/linux_csvtool_privilege_escalation.test.yml new file mode 100644 index 0000000000..43b83fb0e7 --- /dev/null +++ b/tests/endpoint/linux_csvtool_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Csvtool Privilege Escalation Unit Test +tests: +- name: Linux Csvtool Privilege Escalation + file: endpoint/linux_csvtool_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_octave_privilege_escalation.test.yml b/tests/endpoint/linux_octave_privilege_escalation.test.yml new file mode 100644 index 0000000000..7c7bfe2c20 --- /dev/null +++ b/tests/endpoint/linux_octave_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Octave Privilege Escalation Unit Test +tests: +- name: Linux Octave Privilege Escalation + file: endpoint/linux_octave_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_openvpn_privilege_escalation.test.yml b/tests/endpoint/linux_openvpn_privilege_escalation.test.yml new file mode 100644 index 0000000000..357ff46af6 --- /dev/null +++ b/tests/endpoint/linux_openvpn_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux OpenVPN Privilege Escalation Unit Test +tests: +- name: Linux OpenVPN Privilege Escalation + file: endpoint/linux_openvpn_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_puppet_privilege_escalation.test.yml b/tests/endpoint/linux_puppet_privilege_escalation.test.yml new file mode 100644 index 0000000000..2f0228e45e --- /dev/null +++ b/tests/endpoint/linux_puppet_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Puppet Privilege Escalation Unit Test +tests: +- name: Linux Puppet Privilege Escalation + file: endpoint/linux_puppet_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_sqlite3_privilege_escalation.test.yml b/tests/endpoint/linux_sqlite3_privilege_escalation.test.yml new file mode 100644 index 0000000000..a2131d172a --- /dev/null +++ b/tests/endpoint/linux_sqlite3_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Sqlite3 Privilege Escalation Unit Test +tests: +- name: Linux Sqlite3 Privilege Escalation + file: endpoint/linux_sqlite3_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true From 9b4b2a2d23b9c00d4fe6439dec1c46ec4c8a51b5 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Fri, 12 Aug 2022 08:31:07 -0400 Subject: [PATCH 4/7] Update SPL octave --- detections/endpoint/linux_octave_privilege_escalation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index 3c24919fa2..a2994fb93d 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -9,7 +9,7 @@ datamodel: description: GNU Octave is a high-level programming language primarily intended for scientific computing and numerical computation. Octave helps in solving linear and nonlinear problems numerically, and for performing other numerical experiments using a language that is mostly compatible with MATLAB. If sudo right is given to the application for the user, then the user can run system commands as root and possibly get a root shell. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process="*openvpn*" AND Processes.process="*--dev*" AND Processes.process="*--script-security*" AND Processes.process="*--up*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name + as lastTime from datamodel=Endpoint.Processes where Processes.process="*octave-cli*" AND Processes.process="*--eval*" AND Processes.process="*system*" AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_octave_privilege_escalation_filter`' From d8f41b1c5d564f22282c50931ebd8b00570d36ef Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Thu, 18 Aug 2022 11:41:29 -0400 Subject: [PATCH 5/7] update risk sccore --- detections/endpoint/linux_apt_get_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_apt_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_awk_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_busybox_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_c89_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_c99_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_composer_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_cpulimit_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_csvtool_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_docker_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_emacs_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_find_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_gdb_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_gem_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_gnu_awk_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_make_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_mysql_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_node_privilege_escalation.yml | 4 ++-- detections/endpoint/linux_octave_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_openvpn_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_php_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_puppet_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_rpm_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_ruby_privilege_escalation.yml | 6 +++--- detections/endpoint/linux_sqlite3_privilege_escalation.yml | 6 +++--- 25 files changed, 74 insertions(+), 74 deletions(-) diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml index 9d19762fa5..7a95f2b209 100644 --- a/detections/endpoint/linux_apt_get_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log - impact: 80 + impact: 20 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,6 +63,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 10 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml index 428ff084df..81661cf6cf 100644 --- a/detections/endpoint/linux_apt_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log - impact: 80 + impact: 20 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,6 +63,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 10 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index a0f226f099..1dde04329d 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -31,13 +31,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -64,5 +64,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml index f6c5107fcd..a1a2b9ac3b 100644 --- a/detections/endpoint/linux_busybox_privilege_escalation.yml +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log - impact: 80 + impact: 20 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 10 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml index 9cf7bda18b..5bc58d0999 100644 --- a/detections/endpoint/linux_c89_privilege_escalation.yml +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml index 6a4eb12d66..64e9801032 100644 --- a/detections/endpoint/linux_c99_privilege_escalation.yml +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml index 52d1d09cd7..c7294da242 100644 --- a/detections/endpoint/linux_composer_privilege_escalation.yml +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log - impact: 80 + impact: 20 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 10 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml index c7c9a1ca7e..8dcfd64da9 100644 --- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log - impact: 80 + impact: 40 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 20 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml index 8c1f1b8af7..60f7082ee4 100644 --- a/detections/endpoint/linux_csvtool_privilege_escalation.yml +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log - impact: 80 + impact: 20 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 10 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index 0978880cdf..e25a30a0d6 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -31,13 +31,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 30 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log - impact: 80 + impact: 10 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -64,5 +64,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 24 + risk_score: 5 security_domain: endpoint diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml index f843f51621..be280a6f6d 100644 --- a/detections/endpoint/linux_emacs_privilege_escalation.yml +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log - impact: 80 + impact: 40 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,5 +63,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 20 security_domain: endpoint diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml index fba72a7282..b5e9be800d 100644 --- a/detections/endpoint/linux_find_privilege_escalation.yml +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log - impact: 80 + impact: 10 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,5 +63,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 5 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml index 7a823fd4cc..3ee477ab74 100644 --- a/detections/endpoint/linux_gdb_privilege_escalation.yml +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log - impact: 80 + impact: 20 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,5 +62,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 10 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml index 683df05816..f0bdb82069 100644 --- a/detections/endpoint/linux_gem_privilege_escalation.yml +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log - impact: 80 + impact: 20 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,5 +63,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 10 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml index 05d43d3090..810058bca7 100644 --- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,5 +62,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml index a5a2f677f2..783fff7196 100644 --- a/detections/endpoint/linux_make_privilege_escalation.yml +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log - impact: 80 + impact: 40 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,5 +63,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 20 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml index aba8ccd221..bd57f3260e 100644 --- a/detections/endpoint/linux_mysql_privilege_escalation.yml +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,5 +63,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index 8aacf88865..b85675fb4d 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -31,7 +31,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation @@ -64,5 +64,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 40 security_domain: endpoint diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index a2994fb93d..97f73de8f4 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log - impact: 80 + impact: 40 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 20 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml index 47c8393837..763671f60f 100644 --- a/detections/endpoint/linux_openvpn_privilege_escalation.yml +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index 2eb88d67d4..2c0dda6dad 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,5 +63,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml index a4970ab658..d0a1d8f49a 100644 --- a/detections/endpoint/linux_puppet_privilege_escalation.yml +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log - impact: 80 + impact: 10 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 5 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml index 91db232e16..3dea327bd4 100644 --- a/detections/endpoint/linux_rpm_privilege_escalation.yml +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,5 +63,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml index 339fb7ebbb..68ec313b3f 100644 --- a/detections/endpoint/linux_ruby_privilege_escalation.yml +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -30,13 +30,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -63,5 +63,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml index b70ff47da6..9997b70cdf 100644 --- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -29,13 +29,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 90 + confidence: 50 context: - Source:Endpoint - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: A commandline $process$ with process $process_name$ on $dest$ @@ -62,6 +62,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 30 security_domain: endpoint \ No newline at end of file From 75b2daa44989d213664bc62d048f28ad58b76dcc Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Thu, 18 Aug 2022 14:09:25 -0400 Subject: [PATCH 6/7] Update msg and ref --- .../endpoint/linux_apt_get_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_apt_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_awk_privilege_escalation.yml | 10 +++++++++- .../endpoint/linux_busybox_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_c89_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_c99_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_composer_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_cpulimit_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_csvtool_privilege_escalation.yml | 10 +++++++++- .../endpoint/linux_docker_privilege_escalation.yml | 10 +++++++++- .../endpoint/linux_emacs_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_find_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_gdb_privilege_escalation.yml | 10 +++++++++- .../endpoint/linux_gem_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_gnu_awk_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_make_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_mysql_privilege_escalation.yml | 10 +++++++++- .../endpoint/linux_node_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_octave_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_openvpn_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_php_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_puppet_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_rpm_privilege_escalation.yml | 11 ++++++++++- .../endpoint/linux_ruby_privilege_escalation.yml | 10 +++++++++- .../endpoint/linux_sqlite3_privilege_escalation.yml | 11 ++++++++++- 25 files changed, 244 insertions(+), 25 deletions(-) diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml index 7a95f2b209..406090fa88 100644 --- a/detections/endpoint/linux_apt_get_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/apt-get/ +- https://phoenixnap.com/kb/how-to-use-apt-get-commands tags: analytic_story: - Linux Privilege Escalation @@ -39,7 +40,7 @@ tags: impact: 20 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml index 81661cf6cf..a6a5866538 100644 --- a/detections/endpoint/linux_apt_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/apt/ +- https://www.digitalocean.com/community/tutorials/what-is-apt tags: analytic_story: - Linux Privilege Escalation @@ -39,7 +40,7 @@ tags: impact: 20 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index 1dde04329d..1793abae71 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -40,7 +40,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -51,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml index a1a2b9ac3b..5295561a8a 100644 --- a/detections/endpoint/linux_busybox_privilege_escalation.yml +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/busybox/ +- https://man.archlinux.org/man/busybox.1.en tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 20 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml index 5bc58d0999..9cca0b07ea 100644 --- a/detections/endpoint/linux_c89_privilege_escalation.yml +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/c89/ +- https://www.ibm.com/docs/en/zos/2.1.0?topic=guide-c89-compiler-invocation-using-host-environment-variables tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml index 64e9801032..853b9ae571 100644 --- a/detections/endpoint/linux_c99_privilege_escalation.yml +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/c99/ +- https://pubs.opengroup.org/onlinepubs/009604499/utilities/c99.html tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml index c7294da242..811a09951e 100644 --- a/detections/endpoint/linux_composer_privilege_escalation.yml +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/composer/ +- https://getcomposer.org/doc/00-intro.md tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 20 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml index 8dcfd64da9..5ad71f7abe 100644 --- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/cpulimit/ +- http://cpulimit.sourceforge.net/ tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 40 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml index 60f7082ee4..b65e2e3d4c 100644 --- a/detections/endpoint/linux_csvtool_privilege_escalation.yml +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -38,7 +38,7 @@ tags: impact: 20 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +49,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index e25a30a0d6..e08d61714d 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -40,7 +40,7 @@ tags: impact: 10 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -51,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml index be280a6f6d..c2508edf1b 100644 --- a/detections/endpoint/linux_emacs_privilege_escalation.yml +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/emacs/ +- https://en.wikipedia.org/wiki/Emacs tags: analytic_story: - Linux Privilege Escalation @@ -39,7 +40,7 @@ tags: impact: 40 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml index b5e9be800d..60aae7426a 100644 --- a/detections/endpoint/linux_find_privilege_escalation.yml +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: - https://gtfobins.github.io/gtfobins/find/ +- https://en.wikipedia.org/wiki/Find_(Unix) tags: analytic_story: - Linux Privilege Escalation @@ -39,7 +40,7 @@ tags: impact: 10 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml index 3ee477ab74..3e92c96fe8 100644 --- a/detections/endpoint/linux_gdb_privilege_escalation.yml +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -38,7 +38,7 @@ tags: impact: 20 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +49,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml index f0bdb82069..bbd3f72bc1 100644 --- a/detections/endpoint/linux_gem_privilege_escalation.yml +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/gem/ +- https://en.wikipedia.org/wiki/RubyGems tags: analytic_story: - Linux Privilege Escalation @@ -39,7 +40,7 @@ tags: impact: 20 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml index 810058bca7..118653558f 100644 --- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/gawk/ +- https://www.geeksforgeeks.org/gawk-command-in-linux-with-examples/ tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml index 783fff7196..e4429914d3 100644 --- a/detections/endpoint/linux_make_privilege_escalation.yml +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/make/ +- https://www.javatpoint.com/linux-make-command tags: analytic_story: - Linux Privilege Escalation @@ -39,7 +40,7 @@ tags: impact: 40 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml index bd57f3260e..90f0fe98e3 100644 --- a/detections/endpoint/linux_mysql_privilege_escalation.yml +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -39,7 +39,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index b85675fb4d..655590e998 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -22,6 +22,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: - https://gtfobins.github.io/gtfobins/docker/ +- https://en.wikipedia.org/wiki/Node.js tags: analytic_story: - Linux Privilege Escalation @@ -40,7 +41,7 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -51,6 +52,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index 97f73de8f4..a56d08f551 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/octave/ +- https://en.wikipedia.org/wiki/GNU_Octave tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 40 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml index 763671f60f..bef6045dd5 100644 --- a/detections/endpoint/linux_openvpn_privilege_escalation.yml +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/openvpn/ +- https://en.wikipedia.org/wiki/OpenVPN tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index 2c0dda6dad..aade9f694e 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/php/ +- https://en.wikipedia.org/wiki/PHP tags: analytic_story: - Linux Privilege Escalation @@ -39,7 +40,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml index d0a1d8f49a..d11c93bd28 100644 --- a/detections/endpoint/linux_puppet_privilege_escalation.yml +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/puppet/ +- https://en.wikipedia.org/wiki/Puppet_(software) tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 10 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml index 3dea327bd4..f5b27342ab 100644 --- a/detections/endpoint/linux_rpm_privilege_escalation.yml +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -21,6 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: - https://gtfobins.github.io/gtfobins/rpm/ +- https://en.wikipedia.org/wiki/RPM_Package_Manager tags: analytic_story: - Linux Privilege Escalation @@ -39,7 +40,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +51,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml index 68ec313b3f..791abf8e33 100644 --- a/detections/endpoint/linux_ruby_privilege_escalation.yml +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -39,7 +39,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -50,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml index 9997b70cdf..553b165127 100644 --- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives may be present, filter as needed. references: - https://gtfobins.github.io/gtfobins/sqlite3/ +- https://manpages.ubuntu.com/manpages/trusty/en/man1/sqlite3.1.html tags: analytic_story: - Linux Privilege Escalation @@ -38,7 +39,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A commandline $process$ with process $process_name$ on $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ mitre_attack_id: - T1548.003 - T1548 @@ -49,6 +50,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security From e0f0d48784a8966a6e04f1aa1b0a214fbb23bdba Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 26 Aug 2022 10:46:51 -0500 Subject: [PATCH 7/7] minonr text updates --- detections/endpoint/linux_apt_get_privilege_escalation.yml | 4 ++-- detections/endpoint/linux_apt_privilege_escalation.yml | 2 +- detections/endpoint/linux_at_allow_config_file_creation.yml | 2 +- detections/endpoint/linux_at_application_execution.yml | 2 +- detections/endpoint/linux_awk_privilege_escalation.yml | 2 +- detections/endpoint/linux_busybox_privilege_escalation.yml | 2 +- detections/endpoint/linux_c89_privilege_escalation.yml | 2 +- detections/endpoint/linux_c99_privilege_escalation.yml | 2 +- detections/endpoint/linux_composer_privilege_escalation.yml | 2 +- detections/endpoint/linux_cpulimit_privilege_escalation.yml | 2 +- detections/endpoint/linux_csvtool_privilege_escalation.yml | 2 +- detections/endpoint/linux_docker_privilege_escalation.yml | 2 +- detections/endpoint/linux_emacs_privilege_escalation.yml | 2 +- detections/endpoint/linux_find_privilege_escalation.yml | 2 +- detections/endpoint/linux_gdb_privilege_escalation.yml | 2 +- detections/endpoint/linux_gem_privilege_escalation.yml | 2 +- detections/endpoint/linux_gnu_awk_privilege_escalation.yml | 2 +- detections/endpoint/linux_make_privilege_escalation.yml | 2 +- detections/endpoint/linux_mysql_privilege_escalation.yml | 2 +- detections/endpoint/linux_node_privilege_escalation.yml | 2 +- detections/endpoint/linux_octave_privilege_escalation.yml | 2 +- detections/endpoint/linux_openvpn_privilege_escalation.yml | 2 +- detections/endpoint/linux_php_privilege_escalation.yml | 2 +- detections/endpoint/linux_puppet_privilege_escalation.yml | 2 +- detections/endpoint/linux_rpm_privilege_escalation.yml | 2 +- detections/endpoint/linux_ruby_privilege_escalation.yml | 2 +- detections/endpoint/linux_sqlite3_privilege_escalation.yml | 2 +- 27 files changed, 28 insertions(+), 28 deletions(-) diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml index 406090fa88..73a9817d54 100644 --- a/detections/endpoint/linux_apt_get_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -6,7 +6,7 @@ author: Gowthamaraj Rajendran, Splunk type: Anomaly datamodel: - Endpoint -description: apt-get is a command line tool for interacting with the Advanced Package Tool (APT) library (a package management system for Linux distributions). +description: The apt-get is a command line tool for interacting with the Advanced Package Tool (APT) library (a package management system for Linux distributions). It allows you to search for, install, manage, update, and remove software. The tool does not build software from the source code. If sudo right is given to the tool for user, then the user can run system commands as root and possibly get a root shell. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_apt_get_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml index a6a5866538..c97f1cddaf 100644 --- a/detections/endpoint/linux_apt_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_apt_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 4c427723b9..0b3df8a994 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. + logs with the file name, file path, and process_guid executions from your endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can create this file for automation purposes. Please update the filter macros to remove false positives. diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index b22f70ca9c..dcc13d9d23 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index 1793abae71..5c46d8cf02 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml index 5295561a8a..0e91760cde 100644 --- a/detections/endpoint/linux_busybox_privilege_escalation.yml +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_busybox_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml index 9cca0b07ea..d84c290fd4 100644 --- a/detections/endpoint/linux_c89_privilege_escalation.yml +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_c89_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml index 853b9ae571..2038ded0d0 100644 --- a/detections/endpoint/linux_c99_privilege_escalation.yml +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_c99_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml index 811a09951e..eeea676413 100644 --- a/detections/endpoint/linux_composer_privilege_escalation.yml +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_composer_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml index 5ad71f7abe..3e9d9a4ac5 100644 --- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_cpulimit_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml index b65e2e3d4c..8bc9648820 100644 --- a/detections/endpoint/linux_csvtool_privilege_escalation.yml +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_csvtool_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index e08d61714d..5d5b54b728 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml index c2508edf1b..e822940a15 100644 --- a/detections/endpoint/linux_emacs_privilege_escalation.yml +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_emacs_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml index 60aae7426a..ca78952396 100644 --- a/detections/endpoint/linux_find_privilege_escalation.yml +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_find_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml index 3e92c96fe8..1c5f21fdc5 100644 --- a/detections/endpoint/linux_gdb_privilege_escalation.yml +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_gdb_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml index bbd3f72bc1..b0f19d396f 100644 --- a/detections/endpoint/linux_gem_privilege_escalation.yml +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_gem_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml index 118653558f..7af0ed031d 100644 --- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_gnu_awk_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml index e4429914d3..8726cbb5c7 100644 --- a/detections/endpoint/linux_make_privilege_escalation.yml +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_make_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml index 90f0fe98e3..9477824818 100644 --- a/detections/endpoint/linux_mysql_privilege_escalation.yml +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_mysql_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index 655590e998..7777ca5af1 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index a56d08f551..6ca28729dd 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_octave_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml index bef6045dd5..815661fe1e 100644 --- a/detections/endpoint/linux_openvpn_privilege_escalation.yml +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_openvpn_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index aade9f694e..981de3f02b 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_php_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml index d11c93bd28..a9b4a0ea77 100644 --- a/detections/endpoint/linux_puppet_privilege_escalation.yml +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_puppet_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml index f5b27342ab..3f98f29155 100644 --- a/detections/endpoint/linux_rpm_privilege_escalation.yml +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_rpm_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml index 791abf8e33..2dbe677e07 100644 --- a/detections/endpoint/linux_ruby_privilege_escalation.yml +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_ruby_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml index 553b165127..6d336d41ed 100644 --- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_sqlite3_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: False positives may be present, filter as needed. references: