linux_auditd_detection

detections/endpoint/linux_auditd_edit_cron_table_parameter.yml

@@ -0,0 +1,69 @@
+name: Linux Auditd Edit Cron Table Parameter
+id: f4bb7321-7e64-4d1e-b1aa-21f8b019a91f
+version: 1
+date: '2024-08-09'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+description: The following analytic detects the suspicious editing of cron jobs in
+  Linux using the crontab command-line parameter (-e). It identifies this activity
+  by monitoring command-line executions involving 'crontab' and the edit parameter.
+  This behavior is significant for a SOC as cron job manipulations can indicate unauthorized
+  persistence attempts or scheduled malicious actions. If confirmed malicious, this
+  activity could lead to system compromise, unauthorized access, or broader network
+  compromise.
+data_source:
+- Linux Auditd Syscall
+search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN ("*/crontab"))
+  success=yes AND NOT (UID IN("daemon")) | stats count min(_time) as firstTime max(_time)
+  as lastTime by comm exe  SYSCALL UID ppid pid | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `linux_auditd_edit_cron_table_parameter_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process complete command-line executions.
+  These logs must be processed using the appropriate Splunk Technology Add-ons that
+  are specific to the EDR product. Use the Splunk Common Information Model (CIM) to
+  normalize the field names and speed up the data modeling process.
+known_false_positives: Administrator or network operator can use this application
+  for automation purposes. Please update the filter macros to remove false positives.
+references:
+- https://attack.mitre.org/techniques/T1053/003/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  - Linux Living Off The Land
+  - Scheduled Tasks
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: $comm$ was executed on host.
+  mitre_attack_id:
+  - T1053.003
+  - T1053
+  observable:
+  - name: comm
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - comm
+  - exe
+  - SYSCALL
+  - UID
+  - ppid
+  - pid
+  risk_score: 64
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_crontab_edit/linux_auditd_crontab_edit.log
+    source: /var/log/audit/audit.log
+    sourcetype: linux:audit

detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml

@@ -0,0 +1,69 @@
+name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File
+id: fea71cf0-fa10-4ef6-9202-9682b2e0c477
+version: 1
+date: '2024-08-09'
+author: Teoderick Contreras, Splunk
+status: production
+type: Hunting
+description: The following analytic detects potential tampering with cronjob files
+  on a Linux system by identifying 'echo' commands that append code to existing cronjob
+  files. It leverages logs from Endpoint Detection and Response (EDR) agents, focusing
+  on process names, parent processes, and command-line executions. This activity is
+  significant because adversaries often use it for persistence or privilege escalation.
+  If confirmed malicious, this could allow attackers to execute unauthorized code
+  automatically, leading to system compromises and unauthorized data access, thereby
+  impacting business operations and data integrity.
+data_source:
+- Linux Auditd Path
+search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID  |
+  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process complete command-line executions.
+  These logs must be processed using the appropriate Splunk Technology Add-ons that
+  are specific to the EDR product. Use the Splunk Common Information Model (CIM) to
+  normalize the field names and speed up the data modeling process.
+known_false_positives: False positives may arise from legitimate actions by administrators
+  or network operators who may use these commands for automation purposes. Therefore,
+  it's recommended to adjust filter macros to eliminate such false positives.
+references:
+- https://attack.mitre.org/techniques/T1053/003/
+- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
+- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  - Linux Living Off The Land
+  - Scheduled Tasks
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: a $PATH$ has been accessed/modified on host.
+  mitre_attack_id:
+  - T1053.003
+  - T1053
+  observable:
+  - name: name
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - name
+  - nametype
+  - OGID
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_auditd_cron_file_audited2.log
+    source: /var/log/audit/audit.log
+    sourcetype: linux:audit

detections/endpoint/linux_auditd_sudo_or_su_execution.yml

@@ -0,0 +1,63 @@
+name: Linux Auditd Sudo Or Su Execution
+id: 817a5c89-5b92-4818-a22d-aa35e1361afe
+version: 1
+date: '2024-08-09'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the execution of the "sudo" or "su" command
+  on a Linux operating system. It leverages data from Endpoint Detection and Response
+  (EDR) agents, focusing on process names and parent process names. This activity
+  is significant because "sudo" and "su" commands are commonly used by adversaries
+  to elevate privileges, potentially leading to unauthorized access or control over
+  the system. If confirmed malicious, this activity could allow attackers to execute
+  commands with root privileges, leading to severe security breaches, data exfiltration,
+  or further system compromise.
+data_source:
+- Linux Auditd Proctitle
+search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE(process_exec,
+  "%sudo %") OR LIKE(process_exec, "%su %") | stats count min(_time) as firstTime
+  max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sudo_or_su_execution_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process complete command-line executions.
+  These logs must be processed using the appropriate Splunk Technology Add-ons that
+  are specific to the EDR product. Use the Splunk Common Information Model (CIM) to
+  normalize the field names and speed up the data modeling process.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+references:
+- https://attack.mitre.org/techniques/T1548/003/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: $process_exec$ event occurred on host.
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  observable:
+  - name: process_exec
+    type: Other
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - proctitle
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudo_su/linux_auditd_sudo_su.log
+    source: /var/log/audit/audit.log
+    sourcetype: linux:audit