From d643ea9701490efc244ca8ba86e5b5aaff68717e Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 13:54:20 +0000 Subject: [PATCH 1/5] Added detection testing service results inDetect LinEnum execution --- .../endpoint/detect_linenum_execution.yml | 30 ++++++++++++------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index acc6d20ce2..88344869e8 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,11 +6,18 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. -search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory - | `detect_linenum_execution_filter` ' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. +description: LinEnum is a bash script that performs discovery commands for accounts, + processes, kernel version, applications, services, and uses the information from + these commands to present operator with ways of escalating privileges or further + exploitation of targeted host. +search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" + | stats count by Computer CommandLine user process_exec process_current_directory + | `detect_linenum_execution_filter` ' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Very rare to perform such an extensive grep on a system, however + certain monitoring tools can produce similar results. It is important if monitoring + tools are in place to verify what is the actual process directory of execution. references: - https://github.com/rebootuser/LinEnum - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist @@ -19,8 +26,8 @@ tags: - Linux Post-Exploitation confidence: 90 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt impact: 50 @@ -37,10 +44,10 @@ tags: - T1016 - T1033 observable: - - name: Computer - type: Endpoint - role: - - Victim + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,3 +60,4 @@ tags: - process_current_directory risk_score: 45 security_domain: endpoint + automated_detection_testing: passed From 9c987e42220b05a92747699521a7b29f9ffdbd99 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:47:41 +0000 Subject: [PATCH 2/5] Added detection testing service results inDetect AutoSUID post exploitation tool From 16302611bee45ab05e38b0e64a82134e3cff25aa Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:48:21 +0000 Subject: [PATCH 3/5] Added detection testing service results inDetect Linux Exploit Suggester Execution --- ...tect_linux_exploit_suggester_execution.yml | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 50389d0d4d..4bec3353fa 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,11 +6,16 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. -search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name - | `detect_linux_exploit_suggester_execution_filter`' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. +description: This search detects Linux Exploit Suggester tool execution. This is a + tool that searches for vulnerabilities based on Kernel and Distribution versions + then queries public exploit databases. +search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR + CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, + process_name | `detect_linux_exploit_suggester_execution_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Monitoring tools may produce similar commands although the + presence of "exploit-db" is very unusual. references: - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist - https://attack.mitre.org/matrices/enterprise/linux/ @@ -19,8 +24,8 @@ tags: - Linux Post-Exploitation confidence: 100 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt impact: 90 @@ -49,3 +54,4 @@ tags: - CommandLine risk_score: 90 security_domain: endpoint + automated_detection_testing: passed From 95be1b79b067e955bd8144cb4bd75595c3ea870f Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:48:40 +0000 Subject: [PATCH 4/5] Added detection testing service results inDetect MimiPenguin --- detections/endpoint/detect_mimipenguin.yml | 28 +++++++++++++--------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index e639c8522a..00544506b3 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -6,11 +6,16 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. -search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user - CommandLine | `detect_mimipenguin_filter`' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. +description: MimiPenguin is a tool that dumps login passwords from current linux destop + users. This search detects execution of this tool. +search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings + -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count + by Computer parent_process process_current_directory user CommandLine | `detect_mimipenguin_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Some of these commands may be executed by sysadmin however + not in the proximity and frequency, specially if querying for tools are that knonwn + not to be installed at target system. references: - https://github.com/huntergregal/mimipenguin - https://attack.mitre.org/matrices/enterprise/linux/ @@ -19,8 +24,8 @@ tags: - Linux Post-Exploitation confidence: 70 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt impact: 50 @@ -30,10 +35,10 @@ tags: mitre_attack_id: - T1552 observable: - - name: Computer - type: Endpoint - role: - - Victim + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,3 +51,4 @@ tags: - process_current_directory risk_score: 35 security_domain: endpoint + automated_detection_testing: passed From 09f07639137323dd13fac5ff51c7404b8d3c358e Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Fri, 14 Jan 2022 07:00:45 -0800 Subject: [PATCH 5/5] Update detect_linenum_execution.test.yml --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 825656a7dd..4f0f44d620 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,7 +1,7 @@ name: Detect LinEnum execution Unit Test tests: - name: Detect LinEnum execution - file: endpoint/detect_linenum_execution.yml + file: endpoint/detect_linenum_execution.test.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now'