From acbeeb7f236112a8818229bf62578969bdfc0712 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 6 Dec 2024 09:28:19 +0100 Subject: [PATCH 1/2] linux_datasource_update --- data_sources/linux_auditd_add_user.yml | 1 + data_sources/linux_auditd_execve.yml | 1 + data_sources/linux_auditd_path.yml | 1 + data_sources/linux_auditd_proctitle.yml | 1 + data_sources/linux_auditd_service_stop.yml | 1 + data_sources/linux_auditd_syscall.yml | 1 + 6 files changed, 6 insertions(+) diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 00f77c2930..c1d4736a2e 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk description: Data source object for Linux Auditd Add User Type source: /var/log/audit/audit.log sourcetype: linux:audit +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index c9287b2adf..0752725a0f 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk description: Data source object for Linux Auditd Execve Type source: /var/log/audit/audit.log sourcetype: linux:audit +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 14e850d8b0..03703ad47b 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk description: Data source object for Linux Auditd Path Type source: /var/log/audit/audit.log sourcetype: linux:audit +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index d4e194e9bf..4831ba4585 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk description: Data source object for Linux Auditd Proctitle Type source: /var/log/audit/audit.log sourcetype: linux:audit +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index d06f7b7ccb..151da0bdca 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk description: Data source object for Linux Auditd Service Stop Type source: /var/log/audit/audit.log sourcetype: linux:audit +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index 326bb8910a..73a300e2be 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk description: Data source object for Linux Auditd Syscall Type source: /var/log/audit/audit.log sourcetype: linux:audit +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 From 6d020a74b1633840d64f9da84de2637e5ec64eed Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 9 Dec 2024 16:53:07 +0100 Subject: [PATCH 2/2] fix #2996 --- .../endpoint/known_services_killed_by_ransomware.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index d313569af9..a23a218e59 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -1,7 +1,7 @@ name: Known Services Killed by Ransomware id: 3070f8e0-c528-11eb-b2a0-acde48001122 -version: '6' -date: '2024-11-28' +version: 7 +date: '2024-12-09' author: Teoderick Contreras, Splunk status: production type: TTP @@ -18,8 +18,8 @@ data_source: search: '`wineventlog_system` EventCode=7036 param1 IN ("*Volume Shadow Copy*","*VSS*", "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*", "DefWatch", "ccEvtMgr", "ccSetMgr", "SavRoam", "RTVscan", "QBFCService", "QBIDPService", "Intuit.QuickBooks.FCS", - "QBCFMonitorService" "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExecVSSProvider", - "BackupExecAgentAccelerator", "BackupExec*", "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", + "QBCFMonitorService", "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExec*", + "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", "WinDefend", "wscsvc", "Sense", "sppsvc", "SecurityHealthService") param2="stopped" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode param1 dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`