Branch was auto-updated.

detections/endpoint/linux_iptables_firewall_modification.yml

@@ -1,7 +1,7 @@
 name: Linux Iptables Firewall Modification
 id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7
-version: 1
-date: '2022-04-05'
+version: 2
+date: '2022-04-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
@@ -10,12 +10,15 @@ description: This analytic looks for suspicious commandline that modify the ipta
   This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow 
   traffic to its tcp port that will be used to communicate with its C2 server.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where  Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*"
-  by  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
-  Processes.process_guid Processes.dest Processes.user Processes.parent_process_name
+  where  Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*"
+  AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*"))
+  by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest 
+  Processes.user Processes.parent_process_name  Processes.parent_process_path Processes.process_path 
+  | rex field=Processes.process "--dport (?<port>3269|636|989|994|995|8443)"
+  | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(lastTime)`
   | `linux_iptables_firewall_modification_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -34,13 +37,13 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
-  confidence: 70
+  confidence: 50
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log
-  impact: 70
+  impact: 50
   kill_chain_phases:
   - Exploitation
   message: A commandline $process$ that may modify iptables firewall on $dest$
@@ -67,5 +70,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  risk_score: 49
+  risk_score: 25
   security_domain: endpoint

detections/endpoint/linux_kworker_process_in_writable_process_path.yml

@@ -1,23 +1,26 @@
-name: Linux Kworker Process CommandLine
+name: Linux Kworker Process In Writable Process Path
 id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed
-version: 1
-date: '2022-04-05'
+version: 2
+date: '2022-04-30'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Hunting
 datamodel:
 - Endpoint
 description:  This analytic looks for suspicious process kworker commandline in a linux machine. 
-  kworker process name or thread are common name of kernel thread in linux process. So it is really a suspicious event a normal user process 
-  contain this process commandline. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal 
-  kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks.
+  kworker process name or thread are common names of kernel threads in linux process. 
+  This hunting detections can lead to investigate process contains process path in 
+  writable directory in linux like /home/, /var/log and /tmp/. This technique was seen 
+  in cyclopsblink malware to blend its core and other of its child process as normal 
+  kworker on the compromised machine. This detection might be a good pivot to look for 
+  other IOC related to cyclopsblink malware or attacks.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where  Processes.process = "*[kworker/*" OR Processes.parent_process = "*[kworker/*"
-  by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+  where  Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*"
+  by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path
   Processes.process_guid Processes.dest Processes.user 
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `linux_kworker_process_commandline_filter`'
+  | `security_content_ctime(lastTime)`
+  | `linux_kworker_process_in_writable_process_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -34,13 +37,13 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
-  confidence: 80
+  confidence: 60
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log
-  impact: 80
+  impact: 60
   kill_chain_phases:
   - Exploitation
   message: a $process_name$ with kworker commandline in $dest$
@@ -67,5 +70,7 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  risk_score: 64
+  - Processes.parent_process_path
+  - Processes.process_path
+  risk_score: 36
   security_domain: endpoint

tests/endpoint/linux_kworker_process_in_writable_process_path.test.yml

@@ -1,7 +1,7 @@
-name: Linux Kworker Process CommandLine Unit Test
+name: Linux Kworker Process In Writable Process Path Unit Test
 tests:
-- name: Linux Kworker Process CommandLine
-  file: endpoint/linux_kworker_process_commandline.yml
+- name: Linux Kworker Process In Writable Process Path
+  file: endpoint/linux_kworker_process_in_writable_process_path.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now