diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml new file mode 100644 index 0000000000..ef9b3c3f2b --- /dev/null +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -0,0 +1,69 @@ +name: Linux Auditd Edit Cron Table Parameter +id: f4bb7321-7e64-4d1e-b1aa-21f8b019a91f +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the suspicious editing of cron jobs in + Linux using the crontab command-line parameter (-e). It identifies this activity + by monitoring command-line executions involving 'crontab' and the edit parameter. + This behavior is significant for a SOC as cron job manipulations can indicate unauthorized + persistence attempts or scheduled malicious actions. If confirmed malicious, this + activity could lead to system compromise, unauthorized access, or broader network + compromise. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN ("*/crontab")) + success=yes AND NOT (UID IN("daemon")) | stats count min(_time) as firstTime max(_time) + as lastTime by comm exe SYSCALL UID ppid pid | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_edit_cron_table_parameter_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1053/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + - Scheduled Tasks + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $comm$ was executed on host. + mitre_attack_id: + - T1053.003 + - T1053 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_crontab_edit/linux_auditd_crontab_edit.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml new file mode 100644 index 0000000000..fb692dc1ca --- /dev/null +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -0,0 +1,69 @@ +name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File +id: fea71cf0-fa10-4ef6-9202-9682b2e0c477 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects potential tampering with cronjob files + on a Linux system by identifying 'echo' commands that append code to existing cronjob + files. It leverages logs from Endpoint Detection and Response (EDR) agents, focusing + on process names, parent processes, and command-line executions. This activity is + significant because adversaries often use it for persistence or privilege escalation. + If confirmed malicious, this could allow attackers to execute unauthorized code + automatically, leading to system compromises and unauthorized data access, thereby + impacting business operations and data integrity. +data_source: +- Linux Auditd Path +search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") + | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID | + `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: False positives may arise from legitimate actions by administrators + or network operators who may use these commands for automation purposes. Therefore, + it's recommended to adjust filter macros to eliminate such false positives. +references: +- https://attack.mitre.org/techniques/T1053/003/ +- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + - Scheduled Tasks + asset_type: Endpoint + confidence: 70 + impact: 70 + message: a $PATH$ has been accessed/modified on host. + mitre_attack_id: + - T1053.003 + - T1053 + observable: + - name: name + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - name + - nametype + - OGID + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_auditd_cron_file_audited2.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml new file mode 100644 index 0000000000..c926954b12 --- /dev/null +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -0,0 +1,63 @@ +name: Linux Auditd Sudo Or Su Execution +id: 817a5c89-5b92-4818-a22d-aa35e1361afe +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of the "sudo" or "su" command + on a Linux operating system. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process names and parent process names. This activity + is significant because "sudo" and "su" commands are commonly used by adversaries + to elevate privileges, potentially leading to unauthorized access or control over + the system. If confirmed malicious, this activity could allow attackers to execute + commands with root privileges, leading to severe security breaches, data exfiltration, + or further system compromise. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE(process_exec, + "%sudo %") OR LIKE(process_exec, "%su %") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sudo_or_su_execution_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1548/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1548.003 + - T1548 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudo_su/linux_auditd_sudo_su.log + source: /var/log/audit/audit.log + sourcetype: linux:audit