Merge branch 'nixpost' of github.com:splunk/security_content into nixpost

detections/endpoint/detect_linenum_execution.yml

@@ -6,11 +6,18 @@ author: Rod Soto
 type: TTP
 datamodel:
 - Endpoint
-description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
-search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory
- | `detect_linenum_execution_filter` '
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution.
+description: LinEnum is a bash script that performs discovery commands for accounts,
+  processes, kernel version, applications, services, and uses the information from
+  these commands to present operator with ways of escalating privileges or further
+  exploitation of targeted host.
+search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
+  | stats count by Computer CommandLine user process_exec process_current_directory
+  | `detect_linenum_execution_filter` '
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
+  Need to install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Very rare to perform such an extensive grep on a system, however
+  certain monitoring tools can produce similar results. It is important if monitoring
+  tools are in place to verify what is the actual process directory of execution.
 references:
 - https://github.com/rebootuser/LinEnum
 - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
@@ -19,8 +26,8 @@ tags:
   - Linux Post-Exploitation
   confidence: 90
   context:
-    - Source: endpoint
-    - Stage: discovery
+  - Source: endpoint
+  - Stage: discovery
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
   impact: 50
@@ -37,10 +44,10 @@ tags:
   - T1016
   - T1033
   observable:
-    - name: Computer
-      type: Endpoint
-      role:
-      - Victim
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -53,3 +60,4 @@ tags:
   - process_current_directory
   risk_score: 45
   security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_linux_exploit_suggester_execution.yml

@@ -6,11 +6,16 @@ author: Rod Soto
 type: TTP
 datamodel:
 - Endpoint
-description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases.
-search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*"  | stats count by CommandLine,user,Computer,action,signature, process_name
- | `detect_linux_exploit_suggester_execution_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual.
+description: This search detects Linux Exploit Suggester tool execution. This is a
+  tool that searches for vulnerabilities based on Kernel and Distribution versions
+  then queries public exploit databases.
+search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR
+  CommandLine="*exploit*" OR CommandLine="*exploit-db*"  | stats count by CommandLine,user,Computer,action,signature,
+  process_name | `detect_linux_exploit_suggester_execution_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
+  Need to install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Monitoring tools may produce similar commands although the
+  presence of "exploit-db" is very unusual.
 references:
 - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
 - https://attack.mitre.org/matrices/enterprise/linux/
@@ -19,8 +24,8 @@ tags:
   - Linux Post-Exploitation
   confidence: 100
   context:
-    - Source: endpoint
-    - Stage: discovery
+  - Source: endpoint
+  - Stage: discovery
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
   impact: 90
@@ -49,3 +54,4 @@ tags:
   - CommandLine
   risk_score: 90
   security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_mimipenguin.yml

@@ -6,11 +6,16 @@ author: Rod Soto
 type: TTP
 datamodel:
 - Endpoint
-description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool.
-search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow"  | stats count by Computer parent_process process_current_directory user
- CommandLine | `detect_mimipenguin_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system.
+description: MimiPenguin is a tool that dumps login passwords from current linux destop
+  users. This search detects execution of this tool.
+search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings
+  -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow"  | stats count
+  by Computer parent_process process_current_directory user CommandLine | `detect_mimipenguin_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
+  Need to install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Some of these commands may be executed by sysadmin however
+  not in the proximity and frequency, specially if querying for tools are that knonwn
+  not to be installed at target system.
 references:
 - https://github.com/huntergregal/mimipenguin
 - https://attack.mitre.org/matrices/enterprise/linux/
@@ -19,8 +24,8 @@ tags:
   - Linux Post-Exploitation
   confidence: 70
   context:
-      - Source: endpoint
-      - Stage: discovery
+  - Source: endpoint
+  - Stage: discovery
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
   impact: 50
@@ -30,10 +35,10 @@ tags:
   mitre_attack_id:
   - T1552
   observable:
-      - name: Computer
-        type: Endpoint
-        role:
-        - Victim
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -46,3 +51,4 @@ tags:
   - process_current_directory
   risk_score: 35
   security_domain: endpoint
+  automated_detection_testing: passed