From 00d82f98b2460937d539afc0b4d02f7ad10fae7c Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 6 May 2022 09:03:57 -0700 Subject: [PATCH 1/2] firstiterationdelsshkfix --- .../endpoint/linux_deletion_of_ssh_key.yml | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/linux_deletion_of_ssh_key.yml b/detections/endpoint/linux_deletion_of_ssh_key.yml index c8e3cebb8f..5b5495460d 100644 --- a/detections/endpoint/linux_deletion_of_ssh_key.yml +++ b/detections/endpoint/linux_deletion_of_ssh_key.yml @@ -6,22 +6,22 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a deletion of ssh key in a linux machine. - attacker may delete or modify ssh key to impair some security features or act as defense evasion in compromised linux machine. - This Anomaly can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what - acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user +description: This analytic is to detect a deletion of ssh key in a linux machine. + attacker may delete or modify ssh key to impair some security features or act as defense evasion in compromised linux machine. + This Anomaly can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what + acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user tries to delete this type of files which is not so common and need further investigation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" AND Filesystem.file_path = "~/.ssh/*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid |join proc_guid, _time [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user | `linux_deletion_of_ssh_key_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -31,7 +31,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - Acidrain @@ -83,4 +83,4 @@ tags: - Processes.process_id - Processes.parent_process_id risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint From 763e2eed8be768f7381dc08e83a503264d87762e Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 6 May 2022 13:58:32 -0400 Subject: [PATCH 2/2] Update linux_deletion_of_ssh_key.yml Check for deletion of SSH key material in the ~/.ssh directory as well. Not just in /etc/ssh. This particular commit fixes minor logic error in including content in the ~/.ssh directory --- detections/endpoint/linux_deletion_of_ssh_key.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_deletion_of_ssh_key.yml b/detections/endpoint/linux_deletion_of_ssh_key.yml index 5b5495460d..2123fef0d5 100644 --- a/detections/endpoint/linux_deletion_of_ssh_key.yml +++ b/detections/endpoint/linux_deletion_of_ssh_key.yml @@ -12,7 +12,7 @@ description: This analytic is to detect a deletion of ssh key in a linux machine acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user tries to delete this type of files which is not so common and need further investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" AND Filesystem.file_path = "~/.ssh/*" + where Filesystem.action=deleted AND Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid