From 691a46e468bee7cf6923abe66dfd4ae0e2b7ea72 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 8 Sep 2020 19:58:34 -0400 Subject: [PATCH] skeleton of linux rootkit story --- stories/linux_rootkits.yml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/stories/linux_rootkits.yml b/stories/linux_rootkits.yml index c7282bf8a6..075c1e668d 100644 --- a/stories/linux_rootkits.yml +++ b/stories/linux_rootkits.yml @@ -2,16 +2,13 @@ name: Credential Dumping id: eaa45cfb-a7ed-4f2d-b16f-4667ad152d82 version: 3 date: '2020-08-31' -description: Uncover linux rootkits when detected by a tool or via suspicios -activity in a system like kernel hooking. Linux rootkits although somewhat rare -to see in the wild are due to the various obfuscation techniques they use. -The included searches in this Analytic Story are designed to identify rootkit infections. +description: Uncover linux rootkits when detected by a tool or via suspicios activity in a system like kernel hooking. Linux rootkits although somewhat rare to see in the wild are due to the various obfuscation techniques they use. The included searches in this Analytic Story are designed to identify rootkit infections. narrative: '' author: Jose Hernandez, Splunk type: ESCU references: -- https://attack.mitre.org/wiki/Technique/T1003 -- https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html +- https://attack.mitre.org/wiki/Technique/T1014 +- https://www.splunk.com/en_us/blog/security/a-little-splunk-medicinalrub-for-your-drovorub-rootkit-questions.html tags: analytics_story: Linux Rootkits usecase: Advanced Threat Detection