Branch was auto-updated.

detections/endpoint/linux_add_user_account.yml

@@ -0,0 +1,71 @@
+name: Linux Add User Account
+id: 51fbcaf2-6259-11ec-b0f3-acde48001122
+version: 1
+date: '2021-12-21'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for commands to create user accounts on the linux
+  platform. This technique is commonly abuse by adversaries, malware author and red
+  teamers to persist on the targeted or compromised host by creating new user with
+  an elevated privilege. This Hunting query may catch normal creation of user by administrator
+  so filter is needed.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
+  where Processes.process_name IN ("useradd", "adduser") OR Processes.process IN ("*useradd
+  *", "*adduser *") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+references:
+- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1136.001
+  - T1136
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ that may create user account on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/linux_common_process_for_elevation_control.yml

@@ -0,0 +1,80 @@
+name: Linux Common Process For Elevation Control
+id: 66ab15c0-63d0-11ec-9e70-acde48001122
+version: 1
+date: '2021-12-23'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic is to look for possible elevation control access using
+  a common known process in linux platform to change the attribute and file ownership.
+  This technique is commonly abused by adversaries, malware author and red teamers
+  to gain persistence or privilege escalation on the target or compromised host. Tis
+  common process is used to modify file attribute, file ownership or SUID. This tools
+  can be used in legitimate purposes so filter is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chmod",
+  "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr",
+  "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid",
+  "setregid") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat
+  *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *",
+  "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid
+  *", "*setregid *", "*setcap *") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+references:
+- https://attack.mitre.org/techniques/T1548/001/
+- https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297
+- https://github.com/bfuzzy1/auditd-attack/blob/master/auditd-attack/auditd-attack.rules#L269-L270
+- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.001
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ with process $process_name$ on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/linux_doas_conf_file_creation.yml

@@ -0,0 +1,71 @@
+name: Linux Doas Conf File Creation
+id: f6343e86-6e09-11ec-9376-acde48001122
+version: 1
+date: '2022-01-05'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect the creation of doas.conf file in linux host
+  platform. This configuration file can be use by doas utility tool to allow or permit
+  standard users to perform tasks as root, the same way sudo does. This tool is developed
+  as a minimalistic alternative to sudo application. This tool can be abused advesaries,
+  attacker or malware to gain elevated privileges to the targeted or compromised host.
+  On the other hand this can also be executed by administrator for a certain task
+  that needs admin rights. In this case filter is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/doas.conf")
+  by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `linux_doas_conf_file_creation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+references:
+- https://wiki.gentoo.org/wiki/Doas
+- https://www.makeuseof.com/how-to-install-and-use-doas/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A file $file_name$ is created in $file_path$ on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/linux_doas_tool_execution.yml

@@ -0,0 +1,74 @@
+name: Linux Doas Tool Execution
+id: d5a62490-6e09-11ec-884e-acde48001122
+version: 1
+date: '2022-01-05'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect the doas tool execution in linux host platform.
+  This utility tool allow standard users to perform tasks as root, the same way sudo
+  does. This tool is developed as a minimalistic alternative to sudo application.
+  This tool can be abused advesaries, attacker or malware to gain elevated privileges
+  to the targeted or compromised host. On the other hand this can also be executed
+  by administrator for a certain task that needs admin rights. In this case filter
+  is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "doas"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `linux_doas_tool_execution_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+references:
+- https://wiki.gentoo.org/wiki/Doas
+- https://www.makeuseof.com/how-to-install-and-use-doas/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A doas $process_name$ with commandline $process$ was executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/linux_possible_access_to_credential_files.yml

@@ -0,0 +1,73 @@
+name: Linux Possible Access To Credential Files
+id: 16107e0e-71fc-11ec-b862-acde48001122
+version: 1
+date: '2022-01-10'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a possible attempt to dump or access the content
+  of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd"
+  store user information within linux OS while "etc/shadow" contain the user passwords
+  hash. Adversaries and threat actors may attempt to access this to gain persistence
+  and/or privilege escalation. This anomaly detection can be a good indicator of possible
+  credential dumping technique but it might catch some normal administrator automation
+  scripts or during credential auditing. In this scenario filter is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat",
+  "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/shadow*", "*/etc/passwd*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_credential_files_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
+references:
+- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd
+- https://attack.mitre.org/techniques/T1003/008/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1003.008
+  - T1003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/linux_possible_access_to_sudoers_file.yml

@@ -0,0 +1,71 @@
+name: Linux Possible Access To Sudoers File
+id: 4479539c-71fc-11ec-b2e2-acde48001122
+version: 1
+date: '2022-01-10'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a possible access or modification of /etc/sudoers
+  file. "/etc/sudoers" file controls who can run what command as what users on what
+  machine and can also control whether a specific user need a password for particular
+  commands.  adversaries and threat actors abuse this file to gain persistence and/or
+  privilege escalation during attack on targeted host.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat",
+  "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/sudoers*") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_sudoers_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives.
+references:
+- https://attack.mitre.org/techniques/T1548/003/
+- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/linux_sudo_or_su_execution.yml

@@ -0,0 +1,73 @@
+name: Linux Sudo OR Su Execution
+id: 4b00f134-6d6a-11ec-a90c-acde48001122
+version: 1
+date: '2022-01-04'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic is to detect the execution of sudo or su command in linux
+  operating system. The "sudo" command allows a system administrator to delegate authority
+  to give certain users (or groups of users) the ability to run some (or all) commands
+  as root or another user while providing an audit trail of the commands and their
+  arguments. This command is commonly abused by adversaries, malware author and red
+  teamers to elevate privileges to the targeted host. This command can be executed
+  by administrator for legitimate purposes or to execute process that need admin privileges,
+  In this scenario filter is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("sudo",
+  "su") OR Processes.parent_process_name IN ("sudo", "su") by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
+references:
+- https://attack.mitre.org/techniques/T1548/003/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ that execute sudo or su in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

tests/endpoint/linux_add_user_account.test.yml

@@ -0,0 +1,12 @@
+name: Linux Add User Account Unit Test
+tests:
+- name: Linux Add User Account
+  file: endpoint/linux_add_user_account.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_common_process_for_elevation_control.test.yml

@@ -0,0 +1,12 @@
+name: Linux Common Process For Elevation Control Unit Test
+tests:
+- name: Linux Common Process For Elevation Control
+  file: endpoint/linux_common_process_for_elevation_control.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_doas_conf_file_creation.test.yml

@@ -0,0 +1,12 @@
+name: Linux Doas Conf File Creation Unit Test
+tests:
+- name: Linux Doas Conf File Creation
+  file: endpoint/linux_doas_conf_file_creation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_doas_tool_execution.test.yml

@@ -0,0 +1,12 @@
+name: Linux Doas Tool Execution Unit Test
+tests:
+- name: Linux Doas Tool Execution
+  file: endpoint/linux_doas_tool_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_possible_access_to_credential_files.test.yml

@@ -0,0 +1,12 @@
+name: Linux Possible Access To Credential Files Unit Test
+tests:
+- name: Linux Possible Access To Credential Files
+  file: endpoint/linux_possible_access_to_credential_files.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_possible_access_to_sudoers_file.test.yml

@@ -0,0 +1,12 @@
+name: Linux Possible Access To Sudoers File Unit Test
+tests:
+- name: Linux Possible Access To Sudoers File
+  file: endpoint/linux_possible_access_to_sudoers_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_sudo_or_su_execution.test.yml

@@ -0,0 +1,12 @@
+name: Linux Sudo OR Su Execution Unit Test
+tests:
+- name: Linux Sudo OR Su Execution
+  file: endpoint/linux_sudo_or_su_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux