Branch was auto-updated.

detections/endpoint/linux_deletion_of_ssh_key.yml

@@ -6,22 +6,22 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a deletion of ssh key in a linux machine. 
-  attacker may delete or modify ssh key to impair some security features or act as defense evasion in compromised linux machine. 
-  This Anomaly can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what 
-  acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user 
+description: This analytic is to detect a deletion of ssh key in a linux machine.
+  attacker may delete or modify ssh key to impair some security features or act as defense evasion in compromised linux machine.
+  This Anomaly can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what
+  acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user
   tries to delete this type of files which is not so common and need further investigation.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem  
-  where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+  where Filesystem.action=deleted AND Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*")
   by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action
-  | `drop_dm_object_name(Filesystem)` 
-  |rename process_guid as proc_guid 
+  | `drop_dm_object_name(Filesystem)`
+  |rename process_guid as proc_guid
   |join proc_guid, _time [
-  | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown 
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid 
-  | `drop_dm_object_name(Processes)` 
-  |rename process_guid as proc_guid 
-  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] 
+  | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid
+  | `drop_dm_object_name(Processes)`
+  |rename process_guid as proc_guid
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action]
   | table  process_name process proc_guid file_name file_path action _time parent_process_name parent_process  process_path dest user
   | `linux_deletion_of_ssh_key_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -31,7 +31,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
-- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ 
+- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
 tags:
   analytic_story:
   - Acidrain
@@ -83,4 +83,4 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   risk_score: 49
-  security_domain: endpoint
+  security_domain: endpoint