From 856635f60193024bd770caefebae48f5981a42df Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 10 Jan 2022 12:51:04 +0100 Subject: [PATCH 01/10] linux_persist_priv_batch_4 --- .../endpoint/linux_add_user_account.yml | 69 ++++++++++++++++++ ...x_common_process_for_elevation_control.yml | 71 ++++++++++++++++++ .../linux_doas_conf_file_creation.yml | 70 ++++++++++++++++++ .../endpoint/linux_doas_tool_execution.yml | 71 ++++++++++++++++++ ...ux_possible_access_to_credential_files.yml | 72 +++++++++++++++++++ .../linux_possible_access_to_sudoers_file.yml | 71 ++++++++++++++++++ .../endpoint/linux_sudo_or_su_execution.yml | 70 ++++++++++++++++++ .../endpoint/linux_add_user_account.test.yml | 12 ++++ ...mon_process_for_elevation_control.test.yml | 12 ++++ .../linux_doas_conf_file_creation.test.yml | 12 ++++ .../linux_doas_tool_execution.test.yml | 12 ++++ ...ssible_access_to_credential_files.test.yml | 12 ++++ ...x_possible_access_to_sudoers_file.test.yml | 12 ++++ .../linux_sudo_or_su_execution.test.yml | 12 ++++ 14 files changed, 578 insertions(+) create mode 100644 detections/endpoint/linux_add_user_account.yml create mode 100644 detections/endpoint/linux_common_process_for_elevation_control.yml create mode 100644 detections/endpoint/linux_doas_conf_file_creation.yml create mode 100644 detections/endpoint/linux_doas_tool_execution.yml create mode 100644 detections/endpoint/linux_possible_access_to_credential_files.yml create mode 100644 detections/endpoint/linux_possible_access_to_sudoers_file.yml create mode 100644 detections/endpoint/linux_sudo_or_su_execution.yml create mode 100644 tests/endpoint/linux_add_user_account.test.yml create mode 100644 tests/endpoint/linux_common_process_for_elevation_control.test.yml create mode 100644 tests/endpoint/linux_doas_conf_file_creation.test.yml create mode 100644 tests/endpoint/linux_doas_tool_execution.test.yml create mode 100644 tests/endpoint/linux_possible_access_to_credential_files.test.yml create mode 100644 tests/endpoint/linux_possible_access_to_sudoers_file.test.yml create mode 100644 tests/endpoint/linux_sudo_or_su_execution.test.yml diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml new file mode 100644 index 0000000000..ba96c211d8 --- /dev/null +++ b/detections/endpoint/linux_add_user_account.yml @@ -0,0 +1,69 @@ +name: Linux Add User Account +id: 51fbcaf2-6259-11ec-b0f3-acde48001122 +version: 1 +date: '2021-12-21' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic looks for commands to create user accounts on the linux platform. + This technique is commonly abuse by adversaries, malware author and red teamers to persist on the targeted or compromised host by creating new user + with an elevated privilege. This Hunting query may catch normal creation of user by administrator so filter is needed. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where + Processes.process_name IN ("useradd", "adduser") OR Processes.process IN ("*useradd *", "*adduser *") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_add_user_account_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. filter is needed +references: +- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1136.001 + - T1136 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that may create user account on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml new file mode 100644 index 0000000000..1de8c5acab --- /dev/null +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -0,0 +1,71 @@ +name: Linux Common Process For Elevation Control +id: 66ab15c0-63d0-11ec-9e70-acde48001122 +version: 1 +date: '2021-12-23' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. + This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. + Tis common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where + Processes.process_name IN ("chmod", "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr", "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid", "setregid") + OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", + "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid *", "*setregid *", “*setcap *”) + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_common_process_for_elevation_control_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1548/001/ +- https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297 +- https://github.com/bfuzzy1/auditd-attack/blob/master/auditd-attack/auditd-attack.rules#L269-L270 +- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.001 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ with process $process_name$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml new file mode 100644 index 0000000000..63864e7d81 --- /dev/null +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -0,0 +1,70 @@ +name: Linux Doas Conf File Creation +id: f6343e86-6e09-11ec-9376-acde48001122 +version: 1 +date: '2022-01-05' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect the creation of doas.conf file in linux host platform. This configuration file can be use by + doas utility tool to allow or permit standard users to perform tasks as root, the same way sudo does. + This tool is developed as a minimalistic alternative to sudo application. This tool can be abused + advesaries, attacker or malware to gain elevated privileges to the targeted or compromised host. On the other hand this can also be executed by + administrator for a certain task that needs admin rights. In this case filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path IN ("*/etc/doas.conf") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `linux_doas_conf_file_creation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. filter is needed +references: +- https://wiki.gentoo.org/wiki/Doas +- https://www.makeuseof.com/how-to-install-and-use-doas/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml new file mode 100644 index 0000000000..24ce248c77 --- /dev/null +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -0,0 +1,71 @@ +name: Linux Doas Tool Execution +id: d5a62490-6e09-11ec-884e-acde48001122 +version: 1 +date: '2022-01-05' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect the doas tool execution in linux host platform. This utility tool allow standard users to perform + tasks as root, the same way sudo does. This tool is developed as a minimalistic alternative to sudo application. This tool can be abused + advesaries, attacker or malware to gain elevated privileges to the targeted or compromised host. On the other hand this can also be executed by + administrator for a certain task that needs admin rights. In this case filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "doas" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_doas_tool_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. filter is needed +references: +- https://wiki.gentoo.org/wiki/Doas +- https://www.makeuseof.com/how-to-install-and-use-doas/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a doas $process_name$ with commandline $process$ was executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml new file mode 100644 index 0000000000..f8d604e03d --- /dev/null +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -0,0 +1,72 @@ +name: Linux Possible Access To Credential Files +id: 16107e0e-71fc-11ec-b862-acde48001122 +version: 1 +date: '2022-01-10' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a possible attempt to dump or access the content of /etc/passwd and /etc/shadow to enable offline credential cracking. + "etc/passwd" store user information within linux OS while "etc/shadow" contain the user passwords hash. Adversaries and threat actors may attempt to access this + to gain persistence and/or privilege escalation. This anomaly detection can be a good indicator of possible credential dumping technique but it might catch + some normal administrator automation scripts or during credential auditing. In this scenario filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name + IN("cat", "nano*","vim*", "vi*") AND Processes.process IN("*/etc/shadow*", "*/etc/passwd*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_access_to_credential_files_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. filter is needed +references: +- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd +- https://attack.mitre.org/techniques/T1003/008/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1003.008 + - T1003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml new file mode 100644 index 0000000000..bbddbf2c23 --- /dev/null +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -0,0 +1,71 @@ +name: Linux Possible Access To Sudoers File +id: 4479539c-71fc-11ec-b2e2-acde48001122 +version: 1 +date: '2022-01-10' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a possible access or modification of /etc/sudoers file. + "/etc/sudoers" file controls who can run what command as what users on what machine and can also control whether a specific user need a password for + particular commands. adversaries and threat actors abuse this file to gain persistence and/or privilege escalation during attack on targeted host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name + IN("cat", "nano*","vim*", "vi*") AND Processes.process IN("*/etc/sudoers*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_access_to_sudoers_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. filter is needed +references: +- https://attack.mitre.org/techniques/T1548/003/ +- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml new file mode 100644 index 0000000000..af92028cf3 --- /dev/null +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -0,0 +1,70 @@ +name: Linux Sudo OR Su Execution +id: 4b00f134-6d6a-11ec-a90c-acde48001122 +version: 1 +date: '2022-01-04' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to detect the execution of sudo or su command in linux operating system. + The "sudo" command allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run + some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. + This command is commonly abused by adversaries, malware author and red teamers to elevate privileges to the targeted host. This command + can be executed by administrator for legitimate purposes or to execute process that need admin privileges, In this scenario filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN ("sudo", "su") OR Processes.parent_process_name IN ("sudo", "su") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_sudo_or_su_execution_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: administrator or network operator can execute this command. filter is needed +references: +- https://attack.mitre.org/techniques/T1548/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that execute sudo or su in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/linux_add_user_account.test.yml b/tests/endpoint/linux_add_user_account.test.yml new file mode 100644 index 0000000000..90a79d5973 --- /dev/null +++ b/tests/endpoint/linux_add_user_account.test.yml @@ -0,0 +1,12 @@ +name: Linux Add User Account Unit Test +tests: +- name: Linux Add User Account + file: endpoint/linux_add_user_account.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_common_process_for_elevation_control.test.yml b/tests/endpoint/linux_common_process_for_elevation_control.test.yml new file mode 100644 index 0000000000..60f8445ae2 --- /dev/null +++ b/tests/endpoint/linux_common_process_for_elevation_control.test.yml @@ -0,0 +1,12 @@ +name: Linux Common Process For Elevation Control Unit Test +tests: +- name: Linux Common Process For Elevation Control + file: endpoint/linux_common_process_for_elevation_control.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_doas_conf_file_creation.test.yml b/tests/endpoint/linux_doas_conf_file_creation.test.yml new file mode 100644 index 0000000000..001f805563 --- /dev/null +++ b/tests/endpoint/linux_doas_conf_file_creation.test.yml @@ -0,0 +1,12 @@ +name: Linux Doas Conf File Creation Unit Test +tests: +- name: Linux Doas Conf File Creation + file: endpoint/linux_doas_conf_file_creation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_doas_tool_execution.test.yml b/tests/endpoint/linux_doas_tool_execution.test.yml new file mode 100644 index 0000000000..de4ddb2671 --- /dev/null +++ b/tests/endpoint/linux_doas_tool_execution.test.yml @@ -0,0 +1,12 @@ +name: Linux Doas Tool Execution Unit Test +tests: +- name: Linux Doas Tool Execution + file: endpoint/linux_doas_tool_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_possible_access_to_credential_files.test.yml b/tests/endpoint/linux_possible_access_to_credential_files.test.yml new file mode 100644 index 0000000000..054315ab72 --- /dev/null +++ b/tests/endpoint/linux_possible_access_to_credential_files.test.yml @@ -0,0 +1,12 @@ +name: Linux Possible Access To Credential Files Unit Test +tests: +- name: Linux Possible Access To Credential Files + file: endpoint/linux_possible_access_to_credential_files.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_possible_access_to_sudoers_file.test.yml b/tests/endpoint/linux_possible_access_to_sudoers_file.test.yml new file mode 100644 index 0000000000..d5f90456ff --- /dev/null +++ b/tests/endpoint/linux_possible_access_to_sudoers_file.test.yml @@ -0,0 +1,12 @@ +name: Linux Possible Access To Sudoers File Unit Test +tests: +- name: Linux Possible Access To Sudoers File + file: endpoint/linux_possible_access_to_sudoers_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_sudo_or_su_execution.test.yml b/tests/endpoint/linux_sudo_or_su_execution.test.yml new file mode 100644 index 0000000000..7d50de70b4 --- /dev/null +++ b/tests/endpoint/linux_sudo_or_su_execution.test.yml @@ -0,0 +1,12 @@ +name: Linux Sudo OR Su Execution Unit Test +tests: +- name: Linux Sudo OR Su Execution + file: endpoint/linux_sudo_or_su_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file From 745e9181764dc6cc5ed0a9ceec78ce02d7c38811 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 10 Jan 2022 23:51:42 +0000 Subject: [PATCH 02/10] Added detection testing service results inLinux Add User Account --- .../endpoint/linux_add_user_account.yml | 48 ++++++++++--------- 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index ba96c211d8..bf2bbe6227 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic looks for commands to create user accounts on the linux platform. - This technique is commonly abuse by adversaries, malware author and red teamers to persist on the targeted or compromised host by creating new user - with an elevated privilege. This Hunting query may catch normal creation of user by administrator so filter is needed. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where - Processes.process_name IN ("useradd", "adduser") OR Processes.process IN ("*useradd *", "*adduser *") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_add_user_account_filter`' +description: This analytic looks for commands to create user accounts on the linux + platform. This technique is commonly abuse by adversaries, malware author and red + teamers to persist on the targeted or compromised host by creating new user with + an elevated privilege. This Hunting query may catch normal creation of user by administrator + so filter is needed. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes + where Processes.process_name IN ("useradd", "adduser") OR Processes.process IN ("*useradd + *", "*adduser *") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. filter is needed + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. + filter is needed references: -- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ +- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ tags: analytic_story: - Linux Privilege Escalation @@ -40,18 +42,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 - risk_score: 25 + confidence: 50 + risk_score: 25 context: - source:endpoint - stage:Privilege Escalation Persistence @@ -66,4 +67,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From eeff9d94b27a8a4c1fd991ebe14f9f9333193959 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 Jan 2022 00:11:47 +0000 Subject: [PATCH 03/10] Added detection testing service results inLinux Doas Conf File Creation --- .../linux_doas_conf_file_creation.yml | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml index 63864e7d81..7ab383a703 100644 --- a/detections/endpoint/linux_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect the creation of doas.conf file in linux host platform. This configuration file can be use by - doas utility tool to allow or permit standard users to perform tasks as root, the same way sudo does. - This tool is developed as a minimalistic alternative to sudo application. This tool can be abused - advesaries, attacker or malware to gain elevated privileges to the targeted or compromised host. On the other hand this can also be executed by - administrator for a certain task that needs admin rights. In this case filter is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path IN ("*/etc/doas.conf") - by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `linux_doas_conf_file_creation_filter`' +description: This analytic is to detect the creation of doas.conf file in linux host + platform. This configuration file can be use by doas utility tool to allow or permit + standard users to perform tasks as root, the same way sudo does. This tool is developed + as a minimalistic alternative to sudo application. This tool can be abused advesaries, + attacker or malware to gain elevated privileges to the targeted or compromised host. + On the other hand this can also be executed by administrator for a certain task + that needs admin rights. In this case filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/doas.conf") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `linux_doas_conf_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. filter is needed + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. + filter is needed references: - https://wiki.gentoo.org/wiki/Doas - https://www.makeuseof.com/how-to-install-and-use-doas/ @@ -43,15 +44,14 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid - Filesystem.file_path security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - source:endpoint @@ -67,4 +67,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From fbc5e53407b4b738df28021d33c5dc534008aead Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 Jan 2022 00:12:45 +0000 Subject: [PATCH 04/10] Added detection testing service results inLinux Doas Tool Execution --- .../endpoint/linux_doas_tool_execution.yml | 45 ++++++++++--------- 1 file changed, 24 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml index 24ce248c77..477c3d0a43 100644 --- a/detections/endpoint/linux_doas_tool_execution.yml +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -6,22 +6,25 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect the doas tool execution in linux host platform. This utility tool allow standard users to perform - tasks as root, the same way sudo does. This tool is developed as a minimalistic alternative to sudo application. This tool can be abused - advesaries, attacker or malware to gain elevated privileges to the targeted or compromised host. On the other hand this can also be executed by - administrator for a certain task that needs admin rights. In this case filter is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "doas" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic is to detect the doas tool execution in linux host platform. + This utility tool allow standard users to perform tasks as root, the same way sudo + does. This tool is developed as a minimalistic alternative to sudo application. + This tool can be abused advesaries, attacker or malware to gain elevated privileges + to the targeted or compromised host. On the other hand this can also be executed + by administrator for a certain task that needs admin rights. In this case filter + is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "doas" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_doas_tool_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. filter is needed + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. + filter is needed references: - https://wiki.gentoo.org/wiki/Doas - https://www.makeuseof.com/how-to-install-and-use-doas/ @@ -42,17 +45,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - source:endpoint @@ -68,4 +70,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From ba46f791bb00af36be9bd604adeb8976c0e8b22d Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 Jan 2022 00:51:50 +0000 Subject: [PATCH 05/10] Added detection testing service results inLinux Possible Access To Credential Files --- ...ux_possible_access_to_credential_files.yml | 50 ++++++++++--------- 1 file changed, 26 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index f8d604e03d..a9e726c7b4 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -6,25 +6,27 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a possible attempt to dump or access the content of /etc/passwd and /etc/shadow to enable offline credential cracking. - "etc/passwd" store user information within linux OS while "etc/shadow" contain the user passwords hash. Adversaries and threat actors may attempt to access this - to gain persistence and/or privilege escalation. This anomaly detection can be a good indicator of possible credential dumping technique but it might catch - some normal administrator automation scripts or during credential auditing. In this scenario filter is needed. +description: This analytic is to detect a possible attempt to dump or access the content + of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd" + store user information within linux OS while "etc/shadow" contain the user passwords + hash. Adversaries and threat actors may attempt to access this to gain persistence + and/or privilege escalation. This anomaly detection can be a good indicator of possible + credential dumping technique but it might catch some normal administrator automation + scripts or during credential auditing. In this scenario filter is needed. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name - IN("cat", "nano*","vim*", "vi*") AND Processes.process IN("*/etc/shadow*", "*/etc/passwd*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_possible_access_to_credential_files_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat", + "nano*","vim*", "vi*") AND Processes.process IN("*/etc/shadow*", "*/etc/passwd*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_credential_files_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. filter is needed + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. + filter is needed references: -- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd +- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd - https://attack.mitre.org/techniques/T1003/008/ tags: analytic_story: @@ -43,18 +45,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 - risk_score: 25 + confidence: 50 + risk_score: 25 context: - source:endpoint - stage:Privilege Escalation Persistence @@ -69,4 +70,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From d7d8acaced29df66c853d437d888540c4f1ec9dd Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 Jan 2022 00:54:51 +0000 Subject: [PATCH 06/10] Added detection testing service results inLinux Sudo OR Su Execution --- .../endpoint/linux_sudo_or_su_execution.yml | 49 ++++++++++--------- 1 file changed, 26 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml index af92028cf3..40371377da 100644 --- a/detections/endpoint/linux_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -6,24 +6,27 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to detect the execution of sudo or su command in linux operating system. - The "sudo" command allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run - some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. - This command is commonly abused by adversaries, malware author and red teamers to elevate privileges to the targeted host. This command - can be executed by administrator for legitimate purposes or to execute process that need admin privileges, In this scenario filter is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name IN ("sudo", "su") OR Processes.parent_process_name IN ("sudo", "su") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_sudo_or_su_execution_filter`' +description: This analytic is to detect the execution of sudo or su command in linux + operating system. The "sudo" command allows a system administrator to delegate authority + to give certain users (or groups of users) the ability to run some (or all) commands + as root or another user while providing an audit trail of the commands and their + arguments. This command is commonly abused by adversaries, malware author and red + teamers to elevate privileges to the targeted host. This command can be executed + by administrator for legitimate purposes or to execute process that need admin privileges, + In this scenario filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("sudo", + "su") OR Processes.parent_process_name IN ("sudo", "su") by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: administrator or network operator can execute this command. filter is needed +known_false_positives: administrator or network operator can execute this command. + filter is needed references: -- https://attack.mitre.org/techniques/T1548/003/ +- https://attack.mitre.org/techniques/T1548/003/ tags: analytic_story: - Linux Privilege Escalation @@ -41,17 +44,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 context: - source:endpoint @@ -67,4 +69,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From d4259f39ef5c3298b434acc5e8516002c9f7bd2b Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 Jan 2022 09:12:52 +0000 Subject: [PATCH 07/10] Added detection testing service results inLinux Possible Access To Sudoers File --- .../linux_possible_access_to_sudoers_file.yml | 45 ++++++++++--------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index bbddbf2c23..dfbfc24933 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -6,22 +6,23 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a possible access or modification of /etc/sudoers file. - "/etc/sudoers" file controls who can run what command as what users on what machine and can also control whether a specific user need a password for - particular commands. adversaries and threat actors abuse this file to gain persistence and/or privilege escalation during attack on targeted host. +description: This analytic is to detect a possible access or modification of /etc/sudoers + file. "/etc/sudoers" file controls who can run what command as what users on what + machine and can also control whether a specific user need a password for particular + commands. adversaries and threat actors abuse this file to gain persistence and/or + privilege escalation during attack on targeted host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name - IN("cat", "nano*","vim*", "vi*") AND Processes.process IN("*/etc/sudoers*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_possible_access_to_sudoers_file_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat", + "nano*","vim*", "vi*") AND Processes.process IN("*/etc/sudoers*") by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_sudoers_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. filter is needed + Sysmon TA. +known_false_positives: administrator or network operator can execute this command. + filter is needed references: - https://attack.mitre.org/techniques/T1548/003/ - https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf @@ -42,18 +43,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 - risk_score: 25 + confidence: 50 + risk_score: 25 context: - source:endpoint - stage:Privilege Escalation Persistence @@ -68,4 +68,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From ec7e006abb2546f4818cc8939451fb106afc76e3 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 11 Jan 2022 11:09:41 +0100 Subject: [PATCH 08/10] linux_persist_priv_batch_4 --- .../endpoint/linux_common_process_for_elevation_control.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index 1de8c5acab..e345bb9afb 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -12,7 +12,7 @@ description: This analytic is to look for possible elevation control access usin search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chmod", "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr", "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid", "setregid") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", - "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid *", "*setregid *", “*setcap *”) + "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid *", "*setregid *", "*setcap *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` From 60edc89fdcdab75d674db51e1278bca6c552cecf Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 Jan 2022 10:30:16 +0000 Subject: [PATCH 09/10] Added detection testing service results inLinux Common Process For Elevation Control --- ...x_common_process_for_elevation_control.yml | 47 ++++++++++--------- 1 file changed, 26 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index e345bb9afb..ffccfef597 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -6,18 +6,23 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. - This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. - Tis common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where - Processes.process_name IN ("chmod", "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr", "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid", "setregid") - OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", - "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid *", "*setregid *", "*setcap *") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_common_process_for_elevation_control_filter`' +description: This analytic is to look for possible elevation control access using + a common known process in linux platform to change the attribute and file ownership. + This technique is commonly abused by adversaries, malware author and red teamers + to gain persistence or privilege escalation on the target or compromised host. Tis + common process is used to modify file attribute, file ownership or SUID. This tools + can be used in legitimate purposes so filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chmod", + "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr", + "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid", + "setregid") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat + *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", + "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid + *", "*setregid *", "*setcap *") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`' how_to_implement: UPDATE_HOW_TO_IMPLEMENT known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: @@ -42,17 +47,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 context: - source:endpoint @@ -68,4 +72,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From e8b6be29c7ee9a06eaf3120a4f33545ca0141f50 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 11 Jan 2022 15:44:16 -0800 Subject: [PATCH 10/10] yml changes and testing --- detections/endpoint/linux_add_user_account.yml | 14 +++++++------- .../linux_common_process_for_elevation_control.yml | 14 +++++++++----- .../endpoint/linux_doas_conf_file_creation.yml | 14 +++++++------- detections/endpoint/linux_doas_tool_execution.yml | 14 +++++++------- .../linux_possible_access_to_credential_files.yml | 13 ++++++------- .../linux_possible_access_to_sudoers_file.yml | 13 ++++++------- detections/endpoint/linux_sudo_or_su_execution.yml | 12 ++++++------ 7 files changed, 48 insertions(+), 46 deletions(-) diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index bf2bbe6227..b77daccbde 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. - filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ tags: @@ -54,9 +53,10 @@ tags: confidence: 50 risk_score: 25 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that may create user account on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may create user account on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index ffccfef597..904b32a0a0 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -23,8 +23,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1548/001/ - https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297 @@ -59,9 +62,10 @@ tags: confidence: 30 risk_score: 9 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ with process $process_name$ on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ with process $process_name$ on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml index 7ab383a703..35f72a92e5 100644 --- a/detections/endpoint/linux_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -20,10 +20,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `linux_doas_conf_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. - filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://wiki.gentoo.org/wiki/Doas - https://www.makeuseof.com/how-to-install-and-use-doas/ @@ -54,9 +53,10 @@ tags: confidence: 70 risk_score: 49 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a file $file_name$ is created in $file_path$ on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml index 477c3d0a43..f6b50a06f3 100644 --- a/detections/endpoint/linux_doas_tool_execution.yml +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -21,10 +21,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `linux_doas_tool_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. - filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://wiki.gentoo.org/wiki/Doas - https://www.makeuseof.com/how-to-install-and-use-doas/ @@ -57,9 +56,10 @@ tags: confidence: 70 risk_score: 49 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a doas $process_name$ with commandline $process$ was executed on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A doas $process_name$ with commandline $process$ was executed on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index a9e726c7b4..be46affa88 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -21,10 +21,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_credential_files_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. - filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd - https://attack.mitre.org/techniques/T1003/008/ @@ -57,9 +55,10 @@ tags: confidence: 50 risk_score: 25 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ executed on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ executed on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index dfbfc24933..df23a9d833 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -19,10 +19,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_sudoers_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can execute this command. - filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1548/003/ - https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf @@ -55,9 +53,10 @@ tags: confidence: 50 risk_score: 25 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ executed on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ executed on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml index 40371377da..ee45705384 100644 --- a/detections/endpoint/linux_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -22,9 +22,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: administrator or network operator can execute this command. - filter is needed + your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1548/003/ tags: @@ -56,9 +55,10 @@ tags: confidence: 30 risk_score: 9 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that execute sudo or su in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that execute sudo or su in $dest$ observable: - name: dest type: Hostname