diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml new file mode 100644 index 0000000000..b77daccbde --- /dev/null +++ b/detections/endpoint/linux_add_user_account.yml @@ -0,0 +1,71 @@ +name: Linux Add User Account +id: 51fbcaf2-6259-11ec-b0f3-acde48001122 +version: 1 +date: '2021-12-21' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic looks for commands to create user accounts on the linux + platform. This technique is commonly abuse by adversaries, malware author and red + teamers to persist on the targeted or compromised host by creating new user with + an elevated privilege. This Hunting query may catch normal creation of user by administrator + so filter is needed. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes + where Processes.process_name IN ("useradd", "adduser") OR Processes.process IN ("*useradd + *", "*adduser *") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1136.001 + - T1136 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may create user account on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml new file mode 100644 index 0000000000..904b32a0a0 --- /dev/null +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -0,0 +1,80 @@ +name: Linux Common Process For Elevation Control +id: 66ab15c0-63d0-11ec-9e70-acde48001122 +version: 1 +date: '2021-12-23' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to look for possible elevation control access using + a common known process in linux platform to change the attribute and file ownership. + This technique is commonly abused by adversaries, malware author and red teamers + to gain persistence or privilege escalation on the target or compromised host. Tis + common process is used to modify file attribute, file ownership or SUID. This tools + can be used in legitimate purposes so filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chmod", + "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr", + "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid", + "setregid") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat + *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", + "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid + *", "*setregid *", "*setcap *") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1548/001/ +- https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297 +- https://github.com/bfuzzy1/auditd-attack/blob/master/auditd-attack/auditd-attack.rules#L269-L270 +- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.001 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ with process $process_name$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml new file mode 100644 index 0000000000..35f72a92e5 --- /dev/null +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -0,0 +1,71 @@ +name: Linux Doas Conf File Creation +id: f6343e86-6e09-11ec-9376-acde48001122 +version: 1 +date: '2022-01-05' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect the creation of doas.conf file in linux host + platform. This configuration file can be use by doas utility tool to allow or permit + standard users to perform tasks as root, the same way sudo does. This tool is developed + as a minimalistic alternative to sudo application. This tool can be abused advesaries, + attacker or malware to gain elevated privileges to the targeted or compromised host. + On the other hand this can also be executed by administrator for a certain task + that needs admin rights. In this case filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/doas.conf") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `linux_doas_conf_file_creation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://wiki.gentoo.org/wiki/Doas +- https://www.makeuseof.com/how-to-install-and-use-doas/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml new file mode 100644 index 0000000000..f6b50a06f3 --- /dev/null +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -0,0 +1,74 @@ +name: Linux Doas Tool Execution +id: d5a62490-6e09-11ec-884e-acde48001122 +version: 1 +date: '2022-01-05' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect the doas tool execution in linux host platform. + This utility tool allow standard users to perform tasks as root, the same way sudo + does. This tool is developed as a minimalistic alternative to sudo application. + This tool can be abused advesaries, attacker or malware to gain elevated privileges + to the targeted or compromised host. On the other hand this can also be executed + by administrator for a certain task that needs admin rights. In this case filter + is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "doas" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_doas_tool_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://wiki.gentoo.org/wiki/Doas +- https://www.makeuseof.com/how-to-install-and-use-doas/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A doas $process_name$ with commandline $process$ was executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml new file mode 100644 index 0000000000..be46affa88 --- /dev/null +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -0,0 +1,73 @@ +name: Linux Possible Access To Credential Files +id: 16107e0e-71fc-11ec-b862-acde48001122 +version: 1 +date: '2022-01-10' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a possible attempt to dump or access the content + of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd" + store user information within linux OS while "etc/shadow" contain the user passwords + hash. Adversaries and threat actors may attempt to access this to gain persistence + and/or privilege escalation. This anomaly detection can be a good indicator of possible + credential dumping technique but it might catch some normal administrator automation + scripts or during credential auditing. In this scenario filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat", + "nano*","vim*", "vi*") AND Processes.process IN("*/etc/shadow*", "*/etc/passwd*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_credential_files_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +references: +- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd +- https://attack.mitre.org/techniques/T1003/008/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1003.008 + - T1003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml new file mode 100644 index 0000000000..df23a9d833 --- /dev/null +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -0,0 +1,71 @@ +name: Linux Possible Access To Sudoers File +id: 4479539c-71fc-11ec-b2e2-acde48001122 +version: 1 +date: '2022-01-10' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a possible access or modification of /etc/sudoers + file. "/etc/sudoers" file controls who can run what command as what users on what + machine and can also control whether a specific user need a password for particular + commands. adversaries and threat actors abuse this file to gain persistence and/or + privilege escalation during attack on targeted host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat", + "nano*","vim*", "vi*") AND Processes.process IN("*/etc/sudoers*") by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_sudoers_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1548/003/ +- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml new file mode 100644 index 0000000000..ee45705384 --- /dev/null +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -0,0 +1,73 @@ +name: Linux Sudo OR Su Execution +id: 4b00f134-6d6a-11ec-a90c-acde48001122 +version: 1 +date: '2022-01-04' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to detect the execution of sudo or su command in linux + operating system. The "sudo" command allows a system administrator to delegate authority + to give certain users (or groups of users) the ability to run some (or all) commands + as root or another user while providing an audit trail of the commands and their + arguments. This command is commonly abused by adversaries, malware author and red + teamers to elevate privileges to the targeted host. This command can be executed + by administrator for legitimate purposes or to execute process that need admin privileges, + In this scenario filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("sudo", + "su") OR Processes.parent_process_name IN ("sudo", "su") by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1548/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that execute sudo or su in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/tests/endpoint/linux_add_user_account.test.yml b/tests/endpoint/linux_add_user_account.test.yml new file mode 100644 index 0000000000..90a79d5973 --- /dev/null +++ b/tests/endpoint/linux_add_user_account.test.yml @@ -0,0 +1,12 @@ +name: Linux Add User Account Unit Test +tests: +- name: Linux Add User Account + file: endpoint/linux_add_user_account.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_common_process_for_elevation_control.test.yml b/tests/endpoint/linux_common_process_for_elevation_control.test.yml new file mode 100644 index 0000000000..60f8445ae2 --- /dev/null +++ b/tests/endpoint/linux_common_process_for_elevation_control.test.yml @@ -0,0 +1,12 @@ +name: Linux Common Process For Elevation Control Unit Test +tests: +- name: Linux Common Process For Elevation Control + file: endpoint/linux_common_process_for_elevation_control.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_doas_conf_file_creation.test.yml b/tests/endpoint/linux_doas_conf_file_creation.test.yml new file mode 100644 index 0000000000..001f805563 --- /dev/null +++ b/tests/endpoint/linux_doas_conf_file_creation.test.yml @@ -0,0 +1,12 @@ +name: Linux Doas Conf File Creation Unit Test +tests: +- name: Linux Doas Conf File Creation + file: endpoint/linux_doas_conf_file_creation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_doas_tool_execution.test.yml b/tests/endpoint/linux_doas_tool_execution.test.yml new file mode 100644 index 0000000000..de4ddb2671 --- /dev/null +++ b/tests/endpoint/linux_doas_tool_execution.test.yml @@ -0,0 +1,12 @@ +name: Linux Doas Tool Execution Unit Test +tests: +- name: Linux Doas Tool Execution + file: endpoint/linux_doas_tool_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_possible_access_to_credential_files.test.yml b/tests/endpoint/linux_possible_access_to_credential_files.test.yml new file mode 100644 index 0000000000..054315ab72 --- /dev/null +++ b/tests/endpoint/linux_possible_access_to_credential_files.test.yml @@ -0,0 +1,12 @@ +name: Linux Possible Access To Credential Files Unit Test +tests: +- name: Linux Possible Access To Credential Files + file: endpoint/linux_possible_access_to_credential_files.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_possible_access_to_sudoers_file.test.yml b/tests/endpoint/linux_possible_access_to_sudoers_file.test.yml new file mode 100644 index 0000000000..d5f90456ff --- /dev/null +++ b/tests/endpoint/linux_possible_access_to_sudoers_file.test.yml @@ -0,0 +1,12 @@ +name: Linux Possible Access To Sudoers File Unit Test +tests: +- name: Linux Possible Access To Sudoers File + file: endpoint/linux_possible_access_to_sudoers_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_sudo_or_su_execution.test.yml b/tests/endpoint/linux_sudo_or_su_execution.test.yml new file mode 100644 index 0000000000..7d50de70b4 --- /dev/null +++ b/tests/endpoint/linux_sudo_or_su_execution.test.yml @@ -0,0 +1,12 @@ +name: Linux Sudo OR Su Execution Unit Test +tests: +- name: Linux Sudo OR Su Execution + file: endpoint/linux_sudo_or_su_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file