From e21247f2d297f48dee2650b59b845861fc685531 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 23 Dec 2021 12:31:05 +0100 Subject: [PATCH 01/29] linux_persist_priv_batch_2 --- ...x_file_creation_in_init_boot_directory.yml | 67 +++++++++++++++++ ...nux_file_creation_in_profile_directory.yml | 69 ++++++++++++++++++ ...vice_file_created_in_systemd_directory.yml | 71 ++++++++++++++++++ .../endpoint/linux_service_restarted.yml | 70 ++++++++++++++++++ .../linux_service_started_or_enabled.yml | 73 +++++++++++++++++++ .../linux_setuid_using_chmod_utility.yml | 72 ++++++++++++++++++ .../linux_setuid_using_setcap_utility.yml | 73 +++++++++++++++++++ ...e_creation_in_init_boot_directory.test.yml | 12 +++ ...ile_creation_in_profile_directory.test.yml | 12 +++ ...file_created_in_systemd_directory.test.yml | 12 +++ .../endpoint/linux_service_restarted.test.yml | 12 +++ .../linux_service_started_or_enabled.test.yml | 12 +++ .../linux_setuid_using_chmod_utility.test.yml | 12 +++ ...linux_setuid_using_setcap_utility.test.yml | 12 +++ 14 files changed, 579 insertions(+) create mode 100644 detections/endpoint/linux_file_creation_in_init_boot_directory.yml create mode 100644 detections/endpoint/linux_file_creation_in_profile_directory.yml create mode 100644 detections/endpoint/linux_service_file_created_in_systemd_directory.yml create mode 100644 detections/endpoint/linux_service_restarted.yml create mode 100644 detections/endpoint/linux_service_started_or_enabled.yml create mode 100644 detections/endpoint/linux_setuid_using_chmod_utility.yml create mode 100644 detections/endpoint/linux_setuid_using_setcap_utility.yml create mode 100644 tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml create mode 100644 tests/endpoint/linux_file_creation_in_profile_directory.test.yml create mode 100644 tests/endpoint/linux_service_file_created_in_systemd_directory.test.yml create mode 100644 tests/endpoint/linux_service_restarted.test.yml create mode 100644 tests/endpoint/linux_service_started_or_enabled.test.yml create mode 100644 tests/endpoint/linux_setuid_using_chmod_utility.test.yml create mode 100644 tests/endpoint/linux_setuid_using_setcap_utility.test.yml diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml new file mode 100644 index 0000000000..825030f1fe --- /dev/null +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -0,0 +1,67 @@ +name: Linux File Creation In Init Boot Directory +id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious file creation on init system directories for automatic execution of script or file upon boot up. + This technique is commonly abuse by adversaries, malware author and red teamer to persist on the targeted or compromised host. + Even this even is really need to be monitor administrator or network operator can still add script files or binary files as part of a task or automation. filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path IN ("*/etc/init.d/*", "*/etc/rc.d/*", "*/sbin/init.d/*", "*/etc/rc.local*") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `linux_file_creation_in_init_boot_directory_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can create file in this folders for automation purposes. filter is needed +references: +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1037.004 + - T1037 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml new file mode 100644 index 0000000000..db9052877f --- /dev/null +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -0,0 +1,69 @@ +name: Linux File Creation In Profile Directory +id: 46ba0082-61af-11ec-9826-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious file creation in /etc/profile.d directory to automatically execute scripts by shell upon boot of machine. + This technique is commonly abused by adversaries, malware and red teamers as persistence mechanism to the targeted or compromised host. + This Anomaly detection is a good indicator that someone wants to run code after boot up which can be done also by the administrator or network operator for + automation purposes. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path IN ("*/etc/profile.d/*") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `linux_file_creation_in_profile_directory_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can create file in profile.d folders for automation purposes. filter is needed +references: +- https://attack.mitre.org/techniques/T1546/004/ +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1546.004 + - T1546 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml new file mode 100644 index 0000000000..77dab789e1 --- /dev/null +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -0,0 +1,71 @@ +name: Linux Service File Created In Systemd Directory +id: c7495048-61b6-11ec-9a37-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious file creation in systemd timer directory in linux platform. + systemd is a system and service manager for Linux distributions. From the Windows perspective, this process fulfills the duties of wininit.exe and services.exe combined. + At the risk of simplifying the functionality of systemd, it initializes a Linux system and starts relevant services that are defined in service unit files. + Adversaries, malware and red teamers may abuse this this feature by stashing systemd service file to persist on the targetted or compromised host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name = *.service Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", + "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*", "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `linux_service_file_created_in_systemd_directory_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can create file in systemd folders for automation purposes. filter is needed +references: +- https://attack.mitre.org/techniques/T1053/006/ +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +- https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/ +- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.006 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a service file named as $file_path$ is created in systemd folder on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml new file mode 100644 index 0000000000..93e6268e29 --- /dev/null +++ b/detections/endpoint/linux_service_restarted.yml @@ -0,0 +1,70 @@ +name: Linux Service Restarted +id: 084275ba-61b8-11ec-8d64-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for restarted or re-enable services in linux platform. + This technique can be executed or performed using systemctl or service tool application. + Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. + When Windows boots up, it starts programs or applications called services that perform background system functions. Administrator may also create + a legitimated service for a specific tool or normal application as part of task or automation, in this scenario it is suggested to look for the service path + of the actual script or executable that register as service and who created the service for further verification. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) + Processes.process IN ("*restart*", "*reload*", “*reenable*”) + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.006 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that may create or start a service on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml new file mode 100644 index 0000000000..bf32694278 --- /dev/null +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -0,0 +1,73 @@ +name: Linux Service Started Or Enabled +id: e0428212-61b7-11ec-88a3-acde48001122 +version: 1 +date: '2021-12-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for created or enable services in linux platform. + This technique can be executed or performed using systemctl or service tool application. + Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. + When Windows boots up, it starts programs or applications called services that perform background system functions. Administrator may also create + a legitimated service for a specific tool or normal application as part of task or automation, in this scenario it is suggested to look for the service path + of the actual script or executable that register as service and who created the service for further verification. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) + Processes.process IN ("* start *", "* enable *") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_service_started_or_enabled_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.006 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that may create or start a service on $dest + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml new file mode 100644 index 0000000000..77f0b473f9 --- /dev/null +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -0,0 +1,72 @@ +name: Linux Setuid Using Chmod Utility +id: bf0304b6-6250-11ec-9d7c-acde48001122 +version: 1 +date: '2021-12-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious chmod utility execution to enable SUID bit. + This allows a user to temporarily gain root access, usually in order to run a program. + For example, only the root account is allowed to change the password information contained in the password database; + If the SUID bit appears as an s, the file's owner also has execute permission to the file; if it appears as an S, the file's owner does not have execute permission. + The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, + except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", “* 4777 *”, "* 4577 *") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_setuid_using_chmod_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. filter is needed +references: +- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.001 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that may set suid or sgid on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml new file mode 100644 index 0000000000..4bcbd30d62 --- /dev/null +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -0,0 +1,73 @@ +name: Linux Setuid Using Setcap Utility +id: 9d96022e-6250-11ec-9a19-acde48001122 +version: 1 +date: '2021-12-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious setcap utility execution to enable SUID bit. + This allows a user to temporarily gain root access, usually in order to run a program. + For example, only the root account is allowed to change the password information contained in the password database; + If the SUID bit appears as an s, the file's owner also has execute permission to the file; if it appears as an S, the file's owner does not have execute permission. + The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, + except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. +search: '| | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = setcap OR Processes.process = "*setcap *") + AND Processes.process IN ("* cap_setuid=ep *", "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep *") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_setuid_using_setcap_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. filter is needed +references: +- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.001 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that may set suid or sgid on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml b/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml new file mode 100644 index 0000000000..7ad16aa6ac --- /dev/null +++ b/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml @@ -0,0 +1,12 @@ +name: Linux File Creation In Init Boot Directory Unit Test +tests: +- name: Linux File Creation In Init Boot Directory + file: endpoint/linux_file_creation_in_init_boot_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_file_creation_in_profile_directory.test.yml b/tests/endpoint/linux_file_creation_in_profile_directory.test.yml new file mode 100644 index 0000000000..deb43e7aef --- /dev/null +++ b/tests/endpoint/linux_file_creation_in_profile_directory.test.yml @@ -0,0 +1,12 @@ +name: Linux File Creation In Profile Directory Unit Test +tests: +- name: Linux File Creation In Profile Directory + file: endpoint/linux_file_creation_in_profile_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_service_file_created_in_systemd_directory.test.yml b/tests/endpoint/linux_service_file_created_in_systemd_directory.test.yml new file mode 100644 index 0000000000..a0077344c5 --- /dev/null +++ b/tests/endpoint/linux_service_file_created_in_systemd_directory.test.yml @@ -0,0 +1,12 @@ +name: Linux Service File Created In Systemd Directory Unit Test +tests: +- name: Linux Service File Created In Systemd Directory + file: endpoint/linux_service_file_created_in_systemd_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_service_restarted.test.yml b/tests/endpoint/linux_service_restarted.test.yml new file mode 100644 index 0000000000..4820bcc88a --- /dev/null +++ b/tests/endpoint/linux_service_restarted.test.yml @@ -0,0 +1,12 @@ +name: Linux Service Restarted Unit Test +tests: +- name: Linux Service Restarted + file: endpoint/linux_service_restarted.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_service_started_or_enabled.test.yml b/tests/endpoint/linux_service_started_or_enabled.test.yml new file mode 100644 index 0000000000..f37ad6c647 --- /dev/null +++ b/tests/endpoint/linux_service_started_or_enabled.test.yml @@ -0,0 +1,12 @@ +name: Linux Service Started Or Enabled Unit Test +tests: +- name: Linux Service Started Or Enabled + file: endpoint/linux_service_started_or_enabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_setuid_using_chmod_utility.test.yml b/tests/endpoint/linux_setuid_using_chmod_utility.test.yml new file mode 100644 index 0000000000..31051cbd83 --- /dev/null +++ b/tests/endpoint/linux_setuid_using_chmod_utility.test.yml @@ -0,0 +1,12 @@ +name: Linux Setuid Using Chmod Utility Unit Test +tests: +- name: Linux Setuid Using Chmod Utility + file: endpoint/linux_setuid_using_chmod_utility.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_setuid_using_setcap_utility.test.yml b/tests/endpoint/linux_setuid_using_setcap_utility.test.yml new file mode 100644 index 0000000000..2742ee77cd --- /dev/null +++ b/tests/endpoint/linux_setuid_using_setcap_utility.test.yml @@ -0,0 +1,12 @@ +name: Linux Setuid Using Setcap Utility Unit Test +tests: +- name: Linux Setuid Using Setcap Utility + file: endpoint/linux_setuid_using_setcap_utility.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file From 780aa81877ffabec41a0104ad1ea0671ea1a6245 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 3 Jan 2022 10:40:56 +0100 Subject: [PATCH 02/29] Update linux_setuid_using_setcap_utility.yml --- detections/endpoint/linux_setuid_using_setcap_utility.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index 4bcbd30d62..b3b45fe2ee 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -12,7 +12,7 @@ description: This analytic looks for suspicious setcap utility execution to enab If the SUID bit appears as an s, the file's owner also has execute permission to the file; if it appears as an S, the file's owner does not have execute permission. The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. -search: '| | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = setcap OR Processes.process = "*setcap *") AND Processes.process IN ("* cap_setuid=ep *", "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid @@ -70,4 +70,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 From 00521f06a5bc104789136d15733202b0527b0068 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 Jan 2022 10:04:59 +0000 Subject: [PATCH 03/29] Added detection testing service results inLinux Setuid Using Setcap Utility --- .../linux_setuid_using_setcap_utility.yml | 52 ++++++++++--------- 1 file changed, 28 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index b3b45fe2ee..bd81ad5b7b 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -6,27 +6,31 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious setcap utility execution to enable SUID bit. - This allows a user to temporarily gain root access, usually in order to run a program. - For example, only the root account is allowed to change the password information contained in the password database; - If the SUID bit appears as an s, the file's owner also has execute permission to the file; if it appears as an S, the file's owner does not have execute permission. - The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, - except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = setcap OR Processes.process = "*setcap *") - AND Processes.process IN ("* cap_setuid=ep *", "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep *") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic looks for suspicious setcap utility execution to enable + SUID bit. This allows a user to temporarily gain root access, usually in order to + run a program. For example, only the root account is allowed to change the password + information contained in the password database; If the SUID bit appears as an s, + the file's owner also has execute permission to the file; if it appears as an S, + the file's owner does not have execute permission. The second specialty permission + is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily + change group membership, usually to execute a program. The SGID bit is set if an + s or an S appears in the group section of permissions. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = setcap + OR Processes.process = "*setcap *") AND Processes.process IN ("* cap_setuid=ep *", + "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep + *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_setuid_using_setcap_utility_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. filter is needed + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. + filter is needed references: -- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ +- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ tags: analytic_story: - Linux Privilege Escalation @@ -44,17 +48,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - source:endpoint @@ -71,3 +74,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 + automated_detection_testing: passed From 72f7bb0676863ca83df0ed0575600c44e6045f82 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 Jan 2022 10:35:34 +0000 Subject: [PATCH 04/29] Added detection testing service results inLinux Service Started Or Enabled --- .../linux_service_started_or_enabled.yml | 55 ++++++++++--------- 1 file changed, 29 insertions(+), 26 deletions(-) diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml index bf32694278..4d71368b8a 100644 --- a/detections/endpoint/linux_service_started_or_enabled.yml +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -7,32 +7,35 @@ type: Anomaly datamodel: - Endpoint description: This analytic looks for created or enable services in linux platform. - This technique can be executed or performed using systemctl or service tool application. - Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. - When Windows boots up, it starts programs or applications called services that perform background system functions. Administrator may also create - a legitimated service for a specific tool or normal application as part of task or automation, in this scenario it is suggested to look for the service path - of the actual script or executable that register as service and who created the service for further verification. + This technique can be executed or performed using systemctl or service tool application. + Adversaries may create or modify Windows services to repeatedly execute malicious + payloads as part of persistence. When Windows boots up, it starts programs or applications + called services that perform background system functions. Administrator may also + create a legitimated service for a specific tool or normal application as part of + task or automation, in this scenario it is suggested to look for the service path + of the actual script or executable that register as service and who created the + service for further verification. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) - Processes.process IN ("* start *", "* enable *") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_service_started_or_enabled_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", + "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process + IN ("* start *", "* enable *") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_service_started_or_enabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed + Sysmon TA. +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. filter is needed references: -- https://attack.mitre.org/techniques/T1543/003/ +- https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log kill_chain_phases: - Privilege Escalation mitre_attack_id: @@ -44,18 +47,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 60 - confidence: 70 - # (impact * confidence)/100 - risk_score: 42 + confidence: 70 + risk_score: 42 context: - source:endpoint - stage:Privilege Escalation Persistence @@ -70,4 +72,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From f85658f1a0c9c479e2c564883fa771dbd20e1395 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 3 Jan 2022 12:25:08 +0100 Subject: [PATCH 05/29] linux_persist_priv_batch_2 --- detections/endpoint/linux_setuid_using_chmod_utility.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index 77f0b473f9..e635151fd9 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -6,9 +6,8 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious chmod utility execution to enable SUID bit. - This allows a user to temporarily gain root access, usually in order to run a program. - For example, only the root account is allowed to change the password information contained in the password database; +description: This analytic looks for suspicious chmod utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. + For example, only the root account is allowed to change the password information contained in the password database. If the SUID bit appears as an s, the file's owner also has execute permission to the file; if it appears as an S, the file's owner does not have execute permission. The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. From 0140a5a99bf8eedef4194456c4c3973764fc5b4a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 3 Jan 2022 12:54:55 +0100 Subject: [PATCH 06/29] Update linux_setuid_using_chmod_utility.yml --- detections/endpoint/linux_setuid_using_chmod_utility.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index e635151fd9..0bd605c527 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: This analytic looks for suspicious chmod utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. For example, only the root account is allowed to change the password information contained in the password database. - If the SUID bit appears as an s, the file's owner also has execute permission to the file; if it appears as an S, the file's owner does not have execute permission. + If the SUID bit appears as an s, the file owner also has execute permission to the file. if it appears as an S, the file owner does not have execute permission. The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -68,4 +68,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 From 5ea972280c651ffc97e5a6a493823d49a2bb7eec Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 Jan 2022 12:38:40 +0000 Subject: [PATCH 07/29] Added detection testing service results inLinux Service File Created In Systemd Directory --- ...vice_file_created_in_systemd_directory.yml | 48 ++++++++++--------- 1 file changed, 26 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml index 77dab789e1..2347b8f785 100644 --- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -6,22 +6,26 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious file creation in systemd timer directory in linux platform. - systemd is a system and service manager for Linux distributions. From the Windows perspective, this process fulfills the duties of wininit.exe and services.exe combined. - At the risk of simplifying the functionality of systemd, it initializes a Linux system and starts relevant services that are defined in service unit files. - Adversaries, malware and red teamers may abuse this this feature by stashing systemd service file to persist on the targetted or compromised host. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name = *.service Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", - "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*", "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") - by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` +description: This analytic looks for suspicious file creation in systemd timer directory + in linux platform. systemd is a system and service manager for Linux distributions. + From the Windows perspective, this process fulfills the duties of wininit.exe and + services.exe combined. At the risk of simplifying the functionality of systemd, + it initializes a Linux system and starts relevant services that are defined in service + unit files. Adversaries, malware and red teamers may abuse this this feature by + stashing systemd service file to persist on the targetted or compromised host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name = *.service + Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", + "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*", + "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") by Filesystem.dest + Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_service_file_created_in_systemd_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can create file in systemd folders for automation purposes. filter is needed + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: administrator or network operator can create file in systemd + folders for automation purposes. filter is needed references: - https://attack.mitre.org/techniques/T1053/006/ - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ @@ -32,7 +36,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log kill_chain_phases: - Privilege Escalation mitre_attack_id: @@ -44,15 +48,14 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid - Filesystem.file_path security_domain: endpoint impact: 80 - confidence: 80 - # (impact * confidence)/100 + confidence: 80 risk_score: 64 context: - source:endpoint @@ -68,4 +71,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From 7c2874bb1e879f08f88975e8e32b7d9e4f8df9c4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 3 Jan 2022 13:57:17 +0100 Subject: [PATCH 08/29] linux_persist_priv_batch_2 --- detections/endpoint/linux_service_restarted.yml | 2 +- detections/endpoint/linux_setuid_using_chmod_utility.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index 93e6268e29..0940365844 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed references: -- https://attack.mitre.org/techniques/T1543/003/ +- https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index 0bd605c527..7eeace286d 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. known_false_positives: administrator or network operator can execute this command. filter is needed references: -- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ +- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ tags: analytic_story: - Linux Privilege Escalation From 943802aec63e0e7a810a103b0bc271b087dc1c06 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 Jan 2022 13:06:51 +0000 Subject: [PATCH 09/29] Added detection testing service results inLinux File Creation In Profile Directory --- ...nux_file_creation_in_profile_directory.yml | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index db9052877f..a5ddfebb4c 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -6,22 +6,22 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious file creation in /etc/profile.d directory to automatically execute scripts by shell upon boot of machine. - This technique is commonly abused by adversaries, malware and red teamers as persistence mechanism to the targeted or compromised host. - This Anomaly detection is a good indicator that someone wants to run code after boot up which can be done also by the administrator or network operator for - automation purposes. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path IN ("*/etc/profile.d/*") - by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `linux_file_creation_in_profile_directory_filter`' +description: This analytic looks for suspicious file creation in /etc/profile.d directory + to automatically execute scripts by shell upon boot of machine. This technique is + commonly abused by adversaries, malware and red teamers as persistence mechanism + to the targeted or compromised host. This Anomaly detection is a good indicator + that someone wants to run code after boot up which can be done also by the administrator + or network operator for automation purposes. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/profile.d/*") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `linux_file_creation_in_profile_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can create file in profile.d folders for automation purposes. filter is needed + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: administrator or network operator can create file in profile.d + folders for automation purposes. filter is needed references: - https://attack.mitre.org/techniques/T1546/004/ - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ @@ -42,15 +42,14 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid - Filesystem.file_path security_domain: endpoint impact: 70 - confidence: 80 - # (impact * confidence)/100 + confidence: 80 risk_score: 56 context: - source:endpoint @@ -66,4 +65,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From b20d3fed3275154c893d8e3da0b67b21151184f7 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 3 Jan 2022 15:43:18 +0100 Subject: [PATCH 10/29] Update linux_file_creation_in_init_boot_directory.test.yml --- .../linux_file_creation_in_init_boot_directory.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml b/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml index 7ad16aa6ac..c974589469 100644 --- a/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml +++ b/tests/endpoint/linux_file_creation_in_init_boot_directory.test.yml @@ -3,10 +3,10 @@ tests: - name: Linux File Creation In Init Boot Directory file: endpoint/linux_file_creation_in_init_boot_directory.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: sysmon_linux.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux \ No newline at end of file + sourcetype: sysmon_linux From 74b0691d7ab6fd0af9f605a454a06713ee018223 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 3 Jan 2022 15:52:31 +0100 Subject: [PATCH 11/29] Update linux_setuid_using_chmod_utility.yml --- .../endpoint/linux_setuid_using_chmod_utility.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index 7eeace286d..deb15faccf 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -6,11 +6,15 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious chmod utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. - For example, only the root account is allowed to change the password information contained in the password database. - If the SUID bit appears as an s, the file owner also has execute permission to the file. if it appears as an S, the file owner does not have execute permission. - The second specialty permission is the SGID, or set group id bit. It is similar to the SUID bit, - except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. +description: This analytic looks for suspicious chmod utility execution to enable + SUID bit. This allows a user to temporarily gain root access, usually in order to + run a program. For example, only the root account is allowed to change the password + information contained in the password database; If the SUID bit appears as an s, + the file's owner also has execute permission to the file; if it appears as an S, + the file's owner does not have execute permission. The second specialty permission + is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily + change group membership, usually to execute a program. The SGID bit is set if an + s or an S appears in the group section of permissions. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", “* 4777 *”, "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid From f96aa5fbe324488470884c4e2fcb3968b174383e Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 4 Jan 2022 11:11:14 +0100 Subject: [PATCH 12/29] Update linux_file_creation_in_init_boot_directory.yml --- .../endpoint/linux_file_creation_in_init_boot_directory.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 825030f1fe..4165327f7e 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -11,7 +11,7 @@ description: This analytic looks for suspicious file creation on init system dir Even this even is really need to be monitor administrator or network operator can still add script files or binary files as part of a task or automation. filter is needed. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/init.d/*", "*/etc/rc.d/*", "*/sbin/init.d/*", "*/etc/rc.local*") - by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` @@ -64,4 +64,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 From 472519cac08ac7ae623fd078c43056260b25fce5 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 4 Jan 2022 10:32:49 +0000 Subject: [PATCH 13/29] Added detection testing service results inLinux File Creation In Init Boot Directory --- ...x_file_creation_in_init_boot_directory.yml | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 4165327f7e..7d74a8d518 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious file creation on init system directories for automatic execution of script or file upon boot up. - This technique is commonly abuse by adversaries, malware author and red teamer to persist on the targeted or compromised host. - Even this even is really need to be monitor administrator or network operator can still add script files or binary files as part of a task or automation. filter is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path IN ("*/etc/init.d/*", "*/etc/rc.d/*", "*/sbin/init.d/*", "*/etc/rc.local*") - by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `linux_file_creation_in_init_boot_directory_filter`' +description: This analytic looks for suspicious file creation on init system directories + for automatic execution of script or file upon boot up. This technique is commonly + abuse by adversaries, malware author and red teamer to persist on the targeted or + compromised host. Even this even is really need to be monitor administrator or network + operator can still add script files or binary files as part of a task or automation. + filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/init.d/*", + "*/etc/rc.d/*", "*/sbin/init.d/*", "*/etc/rc.local*") by Filesystem.dest Filesystem.file_name + Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_file_creation_in_init_boot_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can create file in this folders for automation purposes. filter is needed + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: administrator or network operator can create file in this folders + for automation purposes. filter is needed references: -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ tags: analytic_story: - Linux Privilege Escalation @@ -40,15 +41,14 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid - Filesystem.file_path security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - source:endpoint @@ -65,3 +65,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 + automated_detection_testing: passed From 74dcbf5bbe8198afc8e8562bbbf6779d135ec371 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 4 Jan 2022 11:47:11 +0100 Subject: [PATCH 14/29] linux_persist_priv_batch_2 --- detections/endpoint/linux_service_restarted.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index 0940365844..e2ec6ecd2c 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -18,10 +18,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your + logs with the process name, parent process, and commandline executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed +known_false_positives: Administrator or network operator can use this commandline for automation purposes. Filter is needed. references: - https://attack.mitre.org/techniques/T1543/003/ tags: @@ -29,7 +29,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log kill_chain_phases: - Privilege Escalation mitre_attack_id: From ff3172c7c0ae0ad3688c37ca94bb6d2172d6d226 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 4 Jan 2022 12:15:50 +0100 Subject: [PATCH 15/29] linux_persist_priv_batch_2 --- detections/endpoint/linux_service_restarted.yml | 2 +- detections/endpoint/linux_setuid_using_chmod_utility.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index e2ec6ecd2c..d57098ff24 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -14,7 +14,7 @@ description: This analytic looks for restarted or re-enable services in linux pl of the actual script or executable that register as service and who created the service for further verification. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) - Processes.process IN ("*restart*", "*reload*", “*reenable*”) + Processes.process IN ("*restart*", "*reload*", "*reenable*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index deb15faccf..8235b19b4d 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -16,7 +16,7 @@ description: This analytic looks for suspicious chmod utility execution to enabl change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", “* 4777 *”, "* 4577 *") + WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", "* 4777 *", "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` From 1be58f55d265737c06dd487b8c2f12034b0e2bdf Mon Sep 17 00:00:00 2001 From: root Date: Tue, 4 Jan 2022 11:35:23 +0000 Subject: [PATCH 16/29] Added detection testing service results inLinux Service Restarted --- .../endpoint/linux_service_restarted.yml | 48 +++++++++++-------- 1 file changed, 27 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index d57098ff24..cbd22585be 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -7,21 +7,27 @@ type: Anomaly datamodel: - Endpoint description: This analytic looks for restarted or re-enable services in linux platform. - This technique can be executed or performed using systemctl or service tool application. - Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. - When Windows boots up, it starts programs or applications called services that perform background system functions. Administrator may also create - a legitimated service for a specific tool or normal application as part of task or automation, in this scenario it is suggested to look for the service path - of the actual script or executable that register as service and who created the service for further verification. + This technique can be executed or performed using systemctl or service tool application. + Adversaries may create or modify Windows services to repeatedly execute malicious + payloads as part of persistence. When Windows boots up, it starts programs or applications + called services that perform background system functions. Administrator may also + create a legitimated service for a specific tool or normal application as part of + task or automation, in this scenario it is suggested to look for the service path + of the actual script or executable that register as service and who created the + service for further verification. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) - Processes.process IN ("*restart*", "*reload*", "*reenable*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", + "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process + IN ("*restart*", "*reload*", "*reenable*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and commandline executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this commandline for automation purposes. Filter is needed. + Sysmon TA. +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. Filter is needed. references: - https://attack.mitre.org/techniques/T1543/003/ tags: @@ -41,18 +47,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 - risk_score: 25 + confidence: 50 + risk_score: 25 context: - source:endpoint - stage:Privilege Escalation Persistence @@ -67,4 +72,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From 4c40ac89618ba64e2e08bb9be37b8f60aa998bcd Mon Sep 17 00:00:00 2001 From: root Date: Tue, 4 Jan 2022 11:36:47 +0000 Subject: [PATCH 17/29] Added detection testing service results inLinux Setuid Using Chmod Utility --- .../linux_setuid_using_chmod_utility.yml | 35 ++++++++++--------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index 8235b19b4d..2181165c1d 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -15,18 +15,19 @@ description: This analytic looks for suspicious chmod utility execution to enabl is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily change group membership, usually to execute a program. The SGID bit is set if an s or an S appears in the group section of permissions. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", "* 4777 *", "* 4577 *") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_setuid_using_chmod_utility_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod + OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", + "* 4777 *", "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. filter is needed + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. + filter is needed references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ tags: @@ -46,17 +47,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - source:endpoint @@ -73,3 +73,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 + automated_detection_testing: passed From e8cde0b1f64311f08c1fe710be832deb0c986f12 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 4 Jan 2022 17:59:26 +0100 Subject: [PATCH 18/29] Update linux_file_creation_in_init_boot_directory.yml --- .../endpoint/linux_file_creation_in_init_boot_directory.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 7d74a8d518..1fa48cd594 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -9,8 +9,8 @@ datamodel: description: This analytic looks for suspicious file creation on init system directories for automatic execution of script or file upon boot up. This technique is commonly abuse by adversaries, malware author and red teamer to persist on the targeted or - compromised host. Even this even is really need to be monitor administrator or network - operator can still add script files or binary files as part of a task or automation. + compromised host. This behavior can be executed or use by an administrator or network + operator to add script files or binary files as part of a task or automation. filter is needed. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/init.d/*", From 78732dfe2d71103173812a1dd365b80af84cad71 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 4 Jan 2022 18:00:42 +0100 Subject: [PATCH 19/29] Update linux_file_creation_in_profile_directory.yml --- .../endpoint/linux_file_creation_in_profile_directory.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index a5ddfebb4c..09591a86d1 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -7,10 +7,10 @@ type: Anomaly datamodel: - Endpoint description: This analytic looks for suspicious file creation in /etc/profile.d directory - to automatically execute scripts by shell upon boot of machine. This technique is - commonly abused by adversaries, malware and red teamers as persistence mechanism + to automatically execute scripts by shell upon boot up of a linux machine. This technique is + commonly abused by adversaries, malware and red teamers as a persistence mechanism to the targeted or compromised host. This Anomaly detection is a good indicator - that someone wants to run code after boot up which can be done also by the administrator + that someone wants to run a code after boot up which can be done also by the administrator or network operator for automation purposes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/profile.d/*") From b60f4a2b5a5a2f9dfbd9ff84815ba86276d88da9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:30:55 -0800 Subject: [PATCH 20/29] Update linux_file_creation_in_init_boot_directory.yml --- .../linux_file_creation_in_init_boot_directory.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 1fa48cd594..c4ec120262 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_file_creation_in_init_boot_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase known_false_positives: administrator or network operator can create file in this folders for automation purposes. filter is needed references: @@ -51,9 +51,10 @@ tags: confidence: 70 risk_score: 49 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a file $file_name$ is created in $file_path$ on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ observable: - name: dest type: Hostname From 2944d1690b1aa6b0c1ea2675d0068e4837b5da64 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:32:10 -0800 Subject: [PATCH 21/29] Update linux_file_creation_in_init_boot_directory.yml --- .../endpoint/linux_file_creation_in_init_boot_directory.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index c4ec120262..1172a5018a 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -20,8 +20,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase -known_false_positives: administrator or network operator can create file in this folders - for automation purposes. filter is needed +known_false_positives: Administrator or network operator can create file in this folders + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ tags: From 527d8103b83ccf506c704604fad1c9cff3bc25a2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:33:47 -0800 Subject: [PATCH 22/29] Update linux_file_creation_in_profile_directory.yml --- .../endpoint/linux_file_creation_in_profile_directory.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index 09591a86d1..c9348d7b79 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -19,9 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `linux_file_creation_in_profile_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrator or network operator can create file in profile.d - folders for automation purposes. filter is needed + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create file in profile.d + folders for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1546/004/ - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ @@ -54,7 +54,7 @@ tags: context: - source:endpoint - stage:Privilege Escalation Persistence - message: a file $file_name$ is created in $file_path$ on $dest$ + message: A file $file_name$ is created in $file_path$ on $dest$ observable: - name: dest type: Hostname From 4a08f745b20d958b426d64476247975b17103934 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:41:02 -0800 Subject: [PATCH 23/29] Update linux_service_file_created_in_systemd_directory.yml --- ...ux_service_file_created_in_systemd_directory.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml index 2347b8f785..c388df7347 100644 --- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -23,9 +23,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `linux_service_file_created_in_systemd_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrator or network operator can create file in systemd - folders for automation purposes. filter is needed + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create file in systemd + folders for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/006/ - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ @@ -58,9 +58,10 @@ tags: confidence: 80 risk_score: 64 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a service file named as $file_path$ is created in systemd folder on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A service file named as $file_path$ is created in systemd folder on $dest$ observable: - name: dest type: Hostname From 8bd5c20eac2c08694974b727e66d4d64ef5f81fd Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:46:34 -0800 Subject: [PATCH 24/29] Update linux_file_creation_in_profile_directory.yml --- .../endpoint/linux_file_creation_in_profile_directory.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index c9348d7b79..f9acf157ab 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -52,8 +52,9 @@ tags: confidence: 80 risk_score: 56 context: - - source:endpoint - - stage:Privilege Escalation Persistence + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence message: A file $file_name$ is created in $file_path$ on $dest$ observable: - name: dest From a505181149cf4bcd3d2e72ea10f2888feb98fa43 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:52:25 -0800 Subject: [PATCH 25/29] Update linux_service_restarted.yml --- detections/endpoint/linux_service_restarted.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index cbd22585be..601ea035f9 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -24,10 +24,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and commandline executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Filter is needed. + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1543/003/ tags: @@ -59,9 +58,10 @@ tags: confidence: 50 risk_score: 25 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that may create or start a service on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may create or start a service on $dest$ observable: - name: dest type: Hostname From 19d907da37e3ebdf32e7dea693887400e4f4faf8 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:53:45 -0800 Subject: [PATCH 26/29] Update linux_service_started_or_enabled.yml --- .../endpoint/linux_service_started_or_enabled.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml index 4d71368b8a..3170d48284 100644 --- a/detections/endpoint/linux_service_started_or_enabled.yml +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -24,10 +24,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_service_started_or_enabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this commandline - for automation purposes. filter is needed + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1543/003/ tags: @@ -59,8 +58,9 @@ tags: confidence: 70 risk_score: 42 context: - - source:endpoint - - stage:Privilege Escalation Persistence + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence message: a commandline $process$ that may create or start a service on $dest observable: - name: dest From fabd8208045edd0993bd8b5bd3d7c281b6c3e365 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:55:51 -0800 Subject: [PATCH 27/29] Update linux_setuid_using_chmod_utility.yml --- .../endpoint/linux_setuid_using_chmod_utility.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index 2181165c1d..f7d5fd506e 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -24,10 +24,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. - filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ tags: @@ -59,8 +57,9 @@ tags: confidence: 70 risk_score: 49 context: - - source:endpoint - - stage:Privilege Escalation Persistence + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence message: a commandline $process$ that may set suid or sgid on $dest$ observable: - name: dest From 26f945c52a56313047aa5f380303e1d4c762324b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:56:56 -0800 Subject: [PATCH 28/29] Update linux_setuid_using_setcap_utility.yml --- .../endpoint/linux_setuid_using_setcap_utility.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index bd81ad5b7b..3241fafb0f 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -25,10 +25,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `linux_setuid_using_setcap_utility_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. - filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ tags: @@ -60,8 +59,9 @@ tags: confidence: 70 risk_score: 49 context: - - source:endpoint - - stage:Privilege Escalation Persistence + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence message: a commandline $process$ that may set suid or sgid on $dest$ observable: - name: dest From 3362c243ae3ad721d1b953e1852b4efddd6a615a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 10 Jan 2022 12:59:21 -0800 Subject: [PATCH 29/29] Update linux_setuid_using_setcap_utility.yml --- detections/endpoint/linux_setuid_using_setcap_utility.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index 3241fafb0f..e39fc9f1ad 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -62,7 +62,7 @@ tags: - Source:Endpoint - Stage:Privilege Escalation - Stage:Persistence - message: a commandline $process$ that may set suid or sgid on $dest$ + message: A commandline $process$ that may set suid or sgid on $dest$ observable: - name: dest type: Hostname