admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix auditd PATH type detections (#3810)

Browse Source 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
This commit is contained in:
Nasreddine Bencherchali
2025-12-03 00:41:30 +01:00
committed by GitHub
parent 064cbaef0d d8ddca1a2d
commit 731df609cf
8 changed files with 541 additions and 324 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data_sources/linux_auditd_cwd.yml
+25
View File
@@ -0,0 +1,25 @@
name: Linux Auditd Cwd
id: a9ef851b-d864-478b-b1b3-76535d7ff7fc
version: 1
date: '2025-12-02'
author: Nasreddine Bencherchali, Splunk
description: This type is used to record the working directory from which the process that invoked the system call specified in the first record was executed. The purpose of this record is to record the current process's location in case a relative path winds up being captured in the associated PATH record. This way the absolute path can be reconstructed.
source: auditd
sourcetype: auditd
separator: type
separator_value: CWD
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 10.2.0
fields:
- cwd
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- msg
- type
example_log: 'type=CWD msg=audit(11/20/2025 16:57:48.909:110027) : cwd=/etc/ssh'
detections/endpoint/linux_auditd_doas_conf_file_creation.yml
+84 -52
View File
@@ -1,78 +1,110 @@
name: Linux Auditd Doas Conf File Creation
id: 61059783-574b-40d2-ac2f-69b898afd6b4
version: 7
date: '2025-06-10'
author: Teoderick Contreras, Splunk
version: 8
date: '2025-11-27'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: The following analytic detects the creation of the doas.conf file on
a Linux host. This file is used by the doas utility to allow standard users to perform
tasks as root, similar to sudo. The detection leverages Linux Auditd data, focusing
on the creation of the doas.conf file. This activity is significant because it can
indicate an attempt to gain elevated privileges, potentially by an adversary. If
confirmed malicious, this could allow an attacker to execute commands with root
commands with root privileges, leading to full system compromise.
description: |
The following analytic detects the creation of the doas.conf file on a Linux host.
This file is used by the doas utility to allow standard users to perform tasks as root, similar to sudo.
The detection leverages Linux Auditd data, focusing on the creation of the doas.conf file.
This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root commands with root privileges, leading to full system compromise.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name ="/etc/doas.conf*"
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
- Linux Auditd Path
- Linux Auditd Cwd
search: |
`linux_auditd`
(
(type=PATH nametype="CREATE")
OR
type=CWD
)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
| stats
values(type) as types
values(name) as names
values(nametype) as nametype
values(cwd) as cwd_list
values(_time) as event_times
by audit_id host
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/doas.conf.*"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest
| stats count min(e_time) as firstTime max(e_time) as lastTime
values(nametype) as nametype
by current_working_directory
reconstructed_path
match_count
dest
audit_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_doas_conf_file_creation_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
| table nametype current_working_directory reconstructed_path dest audit_id match_count firstTime lastTime
| `linux_auditd_doas_conf_file_creation_filter`
how_to_implement: |
To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command.
and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
Administrator or network operator can execute this command.
Please update the filter macros to remove false positives.
references:
- https://wiki.gentoo.org/wiki/Doas
- https://www.makeuseof.com/how-to-install-and-use-doas/
- https://wiki.gentoo.org/wiki/Doas
- https://www.makeuseof.com/how-to-install-and-use-doas/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A [$type$] event occurred on host - [$dest$] to create a doas.conf file.
message: A $reconstructed_path$ file was created on host - [$dest$]
risk_objects:
- field: dest
type: system
score: 64
- field: dest
type: system
score: 64
threat_objects: []
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
- T1548.003
- T1548.003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_path_doas_config.log
source: auditd
sourcetype: auditd
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/path_doas.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml
+85 -55
View File
@@ -1,81 +1,111 @@
name: Linux Auditd Possible Access Or Modification Of Sshd Config File
id: acb3ea33-70f7-47aa-b335-643b3aebcb2f
version: 7
date: '2025-06-10'
author: Teoderick Contreras, Splunk
version: 8
date: '2025-11-27'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious access or modification of the
sshd_config file on Linux systems. It leverages data from Linux Auditd, focusing
on command-line executions involving processes like "cat," "nano," "vim," and "vi"
accessing the sshd_config file. This activity is significant because unauthorized
changes to sshd_config can allow threat actors to redirect port connections or use
unauthorized keys, potentially compromising the system. If confirmed malicious,
this could lead to unauthorized access, privilege escalation, or persistent backdoor
access, posing a severe security risk.
description: |
The following analytic detects access, deletion or modification of the ssh_config file on Linux systems.
It leverages data from Linux Auditd, focusing on events of type PATH with a nametype of ("NORMAL", "CREATE", "DELETE").
This activity could be significant because unauthorized changes to ssh_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system.
Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*"
- Linux Auditd Path
- Linux Auditd Cwd
search: |
`linux_auditd`
(
(type=PATH nametype IN ("NORMAL", "CREATE", "DELETE"))
OR
type=CWD
)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
| stats
values(type) as types
values(name) as names
values(nametype) as nametype
values(cwd) as cwd_list
values(_time) as event_times
by audit_id, host
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/ssh/ssh_config.*"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
| stats count min(e_time) as firstTime max(e_time) as lastTime
values(nametype) as nametype
by current_working_directory
reconstructed_path
match_count
dest
audit_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`
how_to_implement: |
To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this commandline
for automation purposes. Please update the filter macros to remove false positives.
and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
Administrator or network operator can use this commandline for automation purposes.
Please update the filter macros to remove false positives.
references:
- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
- https://attack.mitre.org/techniques/T1098/004/
- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
- https://attack.mitre.org/techniques/T1098/004/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A [$type$] has been accessed/modified on host - [$dest$] to modify the
sshd_config file.
message: $reconstructed_path$ has been accessed with type $nametype$ on host - [$dest$]
risk_objects:
- field: dest
type: system
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- Linux Living Off The Land
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
- Linux Living Off The Land
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
- T1098.004
- T1098.004
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_path_ssh_config.log
source: auditd
sourcetype: auditd
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/auditd_path_ssh_config/path_ssh_config.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
+81 -54
View File
@@ -1,80 +1,107 @@
name: Linux Auditd Possible Access To Sudoers File
id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834
version: 10
date: '2025-06-10'
author: Teoderick Contreras, Splunk
version: 11
date: '2025-11-27'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic detects potential access or modification of the
/etc/sudoers file on a Linux system. It leverages data from Linux Auditd, focusing
on processes like "cat," "nano," "vim," and "vi" accessing the /etc/sudoers file.
This activity is significant because the sudoers file controls user permissions
for executing commands with elevated privileges. If confirmed malicious, an attacker
could gain persistence or escalate privileges, compromising the security of the
targeted host.
description: |
The following analytic detects potential access or modification of the /etc/sudoers file on a Linux system.
It leverages data from Linux Auditd, focusing on events of type PATH or CWD.
This activity could be significant because the sudoers file controls user permissions for executing commands with elevated privileges.
Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
If confirmed malicious, an attacker could gain persistence or escalate privileges, compromising the security of the targeted host.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name="/etc/sudoers*"
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
- Linux Auditd Path
- Linux Auditd Cwd
search: |
`linux_auditd`
(type=PATH OR type=CWD)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
| stats
values(type) as types
values(name) as names
values(nametype) as nametype
values(cwd) as cwd_list
values(_time) as event_times
by audit_id, host
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/sudoers.*"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest
| stats count min(e_time) as firstTime max(e_time) as lastTime
values(nametype) as nametype
by current_working_directory
reconstructed_path
match_count
dest
audit_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_possible_access_to_sudoers_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
| `linux_auditd_possible_access_to_sudoers_file_filter`
how_to_implement: |
To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: administrator or network operator can execute this command.
and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
Administrator or network operator can execute this command.
Please update the filter macros to remove false positives.
references:
- https://attack.mitre.org/techniques/T1548/003/
- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf
- https://attack.mitre.org/techniques/T1548/003/
- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A [$type$] has been accessed/modified on host - [$dest$] to access or modify
the sudoers file.
message: $reconstructed_path$ has been accessed for potential modification or deletion on host - [$dest$]
risk_objects:
- field: dest
type: system
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- Linux Persistence Techniques
- Compromised Linux Host
- China-Nexus Threat Activity
- Salt Typhoon
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
- China-Nexus Threat Activity
- Salt Typhoon
- Linux Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
- T1548.003
- T1548.003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_path_sudoers.log
source: auditd
sourcetype: auditd
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/auditd_path_sudoers/path_sudoers.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml
+69 -43
View File
@@ -1,62 +1,88 @@
name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File
id: fea71cf0-fa10-4ef6-9202-9682b2e0c477
version: 8
date: '2025-06-10'
version: 9
date: '2025-11-27'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects potential tampering with cronjob files
on a Linux system by identifying 'echo' commands that append code to existing cronjob
files. It leverages logs from Linux Auditd, focusing on process names, parent processes,
and command-line executions. This activity is significant because adversaries often
use it for persistence or privilege escalation. If confirmed malicious, this could
allow attackers to execute unauthorized code automatically, leading to system compromises
and unauthorized data access, thereby impacting business operations and data integrity.
description: |
The following analytic detects potential tampering with cronjob files on a Linux system.
It leverages logs from Linux Auditd, focusing on events of type PATH or CWD.
This activity could be significant because adversaries often use it for persistence or privilege escalation.
Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby impacting business operations and data integrity.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*")
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid dest
- Linux Auditd Path
- Linux Auditd Cwd
search: |
`linux_auditd` (type=PATH OR type=CWD)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
| stats
values(type) as types
values(name) as names
values(nametype) as nametype
values(cwd) as cwd_list
values(_time) as event_times
by audit_id, host
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/cron.*|.*/cron/.*|/etc/anacrontab.*"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest
| stats count min(e_time) as firstTime max(e_time) as lastTime
values(nametype) as nametype
by current_working_directory
reconstructed_path
match_count
dest
audit_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures
command-line executions and process details on Unix/Linux systems. These logs should
be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`
how_to_implement: |
To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: False positives may arise from legitimate actions by administrators
or network operators who may use these commands for automation purposes. Therefore,
it's recommended to adjust filter macros to eliminate such false positives.
and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
False positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes.
Therefore, it's recommended to adjust filter macros to eliminate such false positives.
references:
- https://attack.mitre.org/techniques/T1053/003/
- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
- https://attack.mitre.org/techniques/T1053/003/
- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
tags:
analytic_story:
- XorDDos
- Linux Living Off The Land
- Compromised Linux Host
- Linux Privilege Escalation
- Scheduled Tasks
- Linux Persistence Techniques
- XorDDos
- Linux Living Off The Land
- Compromised Linux Host
- Linux Privilege Escalation
- Scheduled Tasks
- Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
- T1053.003
- T1053.003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_path_cron.log
source: auditd
sourcetype: auditd
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/auditd_path_cron/path_cron.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml
+78 -52
View File
@@ -1,80 +1,106 @@
name: Linux Auditd Preload Hijack Via Preload File
id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f
version: 7
date: '2025-06-10'
version: 8
date: '2025-11-27'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious preload hijacking via the `preload`
file, which may indicate an attacker's attempt to intercept or manipulate library
loading processes. The `preload` file can be used to force the loading of specific
libraries before others, potentially allowing malicious code to execute or alter
application behavior. By monitoring for unusual or unauthorized modifications to
the `preload` file, this analytic helps identify attempts to hijack preload mechanisms,
enabling security teams to investigate and address potential threats to system integrity
and security.
description: |
The following analytic detects suspicious preload hijacking via the `preload` file, which may indicate an attacker's attempt to intercept or manipulate library loading processes.
The `preload` file can be used to force the loading of specific libraries before others, potentially allowing malicious code to execute or alter application behavior.
By monitoring for unusual or unauthorized modifications to the `preload` file, this analytic helps identify attempts to hijack preload mechanisms, enabling security teams to investigate and address potential threats to system integrity and security.
Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*"
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
- Linux Auditd Path
- Linux Auditd Cwd
search: |
`linux_auditd`
(type=PATH OR type=CWD)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
| stats
values(type) as types
values(name) as names
values(nametype) as nametype
values(cwd) as cwd_list
values(_time) as event_times
by audit_id, host
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/ld.so.preload.*"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest
| stats count min(e_time) as firstTime max(e_time) as lastTime
values(nametype) as nametype
by current_working_directory
reconstructed_path
match_count
dest
audit_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_preload_hijack_via_preload_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
| `linux_auditd_preload_hijack_via_preload_file_filter`
how_to_implement: |
To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application
for automation purposes. Please update the filter macros to remove false positives.
and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
Administrator or network operator can use this application for automation purposes.
Please update the filter macros to remove false positives.
references:
- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A [$type$] event has occurred on host - [$dest$] to modify the preload
file.
risk_objects:
- field: dest
type: system
score: 81
- field: dest
type: system
score: 81
threat_objects: []
tags:
analytic_story:
- Linux Living Off The Land
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
- Linux Living Off The Land
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
- T1574.006
- T1574.006
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_preload_file/linux_path_preload.log
source: auditd
sourcetype: auditd
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/auditd_path_preload_file/path_preload.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml
+80 -58
View File
@@ -1,86 +1,108 @@
name: Linux Auditd Unix Shell Configuration Modification
id: 66f737c6-3f7f-46ed-8e9b-cc0e5bf01f04
version: 7
date: '2025-06-10'
version: 8
date: '2025-11-27'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious modifications to Unix shell
configuration files, which may indicate an attempt to alter system behavior or gain
unauthorized access. Unix shell configuration files, such as `.bashrc` or `.profile`,
control user environment settings and command execution. Unauthorized changes to
these files can be used to execute malicious commands, escalate privileges, or hide
malicious activities. By monitoring for unusual or unauthorized modifications to
shell configuration files, this analytic helps identify potential security threats,
allowing security teams to respond quickly and mitigate risks.
description: |
The following analytic detects suspicious access or modifications to Unix shell configuration files, which may indicate an attempt to alter system behavior or gain unauthorized access.
Unix shell configuration files, such as `.bashrc` or `.profile`, control user environment settings and command execution.
Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities.
By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/profile.d",
"/etc/bash.bashrc", "/etc/bashrc", "/etc/zsh/zprofile", "/etc/zsh/zshrc", "/etc/zsh/zlogin",
"/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile",
"root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc",
"/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login",
"/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout")
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
- Linux Auditd Path
- Linux Auditd Cwd
search: |
`linux_auditd`
(type=PATH OR type=CWD)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
| stats
values(type) as types
values(name) as names
values(nametype) as nametype
values(cwd) as cwd_list
values(_time) as event_times
by audit_id, host
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/profile|/etc/shells|/etc/profile\\.d/.*|/etc/bash\\.bashrc.*|/etc/bashrc|.*/zsh/zprofile|.*/zsh/zshrc|.*/zsh/zlogin|.*/zsh/zlogout|/etc/csh\\.cshrc.*|/etc/csh\\.login.*|/root/\\.bashrc.*|/root/\\.bash_profile.*|/root/\\.profile.*|/root/\\.zshrc.*|/root/\\.zprofile.*|/home/.*/\\.bashrc.*|/home/.*/\\.zshrc.*|/home/.*/\\.bash_profile.*|/home/.*/\\.zprofile.*|/home/.*/\\.profile.*|/home/.*/\\.bash_login.*|/home/.*/\\.bash_logout.*|/home/.*/\\.zlogin.*|/home/.*/\\.zlogout.*"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest
| stats count min(e_time) as firstTime max(e_time) as lastTime
values(nametype) as nametype
by current_working_directory
reconstructed_path
match_count
dest
audit_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_unix_shell_configuration_modification_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
| `linux_auditd_unix_shell_configuration_modification_filter`
how_to_implement: |
To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application
for automation purposes. Please update the filter macros to remove false positives.
and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
Administrator or network operator can use this application for automation purposes.
Please update the filter macros to remove false positives.
references:
- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A [$type$] event occurred on host - [$dest$] to modify the unix shell configuration
file.
risk_objects:
- field: dest
type: system
score: 64
- field: dest
type: system
score: 64
threat_objects: []
tags:
analytic_story:
- Linux Living Off The Land
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
- Linux Living Off The Land
- Linux Privilege Escalation
- Linux Persistence Techniques
- Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
- T1546.004
- T1546.004
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config//linux_path_profile_d.log
source: auditd
sourcetype: auditd
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config//linux_path_profile_d.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_magic_sysrq_key_abuse.yml
+39 -10
View File
@@ -1,32 +1,61 @@
name: Linux Magic SysRq Key Abuse
id: 22c03600-f84a-47fa-abaa-ffbe3e72c782
version: 1
date: '2025-08-28'
version: 2
date: '2025-11-27'
author: Milad Cheraghi
status: production
type: TTP
description: |
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries
with root or sufficient privileges to manipulate or destabilize a system.
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system.
Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging.
Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
Correlate with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=Path name="/proc/sysrq-trigger" OR name="/proc/sys/kernel/sysrq" OR name="/etc/sysctl.conf"
- Linux Auditd Cwd
search: |
`linux_auditd`
(type=PATH OR type=CWD)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
| stats
values(type) as types
values(name) as names
values(nametype) as nametype
values(cwd) as cwd_list
values(_time) as event_times
by audit_id, host
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, ".*/proc/sysrq-trigger|.*/proc/sys/kernel/sysrq|.*/etc/sysctl.conf"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime by dest name
| stats count min(e_time) as firstTime max(e_time) as lastTime
values(nametype) as nametype
by current_working_directory
reconstructed_path
match_count
dest
audit_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_magic_sysrq_key_abuse_filter`'
| `linux_magic_sysrq_key_abuse_filter`
how_to_implement: |
To implement this detection, ensure auditd is configured to watch:
- /proc/sysrq-trigger
- /proc/sys/kernel/sysrq
- /etc/sysctl.conf
with write and attribute changes (`-p wa`) and key `sysrq`.
with write and attribute changes (`-p wa`) and key `sysrq`. Make sure the type=CWD record type is activate in your auditd configuration and
Use the Splunk Add-on for Unix and Linux for proper ingestion and CIM normalization.
This enables effective monitoring of Linux endpoints for SysRq abuse.
known_false_positives: Legitimate administrative activity modifying SysRq for debugging or recovery.
known_false_positives: |
Legitimate administrative activity modifying SysRq for debugging or recovery.
Please update the filter macros to remove false positives.
references:
- https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
@@ -73,6 +102,6 @@ tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1529/linux_sysrq_abuse/linux_sysrq_abuse.log
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1529/auditd_path_sysrq/path_sysrq.log
source: auditd
sourcetype: auditd