From 37185f3e0d3b0972cdb20cd2a4197a81aa5f01fe Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 5 Jan 2022 11:34:57 +0100
Subject: [PATCH 01/13] linux_persist_priv_batch_3

---
 .../linux_change_file_owner_to_root.yml       | 71 +++++++++++++++++++
 ...ile_created_in_kernel_driver_directory.yml | 71 +++++++++++++++++++
 ...ert_kernel_module_using_insmod_utility.yml | 71 +++++++++++++++++++
 ...l_kernel_module_using_modprobe_utility.yml | 71 +++++++++++++++++++
 .../linux_preload_hijack_library_calls.yml    | 69 ++++++++++++++++++
 .../linux_sudoers_tmp_file_creation.yml       | 68 ++++++++++++++++++
 .../linux_visudo_utility_execution.yml        | 70 ++++++++++++++++++
 .../linux_change_file_owner_to_root.test.yml  | 12 ++++
 ...reated_in_kernel_driver_directory.test.yml | 12 ++++
 ...ernel_module_using_insmod_utility.test.yml | 12 ++++
 ...nel_module_using_modprobe_utility.test.yml | 12 ++++
 ...inux_preload_hijack_library_calls.test.yml | 12 ++++
 .../linux_sudoers_tmp_file_creation.test.yml  | 12 ++++
 .../linux_visudo_utility_execution.test.yml   | 12 ++++
 14 files changed, 575 insertions(+)
 create mode 100644 detections/endpoint/linux_change_file_owner_to_root.yml
 create mode 100644 detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
 create mode 100644 detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
 create mode 100644 detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
 create mode 100644 detections/endpoint/linux_preload_hijack_library_calls.yml
 create mode 100644 detections/endpoint/linux_sudoers_tmp_file_creation.yml
 create mode 100644 detections/endpoint/linux_visudo_utility_execution.yml
 create mode 100644 tests/endpoint/linux_change_file_owner_to_root.test.yml
 create mode 100644 tests/endpoint/linux_file_created_in_kernel_driver_directory.test.yml
 create mode 100644 tests/endpoint/linux_insert_kernel_module_using_insmod_utility.test.yml
 create mode 100644 tests/endpoint/linux_install_kernel_module_using_modprobe_utility.test.yml
 create mode 100644 tests/endpoint/linux_preload_hijack_library_calls.test.yml
 create mode 100644 tests/endpoint/linux_sudoers_tmp_file_creation.test.yml
 create mode 100644 tests/endpoint/linux_visudo_utility_execution.test.yml

diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml
new file mode 100644
index 0000000000..593e6cd75e
--- /dev/null
+++ b/detections/endpoint/linux_change_file_owner_to_root.yml
@@ -0,0 +1,71 @@
+name: Linux Change File Owner To Root
+id: c1400ea2-6257-11ec-ad49-acde48001122
+version: 1
+date: '2021-12-21'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic looks for a commandline that change the file owner to root using chown utility tool. 
+  This technique is commonly abuse by adversaries, malware author and red teamers to escalate privilege to the targeted or compromised host by 
+  changing the owner of their malicious file to root. This event is not so common in corporate network except from the administrator doing normal task that needs 
+  high privilege.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where 
+  (Processes.process_name = chown OR Processes.process = "*chown *") AND Processes.process = "* root *"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `linux_change_file_owner_to_root_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: administrator or network operator can execute this command. filter is needed 
+references:
+- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users
+- https://askubuntu.com/questions/617850/changing-from-user-to-superuser
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1222.002
+  - T1222
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 80 
+  # (impact * confidence)/100
+  risk_score: 64 
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a commandline $process$ that may change ownership to root on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
new file mode 100644
index 0000000000..4d61ff489e
--- /dev/null
+++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
@@ -0,0 +1,71 @@
+name: Linux File Created In Kernel Driver Directory
+id: b85bbeec-6326-11ec-9311-acde48001122
+version: 1
+date: '2021-12-22'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic looks for suspicious file creation in kernel/driver directory in linux platform. 
+  This directory is known folder for all linux kernel module available within the system. so creation of file in this directory is a good indicator 
+  that there is a possible rootkit installation in the host machine. This technique was abuse by adversaries, malware author and red teamers to gain 
+  high privileges to their malicious code such us in kernel level. Even this event is not so common administrator or legitimate 3rd party tool may install driver or linux kernel 
+  module as part of its installation.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_path IN ("*/kernel/drivers/*") 
+  by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
+  | `drop_dm_object_name(Filesystem)`
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `linux_file_created_in_kernel_driver_directory_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: administrator or network operator can create file in this folders for automation purposes. filter is needed 
+references:
+- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
+- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
+- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1547.006
+  - T1547
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest 
+  - Filesystem.file_create_time 
+  - Filesystem.file_name 
+  - Filesystem.process_guid 
+  - Filesystem.file_path
+  security_domain: endpoint
+  impact: 80
+  confidence: 90 
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a file $file_name$ is created in $file_path$ on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
new file mode 100644
index 0000000000..996d4b5b58
--- /dev/null
+++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
@@ -0,0 +1,71 @@
+name: Linux Insert Kernel Module Using Insmod Utility
+id: 18b5a1a0-6326-11ec-943a-acde48001122
+version: 1
+date: '2021-12-22'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic looks for inserting of linux kernel module using insmod utility function. 
+  This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. 
+  This Anomaly detection is a good indicator that someone installing kernel module in a linux host either admin or adversaries. filter is needed in this scenario
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name IN("kmod", "sudo") AND Processes.process = *insmod* 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `linux_insert_kernel_module_using_insmod_utility_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: administrator or network operator can execute this command. filter is needed 
+references:
+- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
+- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
+- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1547.006
+  - T1547
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 80 
+  # (impact * confidence)/100
+  risk_score: 64 
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a commandline $process$ that may install kernel module on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
new file mode 100644
index 0000000000..3ed54803a5
--- /dev/null
+++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
@@ -0,0 +1,71 @@
+name: Linux Install Kernel Module Using Modprobe Utility
+id: 387b278a-6326-11ec-aa2c-acde48001122
+version: 1
+date: '2021-12-22'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic looks for possible installing a linux kernel module using modprobe utility function. 
+  This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. 
+  This Anomaly detection is a good indicator that someone installing kernel module in a linux host either admin or adversaries. filter is needed in this scenario
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name IN("kmod", "sudo") AND Processes.process = *modprobe* 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `linux_install_kernel_module_using_modprobe_utility_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: administrator or network operator can execute this command. filter is needed 
+references:
+- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
+- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
+- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1547.006
+  - T1547
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 80 
+  # (impact * confidence)/100
+  risk_score: 64 
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a commandline $process$ that may install kernel module on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml
new file mode 100644
index 0000000000..c6df333f4d
--- /dev/null
+++ b/detections/endpoint/linux_preload_hijack_library_calls.yml
@@ -0,0 +1,69 @@
+name: Linux Preload Hijack Library Calls
+id: cbe2ca30-631e-11ec-8670-acde48001122
+version: 1
+date: '2021-12-22'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious command that may hijack a library function in linux platform. 
+  This technique is commonly abuse by adversaries, malware author and red teamers to gain privileges and persist on the machine. 
+  This detection pertains to loading a dll to hijack or hook a library function of specific program using LD_PRELOAD command.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process = "*LD_PRELOAD*" 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `linux_preload_hijack_library_calls_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: administrator or network operator can execute this command. filter is needed 
+references:
+-  https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1574.006
+  - T1574
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 80 
+  # (impact * confidence)/100
+  risk_score: 64 
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a commandline $process$ that may hijack library function on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
new file mode 100644
index 0000000000..d6a1f01535
--- /dev/null
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -0,0 +1,68 @@
+name: Linux Sudoers Tmp File Creation
+id: be254a5c-63e7-11ec-89da-acde48001122
+version: 1
+date: '2021-12-23'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to looks for file creation of sudoers.tmp file cause by editong /etc/sudoers using visudo in linux platform. 
+  This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. 
+  /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. 
+  The file is composed of aliases (basically variables) and user specifications (which control who can run what).
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_path IN ("*/etc/sudoers*") 
+  by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
+  | `drop_dm_object_name(Filesystem)`
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)`
+  | `linux_sudoers_tmp_file_creation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: administrator or network operator can execute this command. filter is needed 
+references:
+-  https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest 
+  - Filesystem.file_create_time 
+  - Filesystem.file_name 
+  - Filesystem.process_guid 
+  - Filesystem.file_path
+  security_domain: endpoint
+  impact: 80
+  confidence: 90 
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a file $file_name$ is created in $file_path$ on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml
new file mode 100644
index 0000000000..4f12556dbb
--- /dev/null
+++ b/detections/endpoint/linux_visudo_utility_execution.yml
@@ -0,0 +1,70 @@
+name: Linux Visudo Utility Execution
+id: 08c41040-624c-11ec-a71f-acde48001122
+version: 1
+date: '2021-12-21'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to looks for suspicious commandline that add entry to /etc/sudoers by using visudo utility tool in linux platform. 
+  This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. 
+  /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. 
+  The file is composed of aliases (basically variables) and user specifications (which control who can run what).
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where 
+  Processes.process_name = visudo
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `linux_visudo_utility_execution_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: administrator or network operator can execute this command. filter is needed 
+references:
+-  https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 40
+  confidence: 40 
+  # (impact * confidence)/100
+  risk_score: 16 
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/tests/endpoint/linux_change_file_owner_to_root.test.yml b/tests/endpoint/linux_change_file_owner_to_root.test.yml
new file mode 100644
index 0000000000..9549f84393
--- /dev/null
+++ b/tests/endpoint/linux_change_file_owner_to_root.test.yml
@@ -0,0 +1,12 @@
+name: Linux Change File Owner To Root Unit Test
+tests:
+- name: Linux Change File Owner To Root
+  file: endpoint/linux_change_file_owner_to_root.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file
diff --git a/tests/endpoint/linux_file_created_in_kernel_driver_directory.test.yml b/tests/endpoint/linux_file_created_in_kernel_driver_directory.test.yml
new file mode 100644
index 0000000000..8ef34feb59
--- /dev/null
+++ b/tests/endpoint/linux_file_created_in_kernel_driver_directory.test.yml
@@ -0,0 +1,12 @@
+name: Linux File Created In Kernel Driver Directory Unit Test
+tests:
+- name: Linux File Created In Kernel Driver Directory
+  file: endpoint/linux_file_created_in_kernel_driver_directory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file
diff --git a/tests/endpoint/linux_insert_kernel_module_using_insmod_utility.test.yml b/tests/endpoint/linux_insert_kernel_module_using_insmod_utility.test.yml
new file mode 100644
index 0000000000..bbbfab5235
--- /dev/null
+++ b/tests/endpoint/linux_insert_kernel_module_using_insmod_utility.test.yml
@@ -0,0 +1,12 @@
+name: Linux Insert Kernel Module Using Insmod Utility Unit Test
+tests:
+- name: Linux Insert Kernel Module Using Insmod Utility
+  file: endpoint/linux_insert_kernel_module_using_insmod_utility.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file
diff --git a/tests/endpoint/linux_install_kernel_module_using_modprobe_utility.test.yml b/tests/endpoint/linux_install_kernel_module_using_modprobe_utility.test.yml
new file mode 100644
index 0000000000..8b436cebc1
--- /dev/null
+++ b/tests/endpoint/linux_install_kernel_module_using_modprobe_utility.test.yml
@@ -0,0 +1,12 @@
+name: Linux Install Kernel Module Using Modprobe Utility Unit Test
+tests:
+- name: Linux Install Kernel Module Using Modprobe Utility
+  file: endpoint/linux_install_kernel_module_using_modprobe_utility.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file
diff --git a/tests/endpoint/linux_preload_hijack_library_calls.test.yml b/tests/endpoint/linux_preload_hijack_library_calls.test.yml
new file mode 100644
index 0000000000..526971f77c
--- /dev/null
+++ b/tests/endpoint/linux_preload_hijack_library_calls.test.yml
@@ -0,0 +1,12 @@
+name: Linux Preload Hijack Library Calls Unit Test
+tests:
+- name: Linux Preload Hijack Library Calls
+  file: endpoint/linux_preload_hijack_library_calls.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file
diff --git a/tests/endpoint/linux_sudoers_tmp_file_creation.test.yml b/tests/endpoint/linux_sudoers_tmp_file_creation.test.yml
new file mode 100644
index 0000000000..8629fafa45
--- /dev/null
+++ b/tests/endpoint/linux_sudoers_tmp_file_creation.test.yml
@@ -0,0 +1,12 @@
+name: Linux Sudoers Tmp File Creation Unit Test
+tests:
+- name: Linux Sudoers Tmp File Creation
+  file: endpoint/linux_sudoers_tmp_file_creation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file
diff --git a/tests/endpoint/linux_visudo_utility_execution.test.yml b/tests/endpoint/linux_visudo_utility_execution.test.yml
new file mode 100644
index 0000000000..acc41ead03
--- /dev/null
+++ b/tests/endpoint/linux_visudo_utility_execution.test.yml
@@ -0,0 +1,12 @@
+name: Linux Visudo Utility Execution Unit Test
+tests:
+- name: Linux Visudo Utility Execution
+  file: endpoint/linux_visudo_utility_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file

From 78e61e8ee4f6f3218069789903a5b9b43824d8ef Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-72-206>
Date: Wed, 5 Jan 2022 11:42:47 +0000
Subject: [PATCH 02/13] Added detection testing service results inLinux Change
 File Owner To Root

---
 .../linux_change_file_owner_to_root.yml       | 46 ++++++++++---------
 1 file changed, 24 insertions(+), 22 deletions(-)

diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml
index 593e6cd75e..5e452b14d9 100644
--- a/detections/endpoint/linux_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_change_file_owner_to_root.yml
@@ -6,22 +6,24 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for a commandline that change the file owner to root using chown utility tool. 
-  This technique is commonly abuse by adversaries, malware author and red teamers to escalate privilege to the targeted or compromised host by 
-  changing the owner of their malicious file to root. This event is not so common in corporate network except from the administrator doing normal task that needs 
+description: This analytic looks for a commandline that change the file owner to root
+  using chown utility tool. This technique is commonly abuse by adversaries, malware
+  author and red teamers to escalate privilege to the targeted or compromised host
+  by changing the owner of their malicious file to root. This event is not so common
+  in corporate network except from the administrator doing normal task that needs
   high privilege.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where 
-  (Processes.process_name = chown OR Processes.process = "*chown *") AND Processes.process = "* root *"
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `linux_change_file_owner_to_root_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = chown
+  OR Processes.process = "*chown *") AND Processes.process = "* root *" by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_change_file_owner_to_root_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: administrator or network operator can execute this command. filter is needed 
+  Sysmon TA.
+known_false_positives: administrator or network operator can execute this command.
+  filter is needed
 references:
 - https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users
 - https://askubuntu.com/questions/617850/changing-from-user-to-superuser
@@ -42,18 +44,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 80
-  confidence: 80 
-  # (impact * confidence)/100
-  risk_score: 64 
+  confidence: 80
+  risk_score: 64
   context:
   - source:endpoint
   - stage:Privilege Escalation Persistence
@@ -68,4 +69,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16
+  automated_detection_testing: passed

From 377a4822f7d249a9ccde246cd30060b2c016c230 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 5 Jan 2022 12:47:45 +0100
Subject: [PATCH 03/13] linux_persist_priv_batch_3

---
 detections/endpoint/linux_sudoers_tmp_file_creation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index d6a1f01535..2e0d6c2baa 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -29,7 +29,7 @@ tags:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:

From fb306cb79b4b8702f72b6b67faa7d124eee43c34 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-179-220>
Date: Wed, 5 Jan 2022 12:12:09 +0000
Subject: [PATCH 04/13] Added detection testing service results inLinux Visudo
 Utility Execution

---
 .../linux_visudo_utility_execution.yml        | 49 ++++++++++---------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml
index 4f12556dbb..a6b466e62a 100644
--- a/detections/endpoint/linux_visudo_utility_execution.yml
+++ b/detections/endpoint/linux_visudo_utility_execution.yml
@@ -6,24 +6,27 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to looks for suspicious commandline that add entry to /etc/sudoers by using visudo utility tool in linux platform. 
-  This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. 
-  /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. 
-  The file is composed of aliases (basically variables) and user specifications (which control who can run what).
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where 
-  Processes.process_name = visudo
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+description: This analytic is to looks for suspicious commandline that add entry to
+  /etc/sudoers by using visudo utility tool in linux platform. This technique may
+  abuse by adversaries, malware author and red teamers to gain elevated privilege
+  to targeted or compromised host. /etc/sudoers file controls who can run what commands
+  as what users on what machines and can also control special things such as whether
+  you need a password for particular commands. The file is composed of aliases (basically
+  variables) and user specifications (which control who can run what).
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = visudo
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_visudo_utility_execution_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: administrator or network operator can execute this command. filter is needed 
+  Sysmon TA.
+known_false_positives: administrator or network operator can execute this command.
+  filter is needed
 references:
--  https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
+- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -41,18 +44,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 40
-  confidence: 40 
-  # (impact * confidence)/100
-  risk_score: 16 
+  confidence: 40
+  risk_score: 16
   context:
   - source:endpoint
   - stage:Privilege Escalation Persistence
@@ -67,4 +69,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16
+  automated_detection_testing: passed

From ab844e062ffa1ce7f3e08f41667592fbdf1c92e8 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 5 Jan 2022 13:17:08 +0100
Subject: [PATCH 05/13] linux_persist_priv_batch_3

---
 detections/endpoint/linux_sudoers_tmp_file_creation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index 2e0d6c2baa..3c75c2f18b 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -11,7 +11,7 @@ description: This analytic is to looks for file creation of sudoers.tmp file cau
   /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. 
   The file is composed of aliases (basically variables) and user specifications (which control who can run what).
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-  where Filesystem.file_path IN ("*/etc/sudoers*") 
+  where Filesystem.file_path IN ("*sudoers.tmp*") 
   by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
   | `drop_dm_object_name(Filesystem)`
   | `security_content_ctime(lastTime)` 

From 06ffa223946b9b802a2378551702d4e57c6e1a94 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 5 Jan 2022 13:20:37 +0100
Subject: [PATCH 06/13] Update linux_sudoers_tmp_file_creation.yml

---
 detections/endpoint/linux_sudoers_tmp_file_creation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index 3c75c2f18b..8726d9d04f 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to looks for file creation of sudoers.tmp file cause by editong /etc/sudoers using visudo in linux platform. 
+description: This analytic is to looks for file creation of sudoers.tmp file cause by editing /etc/sudoers using visudo in linux platform. 
   This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. 
   /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. 
   The file is composed of aliases (basically variables) and user specifications (which control who can run what).
@@ -65,4 +65,4 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16

From a1a6087bcdb1a918ede9bc6e7e3cb266fb738d50 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-199-235>
Date: Wed, 5 Jan 2022 12:38:46 +0000
Subject: [PATCH 07/13] Added detection testing service results inLinux Sudoers
 Tmp File Creation

---
 .../linux_sudoers_tmp_file_creation.yml       | 40 ++++++++++---------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index 8726d9d04f..958963ce45 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -6,30 +6,32 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to looks for file creation of sudoers.tmp file cause by editing /etc/sudoers using visudo in linux platform. 
-  This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. 
-  /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. 
-  The file is composed of aliases (basically variables) and user specifications (which control who can run what).
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-  where Filesystem.file_path IN ("*sudoers.tmp*") 
+description: This analytic is to looks for file creation of sudoers.tmp file cause
+  by editing /etc/sudoers using visudo in linux platform. This technique may abuse
+  by adversaries, malware author and red teamers to gain elevated privilege to targeted
+  or compromised host. /etc/sudoers file controls who can run what commands as what
+  users on what machines and can also control special things such as whether you need
+  a password for particular commands. The file is composed of aliases (basically variables)
+  and user specifications (which control who can run what).
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*sudoers.tmp*")
   by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
-  | `drop_dm_object_name(Filesystem)`
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)`
+  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `linux_sudoers_tmp_file_creation_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: administrator or network operator can execute this command. filter is needed 
+  Sysmon TA.
+known_false_positives: administrator or network operator can execute this command.
+  filter is needed
 references:
--  https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/
+- https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/
 tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
@@ -41,15 +43,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Filesystem.dest 
-  - Filesystem.file_create_time 
-  - Filesystem.file_name 
-  - Filesystem.process_guid 
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
   - Filesystem.file_path
   security_domain: endpoint
   impact: 80
-  confidence: 90 
-  # (impact * confidence)/100
+  confidence: 90
   risk_score: 72
   context:
   - source:endpoint
@@ -66,3 +67,4 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
+  automated_detection_testing: passed

From 64dfd4a621c99b08760d9df98cfa84c1a3714595 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-214-220>
Date: Wed, 5 Jan 2022 13:08:14 +0000
Subject: [PATCH 08/13] Added detection testing service results inLinux Install
 Kernel Module Using Modprobe Utility

---
 ...l_kernel_module_using_modprobe_utility.yml | 46 ++++++++++---------
 1 file changed, 24 insertions(+), 22 deletions(-)

diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
index 3ed54803a5..4d70510851 100644
--- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
+++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
@@ -6,21 +6,23 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for possible installing a linux kernel module using modprobe utility function. 
-  This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. 
-  This Anomaly detection is a good indicator that someone installing kernel module in a linux host either admin or adversaries. filter is needed in this scenario
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name IN("kmod", "sudo") AND Processes.process = *modprobe* 
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `linux_install_kernel_module_using_modprobe_utility_filter`'
+description: This analytic looks for possible installing a linux kernel module using
+  modprobe utility function. This event can detect a installation of rootkit or malicious
+  kernel module to gain elevated privileges to their malicious code and bypassed detections.
+  This Anomaly detection is a good indicator that someone installing kernel module
+  in a linux host either admin or adversaries. filter is needed in this scenario
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("kmod",
+  "sudo") AND Processes.process = *modprobe* by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_install_kernel_module_using_modprobe_utility_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: administrator or network operator can execute this command. filter is needed 
+  Sysmon TA.
+known_false_positives: administrator or network operator can execute this command.
+  filter is needed
 references:
 - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
 - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
@@ -42,18 +44,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 80
-  confidence: 80 
-  # (impact * confidence)/100
-  risk_score: 64 
+  confidence: 80
+  risk_score: 64
   context:
   - source:endpoint
   - stage:Privilege Escalation Persistence
@@ -68,4 +69,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16
+  automated_detection_testing: passed

From 2e9f51cca44fca899fb0c3f5a92c14de1f6d7905 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-39-230>
Date: Wed, 5 Jan 2022 14:34:31 +0000
Subject: [PATCH 09/13] Added detection testing service results inLinux File
 Created In Kernel Driver Directory

---
 ...ile_created_in_kernel_driver_directory.yml | 43 ++++++++++---------
 1 file changed, 22 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
index 4d61ff489e..cea36608b4 100644
--- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
+++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
@@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for suspicious file creation in kernel/driver directory in linux platform. 
-  This directory is known folder for all linux kernel module available within the system. so creation of file in this directory is a good indicator 
-  that there is a possible rootkit installation in the host machine. This technique was abuse by adversaries, malware author and red teamers to gain 
-  high privileges to their malicious code such us in kernel level. Even this event is not so common administrator or legitimate 3rd party tool may install driver or linux kernel 
-  module as part of its installation.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-  where Filesystem.file_path IN ("*/kernel/drivers/*") 
+description: This analytic looks for suspicious file creation in kernel/driver directory
+  in linux platform. This directory is known folder for all linux kernel module available
+  within the system. so creation of file in this directory is a good indicator that
+  there is a possible rootkit installation in the host machine. This technique was
+  abuse by adversaries, malware author and red teamers to gain high privileges to
+  their malicious code such us in kernel level. Even this event is not so common administrator
+  or legitimate 3rd party tool may install driver or linux kernel module as part of
+  its installation.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/kernel/drivers/*")
   by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
-  | `drop_dm_object_name(Filesystem)`
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)` 
+  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `linux_file_created_in_kernel_driver_directory_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: administrator or network operator can create file in this folders for automation purposes. filter is needed 
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: administrator or network operator can create file in this folders
+  for automation purposes. filter is needed
 references:
 - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
 - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
@@ -44,15 +45,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Filesystem.dest 
-  - Filesystem.file_create_time 
-  - Filesystem.file_name 
-  - Filesystem.process_guid 
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
   - Filesystem.file_path
   security_domain: endpoint
   impact: 80
-  confidence: 90 
-  # (impact * confidence)/100
+  confidence: 90
   risk_score: 72
   context:
   - source:endpoint
@@ -68,4 +68,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16
+  automated_detection_testing: passed

From 9bcad3d21b4e04adae57d89045e64d4d138d9b3d Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-177-120>
Date: Wed, 5 Jan 2022 16:34:58 +0000
Subject: [PATCH 10/13] Added detection testing service results inLinux Change
 File Owner To Root


From ef99a8c8bc819992cd482ba7e8c3de88b33f231d Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 10 Jan 2022 12:36:33 +0100
Subject: [PATCH 11/13] Update linux_sudoers_tmp_file_creation.yml

---
 detections/endpoint/linux_sudoers_tmp_file_creation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index 958963ce45..ab7f1f44e0 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: This analytic is to looks for file creation of sudoers.tmp file cause
-  by editing /etc/sudoers using visudo in linux platform. This technique may abuse
+  by editing /etc/sudoers using visudo or editor in linux platform. This technique may abuse
   by adversaries, malware author and red teamers to gain elevated privilege to targeted
   or compromised host. /etc/sudoers file controls who can run what commands as what
   users on what machines and can also control special things such as whether you need

From 69c2787e51295cfcb3b360194c4cf3dce7e9906b Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 10 Jan 2022 13:21:39 -0800
Subject: [PATCH 12/13] text updates

---
 .../endpoint/linux_change_file_owner_to_root.yml   | 14 +++++++-------
 ...nux_file_created_in_kernel_driver_directory.yml | 13 +++++++------
 ...x_insert_kernel_module_using_insmod_utility.yml | 12 ++++++------
 ...nstall_kernel_module_using_modprobe_utility.yml | 14 +++++++-------
 .../linux_preload_hijack_library_calls.yml         | 12 ++++++------
 .../endpoint/linux_sudoers_tmp_file_creation.yml   | 12 ++++++------
 .../endpoint/linux_visudo_utility_execution.yml    | 14 +++++++-------
 7 files changed, 46 insertions(+), 45 deletions(-)

diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml
index 5e452b14d9..7e29c8d51a 100644
--- a/detections/endpoint/linux_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_change_file_owner_to_root.yml
@@ -20,10 +20,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_change_file_owner_to_root_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: administrator or network operator can execute this command.
-  filter is needed
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
 references:
 - https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users
 - https://askubuntu.com/questions/617850/changing-from-user-to-superuser
@@ -56,9 +55,10 @@ tags:
   confidence: 80
   risk_score: 64
   context:
-  - source:endpoint
-  - stage:Privilege Escalation Persistence
-  message: a commandline $process$ that may change ownership to root on $dest$
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ that may change ownership to root on $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
index cea36608b4..e861f65251 100644
--- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
+++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
@@ -21,9 +21,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `linux_file_created_in_kernel_driver_directory_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the file name, file path, and process_guid executions from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: administrator or network operator can create file in this folders
-  for automation purposes. filter is needed
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can create file in this folders
+  for automation purposes. Please update the filter macros to remove false positives.
 references:
 - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
 - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
@@ -55,9 +55,10 @@ tags:
   confidence: 90
   risk_score: 72
   context:
-  - source:endpoint
-  - stage:Privilege Escalation Persistence
-  message: a file $file_name$ is created in $file_path$ on $dest$
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A file $file_name$ is created in $file_path$ on $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
index 996d4b5b58..48a20e8fb0 100644
--- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
+++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
@@ -18,9 +18,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `linux_insert_kernel_module_using_insmod_utility_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: administrator or network operator can execute this command. filter is needed 
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. 
 references:
 - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
 - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
@@ -55,9 +54,10 @@ tags:
   # (impact * confidence)/100
   risk_score: 64 
   context:
-  - source:endpoint
-  - stage:Privilege Escalation Persistence
-  message: a commandline $process$ that may install kernel module on $dest$
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ that may install kernel module on $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
index 4d70510851..1229cbeb3a 100644
--- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
+++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
@@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(lastTime)` | `linux_install_kernel_module_using_modprobe_utility_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: administrator or network operator can execute this command.
-  filter is needed
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
 references:
 - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
 - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
@@ -56,9 +55,10 @@ tags:
   confidence: 80
   risk_score: 64
   context:
-  - source:endpoint
-  - stage:Privilege Escalation Persistence
-  message: a commandline $process$ that may install kernel module on $dest$
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ that may install kernel module on $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml
index c6df333f4d..4ab7249615 100644
--- a/detections/endpoint/linux_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_preload_hijack_library_calls.yml
@@ -18,9 +18,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `linux_preload_hijack_library_calls_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: administrator or network operator can execute this command. filter is needed 
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase
+known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. 
 references:
 -  https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5
 tags:
@@ -53,9 +52,10 @@ tags:
   # (impact * confidence)/100
   risk_score: 64 
   context:
-  - source:endpoint
-  - stage:Privilege Escalation Persistence
-  message: a commandline $process$ that may hijack library function on $dest$
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ that may hijack library function on $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index ab7f1f44e0..5509b9e6b9 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -20,10 +20,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `linux_sudoers_tmp_file_creation_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: administrator or network operator can execute this command.
-  filter is needed
+  Please update the filter macros to remove false positives.
 references:
 - https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/
 tags:
@@ -53,9 +52,10 @@ tags:
   confidence: 90
   risk_score: 72
   context:
-  - source:endpoint
-  - stage:Privilege Escalation Persistence
-  message: a file $file_name$ is created in $file_path$ on $dest$
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A file $file_name$ is created in $file_path$ on $dest$
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml
index a6b466e62a..956364e969 100644
--- a/detections/endpoint/linux_visudo_utility_execution.yml
+++ b/detections/endpoint/linux_visudo_utility_execution.yml
@@ -21,10 +21,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `linux_visudo_utility_execution_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: administrator or network operator can execute this command.
-  filter is needed
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
 references:
 - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
 tags:
@@ -56,9 +55,10 @@ tags:
   confidence: 40
   risk_score: 16
   context:
-  - source:endpoint
-  - stage:Privilege Escalation Persistence
-  message: a commandline $process$ executed on $dest$
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A commandline $process$ executed on $dest$
   observable:
   - name: dest
     type: Hostname

From a8d236c1c2f84ee7c18f319739f98b25c4bda1f9 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 10 Jan 2022 13:22:24 -0800
Subject: [PATCH 13/13] test results passed from CI

---
 detections/endpoint/linux_preload_hijack_library_calls.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml
index 4ab7249615..7c8b43146e 100644
--- a/detections/endpoint/linux_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_preload_hijack_library_calls.yml
@@ -66,4 +66,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16
+  automated_detection_testing: passed
\ No newline at end of file