admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

linux_persist_priv_batch_2

Browse Source
This commit is contained in:
tccontre
2022-01-04 11:47:11 +01:00
parent 472519cac0
commit 74dcbf5bbe
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_service_restarted.yml
+3 -3
View File
@@ -18,10 +18,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
logs with the process name, parent process, and commandline executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Filter is needed.
references:
- https://attack.mitre.org/techniques/T1543/003/
tags:
@@ -29,7 +29,7 @@ tags:
- Linux Privilege Escalation
- Linux Persistence Techniques
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log
kill_chain_phases:
- Privilege Escalation
mitre_attack_id: