admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

skeleton of linux rootkit story

Browse Source
This commit is contained in:
divious1
2020-09-08 19:58:34 -04:00
parent 2ed48b0016
commit 691a46e468
1 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stories/linux_rootkits.yml
+3 -6
View File
@@ -2,16 +2,13 @@ name: Credential Dumping
id: eaa45cfb-a7ed-4f2d-b16f-4667ad152d82
version: 3
date: '2020-08-31'
description: Uncover linux rootkits when detected by a tool or via suspicios
activity in a system like kernel hooking. Linux rootkits although somewhat rare
to see in the wild are due to the various obfuscation techniques they use.
The included searches in this Analytic Story are designed to identify rootkit infections.
description: Uncover linux rootkits when detected by a tool or via suspicios activity in a system like kernel hooking. Linux rootkits although somewhat rare to see in the wild are due to the various obfuscation techniques they use. The included searches in this Analytic Story are designed to identify rootkit infections.
narrative: ''
author: Jose Hernandez, Splunk
type: ESCU
references:
- https://attack.mitre.org/wiki/Technique/T1003
- https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
- https://attack.mitre.org/wiki/Technique/T1014
- https://www.splunk.com/en_us/blog/security/a-little-splunk-medicinalrub-for-your-drovorub-rootkit-questions.html
tags:
analytics_story: Linux Rootkits
usecase: Advanced Threat Detection