diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 06df72a3bd..cec01c4d5e 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -6,17 +6,17 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. - This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow +description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. + This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest - Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest + Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 - | `drop_dm_object_name(Processes)` + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter`' @@ -24,14 +24,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: administrator may do this commandline for auditing and testing purposes. +known_false_positives: administrator may do this commandline for auditing and testing purposes. In this scenario filter is needed. references: - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: - - Cyclops BLink + - CyclopsBLink asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index ea3ad76690..0d82dbfbdc 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic looks for suspicious process kworker commandline in a linux machine. - kworker process name or thread are common names of kernel threads in linux process. - This hunting detections can lead to investigate process contains process path in - writable directory in linux like /home/, /var/log and /tmp/. This technique was seen - in cyclopsblink malware to blend its core and other of its child process as normal - kworker on the compromised machine. This detection might be a good pivot to look for +description: This analytic looks for suspicious process kworker commandline in a linux machine. + kworker process name or thread are common names of kernel threads in linux process. + This hunting detections can lead to investigate process contains process path in + writable directory in linux like /home/, /var/log and /tmp/. This technique was seen + in cyclopsblink malware to blend its core and other of its child process as normal + kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path - Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` + Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kworker_process_in_writable_process_path_filter`' @@ -31,7 +31,7 @@ references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: - - Cyclops BLink + - CyclopsBLink asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml index 3d1f335194..8d591eef56 100644 --- a/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ b/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. - This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the +description: This analytic looks for suspicious commandline that redirect the stdout or possible stderror to dev/null file. + This technique was seen in cyclopsblink malware where it redirect the possible output or error while modify the iptables firewall setting of the compromised machine to hide its action from the user. This Anomaly detection is a good pivot to look further why process or user use this un common approach. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*&>/dev/null*" - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process = "*&>/dev/null*" + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name - | `drop_dm_object_name(Processes)` + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `linux_stdout_redirection_to_dev_null_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -27,7 +27,7 @@ references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: - - Cyclops BLink + - CyclopsBLink - Industroyer2 asset_type: Endpoint cis20: