From c6d3eac54277c34fa97e6fa090c7ca3c938c20b5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 9 Aug 2024 10:46:52 +0200 Subject: [PATCH 01/54] linux_auditd_detection --- .../linux_auditd_add_user_account.yml | 63 ++++++++++++++++ .../linux_auditd_at_application_execution.yml | 73 +++++++++++++++++++ ...linux_auditd_change_file_owner_to_root.yml | 65 +++++++++++++++++ .../linux_auditd_clipboard_data_copy.yml | 66 +++++++++++++++++ .../linux_auditd_data_destruction_command.yml | 65 +++++++++++++++++ macros/linux_auditd.yml | 4 + ...linux_auditd_normalized_execve_process.yml | 4 + ...ux_auditd_normalized_proctitle_process.yml | 6 ++ 8 files changed, 346 insertions(+) create mode 100644 detections/endpoint/linux_auditd_add_user_account.yml create mode 100644 detections/endpoint/linux_auditd_at_application_execution.yml create mode 100644 detections/endpoint/linux_auditd_change_file_owner_to_root.yml create mode 100644 detections/endpoint/linux_auditd_clipboard_data_copy.yml create mode 100644 detections/endpoint/linux_auditd_data_destruction_command.yml create mode 100644 macros/linux_auditd.yml create mode 100644 macros/linux_auditd_normalized_execve_process.yml create mode 100644 macros/linux_auditd_normalized_proctitle_process.yml diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml new file mode 100644 index 0000000000..c300dd0f51 --- /dev/null +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -0,0 +1,63 @@ +name: Linux Auditd Add User Account +id: aae66dc0-74b4-4807-b480-b35f8027abb4 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects the creation of new user accounts on Linux + systems using commands like "useradd" or "adduser." It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on process names and command-line + executions. This activity is significant as adversaries often create new user accounts + to establish persistence on compromised hosts. If confirmed malicious, this could + allow attackers to maintain access, escalate privileges, and further compromise + the system, posing a severe security risk. +data_source: Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, + "%useradd%") OR LIKE (process_exec, "%adduser%") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1136.001 + - T1136 + observable: + - name: process_exec + type: Other + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/linux_auditd_add_user/linux_auditd_add_user.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml new file mode 100644 index 0000000000..a7b2517157 --- /dev/null +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -0,0 +1,73 @@ +name: Linux Auditd At Application Execution +id: 9f306e0a-1c36-469e-8892-968ca12470dd +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of the "At" application + in Linux, which can be used by attackers to create persistence entries on a compromised + host. This detection leverages data from Endpoint Detection and Response (EDR) agents, + focusing on process names and parent process names associated with "at" or "atd". + This activity is significant because the "At" application can be exploited to maintain + unauthorized access or deliver additional malicious payloads. If confirmed malicious, + this behavior could lead to data theft, ransomware attacks, or other severe consequences. + Immediate investigation is required to determine the legitimacy of the execution + and mitigate potential risks. +data_source: Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") + AND NOT (UID IN("daemon")) | stats count min(_time) as firstTime max(_time) as lastTime + by comm exe SYSCALL UID ppid pid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_at_application_execution_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1053/001/ +- https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + - Scheduled Tasks + asset_type: Endpoint + confidence: 30 + impact: 30 + message: $comm$ was executed on host. + mitre_attack_id: + - T1053.002 + - T1053 + observable: + - name: comm + type: Other + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 9 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_at/linux_auditd_at_execution.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml new file mode 100644 index 0000000000..5f232006d4 --- /dev/null +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Change File Owner To Root +id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the use of the 'chown' command to change + a file owner to 'root' on a Linux system. It leverages Endpoint Detection and Response + (EDR) telemetry, specifically monitoring command-line executions and process details. + This activity is significant as it may indicate an attempt to escalate privileges + by adversaries, malware, or red teamers. If confirmed malicious, this action could + allow an attacker to gain root-level access, leading to full control over the compromised + host and potential persistence within the environment. +data_source: Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE (process_exec, + "%chown %") AND LIKE (process_exec, "% root %") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_change_file_owner_to_root_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users +- https://askubuntu.com/questions/617850/changing-from-user-to-superuser +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1222.002 + - T1222 + observable: + - name: process_exec + type: Other + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml new file mode 100644 index 0000000000..826f2f676a --- /dev/null +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -0,0 +1,66 @@ +name: Linux Auditd Clipboard Data Copy +id: 9ddfe470-c4d0-4e60-8668-7337bd699edd +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the use of the Linux 'xclip' command to + copy data from the clipboard. It leverages Endpoint Detection and Response (EDR) + telemetry, focusing on process names and command-line arguments related to clipboard + operations. This activity is significant because adversaries can exploit clipboard + data to capture sensitive information such as passwords or IP addresses. If confirmed + malicious, this technique could lead to unauthorized data exfiltration, compromising + sensitive information and potentially aiding further attacks within the environment. +data_source: Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, + "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") + OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, + "%sel %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc + process_exec | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_clipboard_data_copy_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives may be present on Linux desktop as it may commonly + be used by administrators or end users. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1115/ +- https://linux.die.net/man/1/xclip +tags: + analytic_story: + - Linux Living Off The Land + asset_type: Endpoint + confidence: 40 + impact: 40 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1115 + observable: + - name: process_exec + type: Other + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 16 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/linux_auditd_xclip/linux_auditd_xclip.log + source: /var/log/audit/audit.log + sourcetype: linux:audit + update_timestamp: true diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml new file mode 100644 index 0000000000..ce56095d83 --- /dev/null +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Data Destruction Command +id: 4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the execution of a Unix shell command + designed to wipe root directories on a Linux host. It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on the 'rm' command with force recursive + deletion and the '--no-preserve-root' option. This activity is significant as it + indicates potential data destruction attempts, often associated with malware like + Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, + system instability, and compromised integrity of the affected Linux host. Immediate + investigation and response are crucial to mitigate potential damage. +data_source: Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, + "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") + | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: unknown +references: +- https://cert.gov.ua/article/3718487 +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ +tags: + analytic_story: + - AwfulShred + - Data Destruction + asset_type: Endpoint + confidence: 90 + impact: 100 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1485 + observable: + - name: process_exec + type: Other + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 90 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_no_preserve_root/linux_auditd_no_preserve_root.log + source: /var/log/audit/audit.log + sourcetype: linux:audit + update_timestamp: true diff --git a/macros/linux_auditd.yml b/macros/linux_auditd.yml new file mode 100644 index 0000000000..70ce2b76cd --- /dev/null +++ b/macros/linux_auditd.yml @@ -0,0 +1,4 @@ +definition: sourcetype="linux:audit" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: linux_auditd \ No newline at end of file diff --git a/macros/linux_auditd_normalized_execve_process.yml b/macros/linux_auditd_normalized_execve_process.yml new file mode 100644 index 0000000000..83f885f803 --- /dev/null +++ b/macros/linux_auditd_normalized_execve_process.yml @@ -0,0 +1,4 @@ +definition: 'type=EXECVE | eval relevant_fields=if(type="EXECVE", "", relevant_fields) | foreach a* [eval relevant_fields=if(type="EXECVE", mvappend(relevant_fields, ''<>''), relevant_fields)] | eval process_exec=if(type="EXECVE", mvjoin(relevant_fields, " "), process_exec) | eval process_exec=if(type="EXECVE", trim(process_exec), process_exec)' +description: customer specific splunk configurations to normalized auditd PROCTITLE type to recover process commandline. + Replace the macro definition with configurations for your Splunk Environmnent. +name: linux_auditd_normalized_execve_process \ No newline at end of file diff --git a/macros/linux_auditd_normalized_proctitle_process.yml b/macros/linux_auditd_normalized_proctitle_process.yml new file mode 100644 index 0000000000..999b133614 --- /dev/null +++ b/macros/linux_auditd_normalized_proctitle_process.yml @@ -0,0 +1,6 @@ +definition: 'type=PROCTITLE | eval normalized_proctitle_delimiter = if(type=="PROCTITLE" AND isnotnull(proctitle), if(match(proctitle,"^[0-9A-F]+$"), replace(proctitle, "000", "020"),proctitle),null()) + | eval normalized_proctitle_delimiter = if(type=="PROCTITLE" AND isnotnull(proctitle), if(match(normalized_proctitle_delimiter,"^[0-9A-F]+$"), replace(normalized_proctitle_delimiter, "00", "20"),normalized_proctitle_delimiter),null()) + | eval process_exec = if(match(normalized_proctitle_delimiter,"^[0-9A-F]+$"),urldecode(replace(normalized_proctitle_delimiter,"([0-9A-F]{2})","%\1")),normalized_proctitle_delimiter)' +description: customer specific splunk configurations to normalized auditd PROCTITLE type to recover process commandline. + Replace the macro definition with configurations for your Splunk Environmnent. +name: linux_auditd_normalized_proctitle_process \ No newline at end of file From 7d0046cf33ccb09d011b50498b7ed1a600e3e96d Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 9 Aug 2024 10:55:33 +0200 Subject: [PATCH 02/54] linux_auditd_detection --- detections/endpoint/linux_auditd_add_user_account.yml | 3 ++- detections/endpoint/linux_auditd_at_application_execution.yml | 3 ++- detections/endpoint/linux_auditd_change_file_owner_to_root.yml | 3 ++- detections/endpoint/linux_auditd_clipboard_data_copy.yml | 3 ++- detections/endpoint/linux_auditd_data_destruction_command.yml | 3 ++- 5 files changed, 10 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index c300dd0f51..8dccee17a7 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -12,7 +12,8 @@ description: The following analytic detects the creation of new user accounts on to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk. -data_source: Linux Auditd Proctitle +data_source: +- Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, "%useradd%") OR LIKE (process_exec, "%adduser%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle | `security_content_ctime(firstTime)`| diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index a7b2517157..40abb32f9d 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -14,7 +14,8 @@ description: The following analytic detects the execution of the "At" applicatio this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks. -data_source: Linux Auditd Syscall +data_source: +- Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") AND NOT (UID IN("daemon")) | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 5f232006d4..6d9f425440 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -12,7 +12,8 @@ description: The following analytic detects the use of the 'chown' command to ch by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised host and potential persistence within the environment. -data_source: Linux Auditd Proctitle +data_source: +- Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE (process_exec, "%chown %") AND LIKE (process_exec, "% root %") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 826f2f676a..af5f251e5e 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -12,7 +12,8 @@ description: The following analytic detects the use of the Linux 'xclip' command data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment. -data_source: Linux Auditd Execve +data_source: +- Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index ce56095d83..d7fe06e25e 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -13,7 +13,8 @@ description: The following analytic detects the execution of a Unix shell comman Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage. -data_source: Linux Auditd Execve +data_source: +- Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec From 110f60b92ae5e57c9450ab5c527daae8e1e41a5e Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 9 Aug 2024 11:42:18 +0200 Subject: [PATCH 03/54] linux_auditd_detection --- detections/endpoint/linux_auditd_add_user_account.yml | 2 +- detections/endpoint/linux_auditd_at_application_execution.yml | 2 +- detections/endpoint/linux_auditd_change_file_owner_to_root.yml | 2 +- detections/endpoint/linux_auditd_clipboard_data_copy.yml | 2 +- detections/endpoint/linux_auditd_data_destruction_command.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 8dccee17a7..6ec37f0e13 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -46,7 +46,7 @@ tags: - name: process_exec type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index 40abb32f9d..6ad34f1358 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -51,7 +51,7 @@ tags: - name: comm type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 6d9f425440..48531c8539 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -48,7 +48,7 @@ tags: - name: process_exec type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index af5f251e5e..4d8fda3dcf 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -47,7 +47,7 @@ tags: - name: process_exec type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index d7fe06e25e..d5f8bf1017 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -46,7 +46,7 @@ tags: - name: process_exec type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security From 727701b82ba2fab833e840527902e1ddbd39074a Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 9 Aug 2024 11:57:23 +0200 Subject: [PATCH 04/54] linux_auditd_detection --- detections/endpoint/linux_auditd_add_user_account.yml | 6 ++---- .../endpoint/linux_auditd_at_application_execution.yml | 6 ++---- .../endpoint/linux_auditd_change_file_owner_to_root.yml | 6 ++---- detections/endpoint/linux_auditd_clipboard_data_copy.yml | 6 ++---- .../endpoint/linux_auditd_data_destruction_command.yml | 6 ++---- 5 files changed, 10 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 6ec37f0e13..be955d9984 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -21,11 +21,9 @@ search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must + you must ingest logs that contain the process complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field + the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index 6ad34f1358..495a755af4 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -23,11 +23,9 @@ search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/ how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must + you must ingest logs that contain the process complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field + the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 48531c8539..c1f84eba83 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -21,11 +21,9 @@ search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must + you must ingest logs that contain the process complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field + the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 4d8fda3dcf..60b67b26a6 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -23,11 +23,9 @@ search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(pr how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must + you must ingest logs that contain the process complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field + the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed. diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index d5f8bf1017..b724b6ca98 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -22,11 +22,9 @@ search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (p how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must + you must ingest logs that contain the process complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field + the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: unknown references: From b8c18cca21c9364de1a7cae531458b5db0ee2eeb Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 9 Aug 2024 14:58:35 +0200 Subject: [PATCH 05/54] linux_auditd_detection --- .../linux_auditd_add_user_account.yml | 2 +- ...linux_auditd_change_file_owner_to_root.yml | 2 +- .../linux_auditd_dd_file_overwrite.yml | 62 +++++++++++++++++ .../linux_auditd_doas_conf_file_creation.yml | 64 ++++++++++++++++++ .../linux_auditd_doas_tool_execution.yml | 67 +++++++++++++++++++ 5 files changed, 195 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/linux_auditd_dd_file_overwrite.yml create mode 100644 detections/endpoint/linux_auditd_doas_conf_file_creation.yml create mode 100644 detections/endpoint/linux_auditd_doas_tool_execution.yml diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index be955d9984..1407ca4662 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -4,7 +4,7 @@ version: 1 date: '2024-08-09' author: Teoderick Contreras, Splunk status: production -type: Hunting +type: Anomaly description: The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index c1f84eba83..b5cd53a70f 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -4,7 +4,7 @@ version: 1 date: '2024-08-09' author: Teoderick Contreras, Splunk status: production -type: Anomaly +type: TTP description: The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. It leverages Endpoint Detection and Response (EDR) telemetry, specifically monitoring command-line executions and process details. diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml new file mode 100644 index 0000000000..b699f1c420 --- /dev/null +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -0,0 +1,62 @@ +name: Linux Auditd Dd File Overwrite +id: d1b74420-4cea-4752-a123-9b40dfcca49a +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the use of the 'dd' command to overwrite + files on a Linux system. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process execution logs that include command-line details. + This activity is significant because adversaries often use the 'dd' command to destroy + or irreversibly overwrite files, disrupting system availability and services. If + confirmed malicious, this behavior could lead to data destruction, making recovery + difficult and potentially causing significant operational disruptions. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE(process_exec, + "%dd %") AND LIKE(process_exec, "% of=%") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_dd_file_overwrite_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://gtfobins.github.io/gtfobins/dd/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md +tags: + analytic_story: + - Data Destruction + - Industroyer2 + asset_type: Endpoint + confidence: 90 + impact: 90 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1485 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 81 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_dd_overwrite/linux_auditd_dd_overwrite.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml new file mode 100644 index 0000000000..df628c7592 --- /dev/null +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -0,0 +1,64 @@ +name: Linux Auditd Doas Conf File Creation +id: 61059783-574b-40d2-ac2f-69b898afd6b4 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the creation of the doas.conf file on + a Linux host. This file is used by the doas utility to allow standard users to perform + tasks as root, similar to sudo. The detection leverages filesystem data from the + Endpoint data model, focusing on the creation of the doas.conf file. This activity + is significant because it can indicate an attempt to gain elevated privileges, potentially + by an adversary. If confirmed malicious, this could allow an attacker to execute + commands with root privileges, leading to full system compromise. +data_source: +- Linux Auditd Path +search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | stats count min(_time) + as firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_doas_conf_file_creation_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://wiki.gentoo.org/wiki/Doas +- https://www.makeuseof.com/how-to-install-and-use-doas/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 80 + impact: 80 + message: a $PATH$ has been accessed/modified on host. + mitre_attack_id: + - T1548.003 + - T1548 + observable: + - name: name + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - name + - nametype + - OGID + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_audited_doas_conf.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml new file mode 100644 index 0000000000..c2965cb62a --- /dev/null +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -0,0 +1,67 @@ +name: Linux Auditd Doas Tool Execution +id: 91b8ca78-f205-4826-a3ef-cd8d6b24e97b +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of the 'doas' tool on a + Linux host. This tool allows standard users to perform tasks with root privileges, + similar to 'sudo'. The detection leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process names and command-line executions. This activity + is significant as 'doas' can be exploited by adversaries to gain elevated privileges + on a compromised host. If confirmed malicious, this could lead to unauthorized administrative + access, potentially compromising the entire system. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm=doas | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_doas_tool_execution_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://wiki.gentoo.org/wiki/Doas +- https://www.makeuseof.com/how-to-install-and-use-doas/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 70 + impact: 70 + message: $comm$ was executed on host. + mitre_attack_id: + - T1548.003 + - T1548 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_doas/linux_auditd_doas.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From 0800a90171dd0237662690ae745700aac6992075 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 12 Aug 2024 12:45:05 +0200 Subject: [PATCH 06/54] linux_auditd_detection --- .../linux_auditd_service_restarted.yml | 69 +++++++++++++++++++ .../endpoint/linux_auditd_stop_services.yml | 67 ++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 detections/endpoint/linux_auditd_service_restarted.yml create mode 100644 detections/endpoint/linux_auditd_stop_services.yml diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml new file mode 100644 index 0000000000..afedced865 --- /dev/null +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -0,0 +1,69 @@ +name: Linux Auditd Service Restarted +id: 8eb3e858-18d3-44a4-a514-52cfa39f154a +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the restarting or re-enabling of services + on Linux systems using the `systemctl` or `service` commands. It leverages data + from Endpoint Detection and Response (EDR) agents, focusing on process and command-line + execution logs. This activity is significant as adversaries may use it to maintain + persistence or execute unauthorized actions. If confirmed malicious, this behavior + could lead to repeated execution of malicious payloads, unauthorized access, or + data destruction. Security analysts should investigate these events to mitigate + risks and prevent further compromise. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where (LIKE(process_exec, + "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "%restart%") + OR LIKE(process_exec, "%reenable%") OR LIKE(process_exec, "%reload%")) | stats count + min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - AwfulShred + - Linux Privilege Escalation + - Linux Living Off The Land + - Data Destruction + - Linux Persistence Techniques + - Scheduled Tasks + - Gomir + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1053.006 + - T1053 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/linux_services_restart/linux_services_restart.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml new file mode 100644 index 0000000000..0f5c062b65 --- /dev/null +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -0,0 +1,67 @@ +name: Linux Auditd Stop Services +id: 43bc9281-753b-4743-b4b7-60af84f085f3 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects attempts to stop or clear a service on + Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, + focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. + This activity is significant as adversaries often terminate security or critical + services to disable defenses or disrupt operations, as seen in malware like Industroyer2. + If confirmed malicious, this could lead to the disabling of security mechanisms, + allowing attackers to persist, escalate privileges, or deploy destructive payloads, + severely impacting system integrity and availability. +data_source: +- Linux Auditd Service Stop +search: '`linux_auditd` type=SERVICE_STOP | stats count min(_time) as firstTime max(_time) + as lastTime by type pid UID comm exe | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_stop_services_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +- https://cert.gov.ua/article/39518 +tags: + analytic_story: + - AwfulShred + - Data Destruction + - Industroyer2 + asset_type: Endpoint + confidence: 70 + impact: 70 + message: a service stop event occured on host. + mitre_attack_id: + - T1489 + observable: + - name: type + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - type + - pid + - UID + - comm + - exe + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From 47ef91e12832333eae2ed362f66d52daa3553bd7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 12 Aug 2024 16:26:04 +0200 Subject: [PATCH 07/54] linux_auditd_detection --- ...linux_auditd_edit_cron_table_parameter.yml | 69 +++++++++++++++++++ ...cronjob_entry_on_existing_cronjob_file.yml | 69 +++++++++++++++++++ .../linux_auditd_sudo_or_su_execution.yml | 63 +++++++++++++++++ 3 files changed, 201 insertions(+) create mode 100644 detections/endpoint/linux_auditd_edit_cron_table_parameter.yml create mode 100644 detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml create mode 100644 detections/endpoint/linux_auditd_sudo_or_su_execution.yml diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml new file mode 100644 index 0000000000..ef9b3c3f2b --- /dev/null +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -0,0 +1,69 @@ +name: Linux Auditd Edit Cron Table Parameter +id: f4bb7321-7e64-4d1e-b1aa-21f8b019a91f +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the suspicious editing of cron jobs in + Linux using the crontab command-line parameter (-e). It identifies this activity + by monitoring command-line executions involving 'crontab' and the edit parameter. + This behavior is significant for a SOC as cron job manipulations can indicate unauthorized + persistence attempts or scheduled malicious actions. If confirmed malicious, this + activity could lead to system compromise, unauthorized access, or broader network + compromise. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN ("*/crontab")) + success=yes AND NOT (UID IN("daemon")) | stats count min(_time) as firstTime max(_time) + as lastTime by comm exe SYSCALL UID ppid pid | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_edit_cron_table_parameter_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1053/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + - Scheduled Tasks + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $comm$ was executed on host. + mitre_attack_id: + - T1053.003 + - T1053 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_crontab_edit/linux_auditd_crontab_edit.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml new file mode 100644 index 0000000000..fb692dc1ca --- /dev/null +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -0,0 +1,69 @@ +name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File +id: fea71cf0-fa10-4ef6-9202-9682b2e0c477 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects potential tampering with cronjob files + on a Linux system by identifying 'echo' commands that append code to existing cronjob + files. It leverages logs from Endpoint Detection and Response (EDR) agents, focusing + on process names, parent processes, and command-line executions. This activity is + significant because adversaries often use it for persistence or privilege escalation. + If confirmed malicious, this could allow attackers to execute unauthorized code + automatically, leading to system compromises and unauthorized data access, thereby + impacting business operations and data integrity. +data_source: +- Linux Auditd Path +search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") + | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID | + `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: False positives may arise from legitimate actions by administrators + or network operators who may use these commands for automation purposes. Therefore, + it's recommended to adjust filter macros to eliminate such false positives. +references: +- https://attack.mitre.org/techniques/T1053/003/ +- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + - Scheduled Tasks + asset_type: Endpoint + confidence: 70 + impact: 70 + message: a $PATH$ has been accessed/modified on host. + mitre_attack_id: + - T1053.003 + - T1053 + observable: + - name: name + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - name + - nametype + - OGID + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_auditd_cron_file_audited2.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml new file mode 100644 index 0000000000..c926954b12 --- /dev/null +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -0,0 +1,63 @@ +name: Linux Auditd Sudo Or Su Execution +id: 817a5c89-5b92-4818-a22d-aa35e1361afe +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of the "sudo" or "su" command + on a Linux operating system. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process names and parent process names. This activity + is significant because "sudo" and "su" commands are commonly used by adversaries + to elevate privileges, potentially leading to unauthorized access or control over + the system. If confirmed malicious, this activity could allow attackers to execute + commands with root privileges, leading to severe security breaches, data exfiltration, + or further system compromise. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE(process_exec, + "%sudo %") OR LIKE(process_exec, "%su %") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sudo_or_su_execution_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1548/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1548.003 + - T1548 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudo_su/linux_auditd_sudo_su.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From e0a111fb878fb15f89a65b0a430c178d4344386b Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 14 Aug 2024 10:54:53 +0200 Subject: [PATCH 08/54] linux_auditd_detection --- ...linux_auditd_hardware_addition_swapoff.yml | 64 +++++++++++++++++ ...ert_kernel_module_using_insmod_utility.yml | 70 +++++++++++++++++++ ...l_kernel_module_using_modprobe_utility.yml | 70 +++++++++++++++++++ ...linux_auditd_kernel_module_enumeration.yml | 66 +++++++++++++++++ ..._auditd_nopasswd_entry_in_sudoers_file.yml | 64 +++++++++++++++++ ...inux_auditd_setuid_using_chmod_utility.yml | 65 +++++++++++++++++ .../linux_auditd_shred_overwrite_command.yml | 67 ++++++++++++++++++ 7 files changed, 466 insertions(+) create mode 100644 detections/endpoint/linux_auditd_hardware_addition_swapoff.yml create mode 100644 detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml create mode 100644 detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml create mode 100644 detections/endpoint/linux_auditd_kernel_module_enumeration.yml create mode 100644 detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml create mode 100644 detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml create mode 100644 detections/endpoint/linux_auditd_shred_overwrite_command.yml diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml new file mode 100644 index 0000000000..726d2113f8 --- /dev/null +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -0,0 +1,64 @@ +name: Linux Auditd Hardware Addition Swapoff +id: 5728bb16-1a0b-4b66-bce2-0074ac839770 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of the "swapoff" command, + which disables the swapping of paging devices on a Linux system. It leverages data + from Endpoint Detection and Response (EDR) agents, focusing on process execution + logs. This activity is significant because disabling swap can be a tactic used by + malware, such as Awfulshred, to evade detection and hinder forensic analysis. If + confirmed malicious, this action could allow an attacker to manipulate system memory + management, potentially leading to data corruption, system instability, or evasion + of memory-based detection mechanisms. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process`| where LIKE(process_exec, + "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: administrator may disable swapping of devices in a linux host. + Filter is needed. +references: +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ +tags: + analytic_story: + - AwfulShred + - Data Destruction + asset_type: Endpoint + confidence: 60 + impact: 60 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1200 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 36 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/linux_auditd_swapoff/linux_auditd_swapoff.log + source: /var/log/audit/audit.log + sourcetype: linux:audit + update_timestamp: true diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml new file mode 100644 index 0000000000..2da923652d --- /dev/null +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -0,0 +1,70 @@ +name: Linux Auditd Insert Kernel Module Using Insmod Utility +id: bc0ca53f-dea6-4906-9b12-09c396fdf1d3 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the insertion of a Linux kernel module + using the insmod utility. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process execution logs that include process names and + command-line details. This activity is significant as it may indicate the installation + of a rootkit or malicious kernel module, potentially allowing an attacker to gain + elevated privileges and bypass security detections. If confirmed malicious, this + could lead to unauthorized code execution, persistent access, and severe compromise + of the affected system. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm=insmod | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_insert_kernel_module_using_insmod_utility_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ +- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup +- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Rootkit + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $comm$ was executed on host. + mitre_attack_id: + - T1547.006 + - T1547 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_insmod/linux_auditd_insmod.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml new file mode 100644 index 0000000000..e5dfeb8817 --- /dev/null +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -0,0 +1,70 @@ +name: Linux Auditd Install Kernel Module Using Modprobe Utility +id: 95165985-ace5-4d42-9c42-93a89a5af901 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the installation of a Linux kernel module + using the modprobe utility. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process names and command-line executions. This activity + is significant because installing a kernel module can indicate an attempt to deploy + a rootkit or other malicious kernel-level code, potentially leading to elevated + privileges and bypassing security detections. If confirmed malicious, this could + allow an attacker to gain persistent, high-level access to the system, compromising + its integrity and security. +data_source: +- Linux Auditd Syscall +search: linux_auditd` type=SYSCALL comm=modprobe | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_install_kernel_module_using_modprobe_utility_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ +- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup +- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Rootkit + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $comm$ was executed on host. + mitre_attack_id: + - T1547.006 + - T1547 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml new file mode 100644 index 0000000000..0844627f27 --- /dev/null +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -0,0 +1,66 @@ +name: Linux Auditd Kernel Module Enumeration +id: d1b088de-c47a-4572-9339-bdcc26493b32 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies the use of the 'kmod' process to list + kernel modules on a Linux system. This detection leverages data from Endpoint Detection + and Response (EDR) agents, focusing on process names and command-line executions. + While listing kernel modules is not inherently malicious, it can be a precursor + to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity + could allow an attacker to load kernel modules, potentially leading to privilege + escalation, persistence, or other malicious actions within the system. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm=lsmod | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `linux_auditd_kernel_module_enumeration_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: False positives are present based on automated tooling or system + administrative usage. Filter as needed. +references: +- https://man7.org/linux/man-pages/man8/kmod.8.html +tags: + analytic_story: + - Linux Rootkit + asset_type: Endpoint + confidence: 50 + impact: 30 + message: $comm$ was executed on host. + mitre_attack_id: + - T1082 + - T1014 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 15 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/linux_auditd_lsmod/linux_auditd_lsmod.log + source: /var/log/audit/audit.log + sourcetype: linux:audit + update_timestamp: true diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml new file mode 100644 index 0000000000..28a4d1b157 --- /dev/null +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -0,0 +1,64 @@ +name: Linux Auditd Nopasswd Entry In Sudoers File +id: 651df959-ad17-4b73-a323-90cb96d5fa1b +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the addition of NOPASSWD entries to the + /etc/sudoers file on Linux systems. It leverages Endpoint Detection and Response + (EDR) telemetry to identify command lines containing "NOPASSWD:". This activity + is significant because it allows users to execute commands with elevated privileges + without requiring a password, which can be exploited by adversaries to maintain + persistent, privileged access. If confirmed malicious, this could lead to unauthorized + privilege escalation, persistent access, and potential compromise of sensitive data + and system integrity. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, + "%NOPASSWD%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec + proctitle normalized_proctitle_delimiter | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands +- https://help.ubuntu.com/community/Sudoers +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1548.003 + - T1548 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml new file mode 100644 index 0000000000..f89c95db1a --- /dev/null +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Setuid Using Chmod Utility +id: 8230c407-1b47-4d95-ac2e-718bd6381386 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of the chmod utility to + set the SUID or SGID bit on files, which can allow users to temporarily gain root + or group-level access. This detection leverages data from Endpoint Detection and + Response (EDR) agents, focusing on process names and command-line arguments related + to chmod. This activity is significant as it can indicate an attempt to escalate + privileges or maintain persistence on a system. If confirmed malicious, an attacker + could gain elevated access, potentially compromising sensitive data or critical + system functions. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, + "%chmod %") AND (LIKE (process_exec, "% u+s %") OR LIKE (process_exec, "% g+s %") + OR LIKE (process_exec, "% 4777 %") OR LIKE (process_exec, "% 4577 %")) | stats count + min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_chmod_utility_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 90 + impact: 90 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1548.001 + - T1548 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 81 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setuid.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml new file mode 100644 index 0000000000..7396707986 --- /dev/null +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -0,0 +1,67 @@ +name: Linux Auditd Shred Overwrite Command +id: ce2bde4d-a1d4-4452-8c87-98440e5adfb3 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the execution of the 'shred' command on + a Linux machine, which is used to overwrite files to make them unrecoverable. It + leverages data from Endpoint Detection and Response (EDR) agents, focusing on process + names and command-line arguments. This activity is significant because the 'shred' + command can be used in destructive attacks, such as those seen in the Industroyer2 + malware targeting energy facilities. If confirmed malicious, this activity could + lead to the permanent destruction of critical files, severely impacting system integrity + and data availability. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, + "%shred%") AND (LIKE (process_exec, "%-n%") OR LIKE (process_exec, "%-z%") OR LIKE + (process_exec, "%-u%") OR LIKE (process_exec, "%-s%")) | stats count min(_time) + as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_shred_overwrite_command_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +- https://cert.gov.ua/article/39518 +tags: + analytic_story: + - Industroyer2 + - AwfulShred + - Linux Privilege Escalation + - Data Destruction + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 90 + impact: 90 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1485 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 81 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_shred/linux_auditd_shred.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From 6d9be3fc6a6de71be3ebb11706877ed1a3bf9775 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 16 Aug 2024 09:39:04 +0200 Subject: [PATCH 09/54] linux_auditd_detection --- .../endpoint/linux_auditd_hardware_addition_swapoff.yml | 2 +- ...ux_auditd_install_kernel_module_using_modprobe_utility.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index 726d2113f8..57374c7ae1 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -15,7 +15,7 @@ description: The following analytic detects the execution of the "swapoff" comma of memory-based detection mechanisms. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process`| where LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index e5dfeb8817..6d71355646 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -15,9 +15,9 @@ description: The following analytic detects the installation of a Linux kernel m its integrity and security. data_source: - Linux Auditd Syscall -search: linux_auditd` type=SYSCALL comm=modprobe | stats count min(_time) as firstTime +search: '`linux_auditd` type=SYSCALL comm=modprobe | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_install_kernel_module_using_modprobe_utility_filter` + `security_content_ctime(lastTime)`| `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, From b0a092a281adbe56e1414c274d4a40ffce5fbdd0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 19 Aug 2024 11:19:59 +0200 Subject: [PATCH 10/54] linux_auditd_detection --- ...ss_or_modification_of_sshd_config_file.yml | 66 +++++++++++++++++++ ...td_possible_access_to_credential_files.yml | 65 ++++++++++++++++++ ...auditd_possible_access_to_sudoers_file.yml | 64 ++++++++++++++++++ ...ux_auditd_preload_hijack_library_calls.yml | 64 ++++++++++++++++++ ...nux_auditd_setuid_using_setcap_utility.yml | 66 +++++++++++++++++++ 5 files changed, 325 insertions(+) create mode 100644 detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml create mode 100644 detections/endpoint/linux_auditd_possible_access_to_credential_files.yml create mode 100644 detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml create mode 100644 detections/endpoint/linux_auditd_preload_hijack_library_calls.yml create mode 100644 detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml new file mode 100644 index 0000000000..98ae86a1ac --- /dev/null +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -0,0 +1,66 @@ +name: Linux Auditd Possible Access Or Modification Of Sshd Config File +id: acb3ea33-70f7-47aa-b335-643b3aebcb2f +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious access or modification of the + sshd_config file on Linux systems. It leverages data from Endpoint Detection and + Response (EDR) agents, focusing on command-line executions involving processes like + "cat," "nano," "vim," and "vi" accessing the sshd_config file. This activity is + significant because unauthorized changes to sshd_config can allow threat actors + to redirect port connections or use unauthorized keys, potentially compromising + the system. If confirmed malicious, this could lead to unauthorized access, privilege + escalation, or persistent backdoor access, posing a severe security risk. +data_source: +- Linux Auditd Path +search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | stats count min(_time) + as firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.hackingarticles.in/ssh-penetration-testing-port-22/ +- https://attack.mitre.org/techniques/T1098/004/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a $PATH$ has been accessed/modified on host. + mitre_attack_id: + - T1098.004 + - T1098 + observable: + - name: name + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - name + - nametype + - OGID + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_auditd_ssh_config.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml new file mode 100644 index 0000000000..6b3a821948 --- /dev/null +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Possible Access To Credential Files +id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects attempts to access or dump the contents + of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on processes like 'cat', 'nano', 'vim', + and 'vi' accessing these files. This activity is significant as it may indicate + credential dumping, a technique used by adversaries to gain persistence or escalate + privileges. If confirmed malicious, attackers could obtain hashed passwords for + offline cracking, leading to unauthorized access and potential system compromise. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where (LIKE + (process_exec, "%shadow%") OR LIKE (process_exec, "%passwd%")) AND (LIKE (process_exec, + "%cat %") OR LIKE (process_exec, "%nano %")OR LIKE (process_exec, "%vim %") OR LIKE + (process_exec, "%vi %")) | stats count min(_time) as firstTime max(_time) as lastTime + by process_exec proctitle normalized_proctitle_delimiter | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_credential_files_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd +- https://attack.mitre.org/techniques/T1003/008/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1003.008 + - T1003 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml new file mode 100644 index 0000000000..a3c26304cb --- /dev/null +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -0,0 +1,64 @@ +name: Linux Auditd Possible Access To Sudoers File +id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects potential access or modification of the + /etc/sudoers file on a Linux system. It leverages data from Endpoint Detection and + Response (EDR) agents, focusing on processes like "cat," "nano," "vim," and "vi" + accessing the /etc/sudoers file. This activity is significant because the sudoers + file controls user permissions for executing commands with elevated privileges. + If confirmed malicious, an attacker could gain persistence or escalate privileges, + compromising the security of the targeted host. +data_source: +- Linux Auditd Path +search: '`linux_auditd` type=PATH name="/etc/sudoers*" | stats count min(_time) as + firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_sudoers_file_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://attack.mitre.org/techniques/T1548/003/ +- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a $PATH$ has been accessed/modified on host. + mitre_attack_id: + - T1548.003 + - T1548 + observable: + - name: name + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - name + - nametype + - OGID + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml new file mode 100644 index 0000000000..8ce1a22a29 --- /dev/null +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -0,0 +1,64 @@ +name: Linux Auditd Preload Hijack Library Calls +id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the use of the LD_PRELOAD environment + variable to hijack or hook library functions on a Linux platform. It leverages data + from Endpoint Detection and Response (EDR) agents, focusing on process execution + logs that include command-line details. This activity is significant because adversaries, + malware authors, and red teamers commonly use this technique to gain elevated privileges + and establish persistence on a compromised machine. If confirmed malicious, this + behavior could allow attackers to execute arbitrary code, escalate privileges, and + maintain long-term access to the system. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, + "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc + process_exec | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_preload_hijack_library_calls_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5 +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 90 + impact: 90 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1574.006 + - T1574 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 81 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml new file mode 100644 index 0000000000..df0df0811c --- /dev/null +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -0,0 +1,66 @@ +name: Linux Auditd Setuid Using Setcap Utility +id: 1474459a-302b-4255-8add-d82f96d14cd9 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the execution of the 'setcap' utility + to enable the SUID bit on Linux systems. It leverages Endpoint Detection and Response + (EDR) data, focusing on process names and command-line arguments that indicate the + use of 'setcap' with specific capabilities. This activity is significant because + setting the SUID bit allows a user to temporarily gain root access, posing a substantial + security risk. If confirmed malicious, an attacker could escalate privileges, execute + arbitrary commands with elevated permissions, and potentially compromise the entire + system. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, + "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep %") OR LIKE (process_exec, + "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p %") OR LIKE + (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep + %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_setcap_utility_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + asset_type: Endpoint + confidence: 90 + impact: 90 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1548.001 + - T1548 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 81 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setcap_priv.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From 6a3e5f7b8fa87fb23e1e13beef72a26509f64025 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 20 Aug 2024 10:34:27 +0200 Subject: [PATCH 11/54] linux_auditd_detection --- .../linux_auditd_add_user_account_type.yml | 67 ++++++++++++++++++ .../linux_auditd_auditd_service_stop.yml | 65 ++++++++++++++++++ .../endpoint/linux_auditd_service_started.yml | 64 +++++++++++++++++ .../linux_auditd_sysmon_service_stop.yml | 65 ++++++++++++++++++ .../linux_auditd_whoami_user_discovery.yml | 68 +++++++++++++++++++ 5 files changed, 329 insertions(+) create mode 100644 detections/endpoint/linux_auditd_add_user_account_type.yml create mode 100644 detections/endpoint/linux_auditd_auditd_service_stop.yml create mode 100644 detections/endpoint/linux_auditd_service_started.yml create mode 100644 detections/endpoint/linux_auditd_sysmon_service_stop.yml create mode 100644 detections/endpoint/linux_auditd_whoami_user_discovery.yml diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml new file mode 100644 index 0000000000..185f0123bc --- /dev/null +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -0,0 +1,67 @@ +name: Linux Auditd Add User Account Type +id: f8c325ea-506e-4105-8ccf-da1492e90115 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the suspicious add user account type. + This behavior is critical for a SOC to monitor because it may indicate attempts + to gain unauthorized access or maintain control over a system. Such actions could + be signs of malicious activity. If confirmed, this could lead to serious consequences, + including a compromised system, unauthorized access to sensitive data, or even a + wider breach affecting the entire network. Detecting and responding to these signs + early is essential to prevent potential security incidents. +data_source: +- Linux Auditd Add User +search: ' `linux_auditd` type=ADD_USER | stats count min(_time) as firstTime max(_time) + as lastTime by exe pid hostname res UID type | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_type_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a $type$ added on host. + mitre_attack_id: + - T1136 + - T1136.001 + observable: + - name: hostname + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - exe + - pid + - hostname + - res + - UID + - type + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/linux_auditd_add_user_type/linux_auditd_add_user_type.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml new file mode 100644 index 0000000000..ba863c9d6f --- /dev/null +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Auditd Service Stop +id: 6cb9d0e1-eabe-41de-a11a-5efade354e9d +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the suspicious auditd service stop. This + behavior is critical for a SOC to monitor because it may indicate attempts to gain + unauthorized access or maintain control over a system. Such actions could be signs + of malicious activity. If confirmed, this could lead to serious consequences, including + a compromised system, unauthorized access to sensitive data, or even a wider breach + affecting the entire network. Detecting and responding to these signs early is essential + to prevent potential security incidents. +data_source: +- Linux Auditd Service Stop +search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | stats count min(_time) + as firstTime max(_time) as lastTime by type pid UID comm exe unit | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_auditd_service_stop_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a $type$ event occured on host. + mitre_attack_id: + - T1489 + observable: + - name: type + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - type + - pid + - UID + - comm + - exe + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_auditd_service_stop/linux_auditd_auditd_service_stop.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml new file mode 100644 index 0000000000..43e4966d58 --- /dev/null +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -0,0 +1,64 @@ +name: Linux Auditd Service Started +id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the suspicious service started. This behavior + is critical for a SOC to monitor because it may indicate attempts to gain unauthorized + access or maintain control over a system. Such actions could be signs of malicious + activity. If confirmed, this could lead to serious consequences, including a compromised + system, unauthorized access to sensitive data, or even a wider breach affecting + the entire network. Detecting and responding to these signs early is essential to + prevent potential security incidents. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where (LIKE(process_exec, + "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "% + start %") OR LIKE(process_exec, "% enable %")) | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_service_started_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1569.002 + - T1569 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/linux_service_start/linux_service_start.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml new file mode 100644 index 0000000000..af315cd7fe --- /dev/null +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Sysmon Service Stop +id: 20901256-633a-40de-8753-7b88811a460f +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the suspicious sysmon service stop. This + behavior is critical for a SOC to monitor because it may indicate attempts to gain + unauthorized access or maintain control over a system. Such actions could be signs + of malicious activity. If confirmed, this could lead to serious consequences, including + a compromised system, unauthorized access to sensitive data, or even a wider breach + affecting the entire network. Detecting and responding to these signs early is essential + to prevent potential security incidents. +data_source: +- Linux Auditd Service Stop +search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | stats count min(_time) + as firstTime max(_time) as lastTime by type pid UID comm exe unit | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_sysmon_service_stop_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: a sysmon $type$ event occured on host. + mitre_attack_id: + - T1489 + observable: + - name: type + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - type + - pid + - UID + - comm + - exe + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_sysmon_service_stop.log/linux_auditd_sysmon_service_stop.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml new file mode 100644 index 0000000000..b5211cb451 --- /dev/null +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -0,0 +1,68 @@ +name: Linux Auditd Whoami User Discovery +id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the suspicious whoami user discovery. + This behavior is critical for a SOC to monitor because it may indicate attempts + to gain unauthorized access or maintain control over a system. Such actions could + be signs of malicious activity. If confirmed, this could lead to serious consequences, + including a compromised system, unauthorized access to sensitive data, or even a + wider breach affecting the entire network. Detecting and responding to these signs + early is essential to prevent potential security incidents. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_whoami_user_discovery_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $comm$ was executed on host. + mitre_attack_id: + - T1033 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/linux_auditd_whoami/linux_auditd_whoami.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From 1440ec4189371f400f06c418502810f977e34a35 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 20 Aug 2024 11:07:36 +0200 Subject: [PATCH 12/54] linux_auditd_detection --- .../linux_auditd_whoami_user_discovery.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index b5211cb451..3225bd9db1 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -5,13 +5,13 @@ date: '2024-08-19' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the suspicious whoami user discovery. - This behavior is critical for a SOC to monitor because it may indicate attempts - to gain unauthorized access or maintain control over a system. Such actions could - be signs of malicious activity. If confirmed, this could lead to serious consequences, - including a compromised system, unauthorized access to sensitive data, or even a - wider breach affecting the entire network. Detecting and responding to these signs - early is essential to prevent potential security incidents. +description: The following analytic detects the suspicious use of the whoami command, + which may indicate an attacker trying to gather information about the current user + account on a compromised system. The whoami command is commonly used to verify user + privileges and identity, especially during initial stages of an attack to assess the + level of access. By monitoring for unusual or unauthorized executions of whoami, + this analytic helps in identifying potential reconnaissance activities, enabling security + teams to take action before the attacker escalates privileges or conducts further malicious operations. data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | stats count From e978f7ddfa27a1e557856db50487e3448827deb1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 21 Aug 2024 09:50:56 +0200 Subject: [PATCH 13/54] linux_auditd_detection --- ...td_data_transfer_size_limits_via_split.yml | 63 +++++++++++++++++ ...transfer_size_limits_via_split_syscall.yml | 66 ++++++++++++++++++ ...ditd_kernel_module_using_rmmod_utility.yml | 67 +++++++++++++++++++ .../linux_auditd_osquery_service_stop.yml | 65 ++++++++++++++++++ ...auditd_preload_hijack_via_preload_file.yml | 64 ++++++++++++++++++ 5 files changed, 325 insertions(+) create mode 100644 detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml create mode 100644 detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml create mode 100644 detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml create mode 100644 detections/endpoint/linux_auditd_osquery_service_stop.yml create mode 100644 detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml new file mode 100644 index 0000000000..13b1b5027e --- /dev/null +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -0,0 +1,63 @@ +name: Linux Auditd Data Transfer Size Limits Via Split +id: 4669561d-3bbd-44e3-857c-0e3c6ef2120c +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious data transfer activities + that involve the use of the `split` syscall, potentially indicating an attempt to + evade detection by breaking large files into smaller parts. Attackers may use this + technique to bypass size-based security controls, facilitating the covert exfiltration + of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, + this analytic helps identify potential data exfiltration attempts, allowing security teams + to intervene and prevent the unauthorized transfer of critical information from the network. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, + "%split %") AND LIKE(process_exec, "% -b %") | stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 70 + impact: 70 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1030 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_b_exec/linux_auditd_split_b_exec.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml new file mode 100644 index 0000000000..35a5d24daa --- /dev/null +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -0,0 +1,66 @@ +name: Linux Auditd Data Transfer Size Limits Via Split Syscall +id: c03d4a49-cf9d-435b-86e9-c6f8c9b6c42e +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious data transfer activities + that involve the use of the `split` syscall, potentially indicating an attempt to + evade detection by breaking large files into smaller parts. Attackers may use this + technique to bypass size-based security controls, facilitating the covert exfiltration + of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, + this analytic helps identify potential data exfiltration attempts, allowing security teams + to intervene and prevent the unauthorized transfer of critical information from the network. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | stats count min(_time) + as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $comm$ was executed on host. + mitre_attack_id: + - T1030 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_syscall/linux_auditd_split_syscall.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml new file mode 100644 index 0000000000..671cf1f5ac --- /dev/null +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -0,0 +1,67 @@ +name: Linux Auditd Kernel Module Using Rmmod Utility +id: 31810b7a-0abe-42be-a210-0dec8106afee +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious use of the `rmmod` utility + for kernel module removal, which may indicate an attacker’s attempt to unload critical + or security-related kernel modules. The `rmmod` command is used to remove modules from + the Linux kernel, and unauthorized use can be a tactic to disable security features, + conceal malicious activities, or disrupt system operations. By monitoring for unusual + or unauthorized `rmmod` activity, this analytic helps identify potential tampering with + kernel modules, enabling security teams to take proactive measures to protect system integrity and security. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm=rmmod | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_kernel_module_using_rmmod_utility_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 90 + message: $comm$ was executed on host. + mitre_attack_id: + - T1547.006 + - T1547 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 72 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_rmmod/linux_auditd_rmmod.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml new file mode 100644 index 0000000000..8150211f2f --- /dev/null +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Osquery Service Stop +id: 0c320fea-6e87-4b99-a884-74d09d4b655d +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious stopping of the `osquery` service, + which may indicate an attempt to disable monitoring and evade detection. `Osquery` + is a powerful tool used for querying system information and detecting anomalies, and + stopping its service can be a sign that an attacker is trying to disrupt security + monitoring or hide malicious activities. By monitoring for unusual or unauthorized stops + of the `osquery` service, this analytic helps identify potential efforts to bypass security + controls, enabling security teams to investigate and respond to possible threats effectively. +data_source: +- Linux Auditd Service Stop +search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | stats count min(_time) + as firstTime max(_time) as lastTime by type pid UID comm exe unit | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_osquery_service_stop_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: an auditd $type$ event occured on host. + mitre_attack_id: + - T1489 + observable: + - name: type + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - type + - pid + - UID + - comm + - exe + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_osquerd_service_stop/linux_auditd_osquerd_service_stop.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml new file mode 100644 index 0000000000..37c17c1fba --- /dev/null +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -0,0 +1,64 @@ +name: Linux Auditd Preload Hijack Via Preload File +id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious preload hijacking via the `preload` file, + which may indicate an attacker’s attempt to intercept or manipulate library loading processes. + The `preload` file can be used to force the loading of specific libraries before others, + potentially allowing malicious code to execute or alter application behavior. By monitoring + for unusual or unauthorized modifications to the `preload` file, this analytic helps identify + attempts to hijack preload mechanisms, enabling security teams to investigate and address + potential threats to system integrity and security. +data_source: +- Linux Auditd Path +search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | stats count min(_time) + as firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_via_preload_file_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 90 + impact: 90 + message: a $PATH$ has been accessed/modified on host. + mitre_attack_id: + - T1574.006 + - T1574 + observable: + - name: name + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - name + - nametype + - OGID + risk_score: 81 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_preload_file/linux_auditd_preload_file.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From e7bf43d5f8f1e36f13acee3bd60441eedcadb9cf Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 22 Aug 2024 12:05:10 +0200 Subject: [PATCH 14/54] linux_auditd_detection --- ...ux_auditd_file_and_directory_discovery.yml | 74 +++++++++++++++++++ ...file_permission_modification_via_chmod.yml | 64 ++++++++++++++++ ...le_permissions_modification_via_chattr.yml | 63 ++++++++++++++++ ..._unix_shell_configuration_modification.yml | 69 +++++++++++++++++ ...inux_auditd_unload_module_via_modprobe.yml | 63 ++++++++++++++++ 5 files changed, 333 insertions(+) create mode 100644 detections/endpoint/linux_auditd_file_and_directory_discovery.yml create mode 100644 detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml create mode 100644 detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml create mode 100644 detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml create mode 100644 detections/endpoint/linux_auditd_unload_module_via_modprobe.yml diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml new file mode 100644 index 0000000000..80c7de17fd --- /dev/null +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -0,0 +1,74 @@ +name: Linux Auditd File And Directory Discovery +id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious file and directory discovery activities, + which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. + This behavior often precedes data exfiltration, as adversaries seek to identify valuable or confidential + information for theft. By identifying unusual or unauthorized attempts to browse or enumerate files and + directories, this analytic helps security teams detect potential reconnaissance or preparatory actions + by an attacker, enabling timely intervention to prevent data breaches or unauthorized access. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, + "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.tif%") OR + LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, "%.gif%") OR LIKE (process_exec, + "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE (process_exec, "%.jif%")OR LIKE + (process_exec, "%.jfif%")OR LIKE (process_exec, "%.jp2%")OR LIKE (process_exec, + "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE (process_exec, "%.j2c%")OR LIKE + (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR LIKE (process_exec, "%.png%")OR + LIKE (process_exec, "%.flv%") OR LIKE (process_exec, "%.pdf%")OR LIKE (process_exec, + "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE (process_exec, "%.gifv%")OR LIKE + (process_exec, "%.avi%")OR LIKE (process_exec, "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR + LIKE (process_exec, "%.wav%")OR LIKE (process_exec, "%.doc%")OR LIKE (process_exec, + "%.docx%")OR LIKE (process_exec, "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE + (process_exec, "%.svg%")) | stats count min(_time) as firstTime max(_time) as lastTime + by argc process_exec | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_file_and_directory_discovery_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1083 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_document/linux_auditd_find_document.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml new file mode 100644 index 0000000000..8e34e3af6b --- /dev/null +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -0,0 +1,64 @@ +name: Linux Auditd File Permission Modification Via Chmod +id: 5f1d2ea7-eec0-4790-8b24-6875312ad492 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious file permission modifications using the `chmod` command, + which may indicate an attacker attempting to alter access controls on critical files or directories. + Such modifications can be used to grant unauthorized users elevated privileges or to conceal malicious + activities by restricting legitimate access. By monitoring for unusual or unauthorized `chmod` usage, + this analytic helps identify potential security breaches, allowing security teams to respond promptly + to prevent privilege escalation, data tampering, or other unauthorized actions on the system. +data_source: +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE(process_exec, + "%chmod%") AND (LIKE(process_exec, "% 777 %") OR LIKE(process_exec, "% 755 %") OR + LIKE(process_exec, "%x%") OR LIKE(process_exec, "% 754 %") OR LIKE(process_exec, + "% 700 %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec + proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_file_permission_modification_via_chmod_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1222.002 + - T1222 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - proctitle + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml new file mode 100644 index 0000000000..149f2e6775 --- /dev/null +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -0,0 +1,63 @@ +name: Linux Auditd File Permissions Modification Via Chattr +id: f2d1110d-b01c-4a58-9975-90a9edeb083a +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious file permissions modifications using the chattr command, + which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. + The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect + malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, + this analytic helps identify potential tampering with critical files, enabling security teams to quickly + respond to and mitigate threats associated with unauthorized file attribute changes. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process`| where LIKE(process_exec, + "%chattr %") AND LIKE(process_exec, "% -i %") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 70 + impact: 70 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1222.002 + - T1222 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chattr_i/linux_auditd_chattr_i.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml new file mode 100644 index 0000000000..8fac5695b4 --- /dev/null +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -0,0 +1,69 @@ +name: Linux Auditd Unix Shell Configuration Modification +id: 66f737c6-3f7f-46ed-8e9b-cc0e5bf01f04 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious modifications to Unix shell configuration files, + which may indicate an attempt to alter system behavior or gain unauthorized access. + Unix shell configuration files, such as `.bashrc` or `.profile`, control user environment settings and command execution. + Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, + or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, + this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks. +data_source: +- Linux Auditd Path +search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/profile.d", + "/etc/bash.bashrc", "/etc/bashrc", "/etc/zsh/zprofile", "/etc/zsh/zshrc", "/etc/zsh/zlogin", + "/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile", + "root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc", + "/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login", + "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | stats count min(_time) + as firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_unix_shell_configuration_modification_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: a $PATH$ has been accessed/modified on host. + mitre_attack_id: + - T1546.004 + - T1546 + observable: + - name: name + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - name + - nametype + - OGID + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_auditd_unix_shell_mod_config.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml new file mode 100644 index 0000000000..9f1c2ace78 --- /dev/null +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -0,0 +1,63 @@ +name: Linux Auditd Unload Module Via Modprobe +id: 90964d6a-4b5f-409a-85bd-95e261e03fe9 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious use of the `modprobe` command to unload kernel modules, + which may indicate an attempt to disable critical system components or evade detection. The `modprobe` utility + manages kernel modules, and unauthorized unloading of modules can disrupt system security features, remove + logging capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized `modprobe` + operations involving module unloading, this analytic helps identify potential tampering with kernel functionality, + enabling security teams to investigate and address possible threats to system integrity. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, + "%modprobe%") AND LIKE (process_exec, "%-r %") | stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_unload_module_via_modprobe_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 70 + impact: 70 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1547.006 + - T1547 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe_unload_module/linux_auditd_modprobe_unload_module.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From d4d1d24dfa8d0166f9b4af6d8e59b7e5b104647b Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 22 Aug 2024 12:33:37 +0200 Subject: [PATCH 15/54] linux_auditd_detection --- .../linux_auditd_file_permissions_modification_via_chattr.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 149f2e6775..a62d60e75f 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -14,7 +14,7 @@ description: The following analytic detects suspicious file permissions modifica data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process`| where LIKE(process_exec, - "%chattr %") AND LIKE(process_exec, "% -i %") | stats count min(_time) as firstTime + "%chattr%") AND LIKE(process_exec, "%-i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection From dbbc8ddc45cb22539ff2581098df319bc66e5f32 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 22 Aug 2024 13:53:37 +0200 Subject: [PATCH 16/54] linux_auditd_detection --- .../linux_auditd_file_permissions_modification_via_chattr.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index a62d60e75f..b1018f726d 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -13,8 +13,8 @@ description: The following analytic detects suspicious file permissions modifica respond to and mitigate threats associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process`| where LIKE(process_exec, - "%chattr%") AND LIKE(process_exec, "%-i%") | stats count min(_time) as firstTime +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE(process_exec, + "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection From ae316bf34f1a17697cbfc606ffdd41a0182a9a4f Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 23 Aug 2024 11:41:25 +0200 Subject: [PATCH 17/54] linux_auditd_detection --- .../linux_auditd_base64_decode_files.yml | 63 ++++++++++++++++ ..._database_file_and_directory_discovery.yml | 70 ++++++++++++++++++ ...ditd_disable_or_modify_system_firewall.yml | 66 +++++++++++++++++ ...ind_credentials_from_password_managers.yml | 70 ++++++++++++++++++ ..._find_credentials_from_password_stores.yml | 66 +++++++++++++++++ .../linux_auditd_find_private_keys.yml | 69 ++++++++++++++++++ .../linux_auditd_find_ssh_private_keys.yml | 67 +++++++++++++++++ ..._hidden_files_and_directories_creation.yml | 65 +++++++++++++++++ ...system_network_configuration_discovery.yml | 71 +++++++++++++++++++ ...tual_disk_file_and_directory_discovery.yml | 65 +++++++++++++++++ 10 files changed, 672 insertions(+) create mode 100644 detections/endpoint/linux_auditd_base64_decode_files.yml create mode 100644 detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml create mode 100644 detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml create mode 100644 detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml create mode 100644 detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml create mode 100644 detections/endpoint/linux_auditd_find_private_keys.yml create mode 100644 detections/endpoint/linux_auditd_find_ssh_private_keys.yml create mode 100644 detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml create mode 100644 detections/endpoint/linux_auditd_system_network_configuration_discovery.yml create mode 100644 detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml new file mode 100644 index 0000000000..fd857bb1c2 --- /dev/null +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -0,0 +1,63 @@ +name: Linux Auditd Base64 Decode Files +id: 5890ba10-4e48-4dc0-8a40-3e1ebe75e737 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, + such as data exfiltration or execution of encoded commands. Base64 is commonly used to encode data for safe transmission, + but attackers may abuse it to conceal malicious payloads. This detection focuses on identifying unusual or unexpected + Base64 decoding processes, particularly when associated with critical files or directories. By monitoring these activities, + the analytic helps uncover potential threats, enabling security teams to respond promptly and mitigate risks associated + with encoded malware or unauthorized data access. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, + "%base64%") AND (LIKE(process_exec, "%-d %") OR LIKE(process_exec, "% --d%")) | + stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_base64_decode_files_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://gtfobins.github.io/gtfobins/dd/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1140 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/linux_auditd_base64/linux_auditd_base64.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml new file mode 100644 index 0000000000..b9f22d4762 --- /dev/null +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -0,0 +1,70 @@ +name: Linux Auditd Database File And Directory Discovery +id: f616c4f3-bde9-41cf-856c-019b65f668bb +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious database file and directory discovery activities, + which may signal an attacker’s attempt to locate and assess critical database assets on a compromised system. + This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, + as attackers seek to identify valuable information stored in databases. + By monitoring for unusual or unauthorized attempts to locate database files and directories, + this analytic aids in early detection of potential reconnaissance or data breach efforts, + enabling security teams to respond swiftly and mitigate the risk of further compromise. +data_source: +- Linux Auditd Execve +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, + "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.db%") OR + LIKE (process_exec, "%.sql%") OR LIKE (process_exec, "%.sqlite%") OR LIKE (process_exec, + "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR LIKE (process_exec, "%.mdf%")OR LIKE + (process_exec, "%.ndf%")OR LIKE (process_exec, "%.ldf%")OR LIKE (process_exec, "%.frm%")OR + LIKE (process_exec, "%.idb%")OR LIKE (process_exec, "%.myd%")OR LIKE (process_exec, + "%.myi%")OR LIKE (process_exec, "%.dbf%")OR LIKE (process_exec, "%.db2%")OR LIKE + (process_exec, "%.dbc%")OR LIKE (process_exec, "%.fpt%")OR LIKE (process_exec, "%.ora%")) + | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1083 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml new file mode 100644 index 0000000000..398462b62e --- /dev/null +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -0,0 +1,66 @@ +name: Linux Auditd Disable Or Modify System Firewall +id: 07052556-d4b5-4bae-89aa-cbdc1bb11250 +version: 1 +date: '2024-08-09' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the suspicious disable or modify system + firewall. This behavior is critical for a SOC to monitor because it may indicate + attempts to gain unauthorized access or maintain control over a system. Such actions + could be signs of malicious activity. If confirmed, this could lead to serious consequences, + including a compromised system, unauthorized access to sensitive data, or even a + wider breach affecting the entire network. Detecting and responding to these signs + early is essential to prevent potential security incidents. +data_source: +- Linux Auditd Service Stop +search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | stats count + min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_disable_or_modify_system_firewall_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: a firewall $type$ event occured on host. + mitre_attack_id: + - T1562.004 + - T1562 + observable: + - name: type + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - type + - pid + - UID + - comm + - exe + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/linux_auditd_disable_firewall/linux_auditd_disable_firewall.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml new file mode 100644 index 0000000000..4bf58b2a01 --- /dev/null +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -0,0 +1,70 @@ +name: Linux Auditd Find Credentials From Password Managers +id: 784241aa-85a5-4782-a503-d071bd3446f9 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious attempts to find credentials stored in password managers, + which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often + targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. + By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps + identify potential credential theft attempts, enabling security teams to respond quickly to protect critical + accounts and prevent further unauthorized access. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, + "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") + OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") + OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, + "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR + LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, + "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR + LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) + as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1555.005 + - T1555 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_password_db/linux_auditd_find_password_db.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml new file mode 100644 index 0000000000..99511b40e2 --- /dev/null +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -0,0 +1,66 @@ +name: Linux Auditd Find Credentials From Password Stores +id: 4de73044-9a1d-4a51-a1c2-85267d8dcab3 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious attempts to find credentials stored in password stores, + indicating a potential attacker's effort to access sensitive login information. Password stores are critical + repositories that contain valuable credentials, and unauthorized access to them can lead to significant + security breaches. By monitoring for unusual or unauthorized activities related to password store access, + this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly + and prevent unauthorized access to critical systems and data. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, + "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") + OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE + (process_exec, "%creds%")) | stats count min(_time) + as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1555.005 + - T1555 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_credentials/linux_auditd_find_credentials.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_find_private_keys.yml new file mode 100644 index 0000000000..5500d7d1b4 --- /dev/null +++ b/detections/endpoint/linux_auditd_find_private_keys.yml @@ -0,0 +1,69 @@ +name: Linux Auditd Find Private Keys +id: 80bb9988-190b-4ee0-a3c3-509545a8f678 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious attempts to find private keys, + which may indicate an attacker’s effort to access sensitive cryptographic information. + Private keys are crucial for securing encrypted communications and data, and unauthorized access + to them can lead to severe security breaches, including data decryption and identity theft. + By monitoring for unusual or unauthorized searches for private keys, + this analytic helps identify potential threats to cryptographic security, enabling security teams + to take swift action to protect the integrity and confidentiality of encrypted information. +data_source: +- Linux Auditd Execve +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, + "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR + LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, + "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE + (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%")OR LIKE (process_exec, + "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_find_private_keys_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1552.004 + - T1552 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_gpg/linux_auditd_find_gpg.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml new file mode 100644 index 0000000000..c1219214f9 --- /dev/null +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -0,0 +1,67 @@ +name: Linux Auditd Find Ssh Private Keys +id: e2d2bd10-dcd1-4b2f-8a76-0198eab32ba5 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious attempts to find SSH private keys, + which may indicate an attacker’s effort to compromise secure access to systems. + SSH private keys are essential for secure authentication, and unauthorized access to t + hese keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. + By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify + potential threats to network security, allowing security teams to quickly respond and safeguard against + unauthorized access and potential breaches. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, + "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%id_rsa%") + OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, + "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) | stats count min(_time) + as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_find_ssh_private_keys_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 70 + impact: 70 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1552.004 + - T1552 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_ssh_files/linux_auditd_find_ssh_files.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml new file mode 100644 index 0000000000..e96a44637b --- /dev/null +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Hidden Files And Directories Creation +id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects suspicious creation of hidden files and directories, + which may indicate an attacker’s attempt to conceal malicious activities or unauthorized data. + Hidden files and directories are often used to evade detection by security tools and administrators, + providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for + unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential + attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. +data_source: +- Linux Auditd Execve +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec,"%touch + %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi + %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE + (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1083 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_hidden_file/linux_auditd_hidden_file.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml new file mode 100644 index 0000000000..f35a5242de --- /dev/null +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -0,0 +1,71 @@ +name: Linux Auditd System Network Configuration Discovery +id: 5db16825-81bd-4923-a8d6-d6a13a59832a +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious system network configuration discovery activities, + which may indicate an adversary's attempt to gather information about the network environment. + Such actions typically involve commands or tools used to identify network interfaces, routing tables, + and active connections. Detecting these activities is crucial, as they often precede more targeted + attacks like lateral movement or data exfiltration. By identifying unusual or unauthorized network + discovery efforts, this analytic helps security teams to swiftly detect and respond to potential + reconnaissance operations, mitigating the risk of further compromise. +data_source: +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route") + | bucket _time span=15m + | stats dc(comm) as unique_commands, values(comm) as comm, values(exe) as exe, values(SYSCALL) as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) as pid, count, + min(_time) as firstTime, max(_time) as lastTime by success + | where unique_commands >= 4 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_system_network_configuration_discovery_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $comm$ was executed on host. + mitre_attack_id: + - T1016 + observable: + - name: comm + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - comm + - exe + - SYSCALL + - UID + - ppid + - pid + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/linux_auditd_net_tool/linux_auditd_net_tool.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml new file mode 100644 index 0000000000..7ed8b415f2 --- /dev/null +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -0,0 +1,65 @@ +name: Linux Auditd Virtual Disk File And Directory Discovery +id: eec78cef-d4c8-4b35-8f5b-6922102a4a41 +version: 1 +date: '2024-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious discovery of virtual disk files and directories, + which may indicate an attacker’s attempt to locate and access virtualized storage environments. + Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery + attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring + for unusual or unauthorized searches for virtual disk files and directories, this analytic helps + identify potential reconnaissance activities, enabling security teams to respond promptly and + safeguard against unauthorized access and data breaches. +data_source: +- Linux Auditd Execve +search: ' linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, + "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR + LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count + min(_time) as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Living Off The Land + asset_type: Endpoint + confidence: 50 + impact: 50 + message: $process_exec$ event occurred on host. + mitre_attack_id: + - T1083 + observable: + - name: process_exec + type: Other + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - argc + - process_exec + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_virtual_disk/linux_auditd_find_virtual_disk.log + source: /var/log/audit/audit.log + sourcetype: linux:audit From 5649a1b8b04154aad828a2ef1172acc9244be3c6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 23 Aug 2024 12:02:19 +0200 Subject: [PATCH 18/54] linux_auditd_detection --- .../linux_auditd_database_file_and_directory_discovery.yml | 2 +- .../linux_auditd_virtual_disk_file_and_directory_discovery.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index b9f22d4762..00568a6b9c 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -65,6 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_db/linux_auditd_find_db.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index 7ed8b415f2..a2293dce3a 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -14,7 +14,7 @@ description: The following analytic detects suspicious discovery of virtual disk safeguard against unauthorized access and data breaches. data_source: - Linux Auditd Execve -search: ' linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` From 23b4910cf6281d3ae8b225e5c4a01bde35d67fc2 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 26 Aug 2024 13:27:08 -0600 Subject: [PATCH 19/54] No More Haag-gling with BlackSuit: A Tailored Analytic Story --- ...ivity_related_to_pass_the_hash_attacks.yml | 11 ++++---- .../endpoint/anomalous_usage_of_7zip.yml | 1 + .../create_remote_thread_into_lsass.yml | 1 + ...redential_dumping_through_lsass_access.yml | 1 + ...tect_sharphound_command_line_arguments.yml | 1 + .../detect_sharphound_file_modifications.yml | 1 + ...thentication_discovery_with_get_aduser.yml | 1 + ...omain_controller_discovery_with_nltest.yml | 1 + .../elevated_group_discovery_with_net.yml | 1 + ...le_written_in_administrative_smb_share.yml | 1 + ...on_flag_disabled_in_useraccountcontrol.yml | 1 + ...andomly_generated_windows_service_name.yml | 1 + .../registry_keys_used_for_persistence.yml | 1 + .../rubeus_command_line_parameters.yml | 1 + ...ticket_exports_through_winlogon_access.yml | 1 + ...no_command_line_arguments_with_network.yml | 1 + ...system_information_discovery_detection.yml | 1 + ...wn_process_using_the_kerberos_protocol.yml | 1 + ...ows_ad_abnormal_object_access_activity.yml | 1 + ...s_ad_privileged_object_access_activity.yml | 1 + detections/endpoint/windows_adfind_exe.yml | 1 + .../windows_driver_load_non_standard_path.yml | 1 + ...scalation_suspicious_process_elevation.yml | 1 + ...n_system_process_without_system_parent.yml | 1 + ...tion_user_process_spawn_system_process.yml | 1 + .../windows_remote_create_service.yml | 1 + .../windows_remote_services_rdp_enable.yml | 1 + ...ws_task_scheduler_event_action_started.yml | 1 + stories/blacksuit_ransomware.yml | 25 +++++++++++++++++++ 29 files changed, 58 insertions(+), 5 deletions(-) create mode 100644 stories/blacksuit_ransomware.yml diff --git a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml index 9b8abca9a6..a2496efcd6 100644 --- a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml @@ -10,11 +10,11 @@ description: This search looks for specific authentication events from the Windo data_source: - Windows Event Log Security 4624 search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) -| fillnull -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `detect_activity_related_to_pass_the_hash_attacks_filter`' + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_activity_related_to_pass_the_hash_attacks_filter`' how_to_implement: To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows. known_false_positives: Legitimate logon activity by authorized NTLM systems may be @@ -23,6 +23,7 @@ references: [] tags: analytic_story: - Active Directory Lateral Movement + - BlackSuit Ransomware asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 8244563d1b..85d7f4a5c7 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -43,6 +43,7 @@ tags: - BlackByte Ransomware - Cobalt Strike - Graceful Wipe Out Attack + - BlackSuit Ransomware asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index ea1084f575..a4c32abbf2 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Credential Dumping + - BlackSuit Ransomware asset_type: Windows confidence: 90 impact: 90 diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 77f0b0e806..9d50d54086 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -35,6 +35,7 @@ tags: - Detect Zerologon Attack - CISA AA23-347A - Credential Dumping + - BlackSuit Ransomware asset_type: Windows confidence: 100 impact: 80 diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 51d16a6f89..e604f18487 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -43,6 +43,7 @@ tags: analytic_story: - Windows Discovery Techniques - Ransomware + - BlackSuit Ransomware asset_type: Endpoint confidence: 80 impact: 30 diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 718559e461..9baff85c8e 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Windows Discovery Techniques - Ransomware + - BlackSuit Ransomware asset_type: Endpoint confidence: 80 impact: 30 diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml index fc69094941..8aeb4e05b9 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml @@ -32,6 +32,7 @@ tags: analytic_story: - CISA AA23-347A - Active Directory Kerberos Attacks + - BlackSuit Ransomware asset_type: Endpoint confidence: 90 impact: 60 diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index 6a1dd7d0e5..1bc0a5d35c 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -39,6 +39,7 @@ tags: - Active Directory Discovery - CISA AA23-347A - Rhysida Ransomware + - BlackSuit Ransomware asset_type: Endpoint confidence: 70 impact: 30 diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index f667778adf..9459acf2cb 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -47,6 +47,7 @@ tags: - Active Directory Discovery - Volt Typhoon - Rhysida Ransomware + - BlackSuit Ransomware asset_type: Endpoint confidence: 70 impact: 30 diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index ac28c68fd7..ee4b3e4655 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -42,6 +42,7 @@ tags: - Data Destruction - Hermetic Wiper - Trickbot + - BlackSuit Ransomware asset_type: Endpoint confidence: 100 impact: 70 diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 43385ce72c..85245f3ae5 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Active Directory Kerberos Attacks + - BlackSuit Ransomware asset_type: Endpoint confidence: 90 impact: 50 diff --git a/detections/endpoint/randomly_generated_windows_service_name.yml b/detections/endpoint/randomly_generated_windows_service_name.yml index 386eae5efc..7357fda8ea 100644 --- a/detections/endpoint/randomly_generated_windows_service_name.yml +++ b/detections/endpoint/randomly_generated_windows_service_name.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Active Directory Lateral Movement + - BlackSuit Ransomware asset_type: Endpoint confidence: 50 impact: 90 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index c1bfa0cf48..6ee57a7b99 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -77,6 +77,7 @@ tags: - CISA AA23-347A - Snake Keylogger - MoonPeak + - BlackSuit Ransomware asset_type: Endpoint confidence: 95 impact: 80 diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 73c9ac3726..507446ecb0 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -49,6 +49,7 @@ tags: - Active Directory Privilege Escalation - CISA AA23-347A - Active Directory Kerberos Attacks + - BlackSuit Ransomware asset_type: Endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 9f2a73434f..bb376bc6b4 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -37,6 +37,7 @@ tags: analytic_story: - CISA AA23-347A - Active Directory Kerberos Attacks + - BlackSuit Ransomware asset_type: Endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index f1fe25961f..5463fe8080 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -48,6 +48,7 @@ tags: - BlackByte Ransomware - PrintNightmare CVE-2021-34527 - Graceful Wipe Out Attack + - BlackSuit Ransomware asset_type: Endpoint confidence: 100 cve: diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index d2fcf549d3..4c6dcab962 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -41,6 +41,7 @@ tags: analytic_story: - Windows Discovery Techniques - Gozi Malware + - BlackSuit Ransomware asset_type: Windows confidence: 50 impact: 30 diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index edc7472aa2..acb78c8790 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -40,6 +40,7 @@ references: tags: analytic_story: - Active Directory Kerberos Attacks + - BlackSuit Ransomware asset_type: Endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml index af65815e95..dc10897e5f 100644 --- a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml +++ b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Active Directory Discovery + - BlackSuit Ransomware asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_ad_privileged_object_access_activity.yml b/detections/endpoint/windows_ad_privileged_object_access_activity.yml index fde48019ed..4d4460ae65 100644 --- a/detections/endpoint/windows_ad_privileged_object_access_activity.yml +++ b/detections/endpoint/windows_ad_privileged_object_access_activity.yml @@ -40,6 +40,7 @@ references: tags: analytic_story: - Active Directory Discovery + - BlackSuit Ransomware asset_type: Endpoint confidence: 50 impact: 80 diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 396269cb15..2b826ac1f4 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -47,6 +47,7 @@ tags: - IcedID - NOBELIUM Group - Graceful Wipe Out Attack + - BlackSuit Ransomware asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index 9dd0aacff0..c6585c949d 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -35,6 +35,7 @@ tags: - CISA AA22-320A - AgentTesla - BlackByte Ransomware + - BlackSuit Ransomware asset_type: Endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml index 8320268295..a398762d0a 100644 --- a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml +++ b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml @@ -56,6 +56,7 @@ references: tags: analytic_story: - Windows Privilege Escalation + - BlackSuit Ransomware asset_type: Endpoint confidence: 40 impact: 100 diff --git a/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml b/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml index a879e325d8..7b8699af27 100644 --- a/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml +++ b/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Windows Privilege Escalation + - BlackSuit Ransomware asset_type: Endpoint confidence: 80 impact: 100 diff --git a/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml b/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml index 801c75f46e..fb32f8c1c2 100644 --- a/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml +++ b/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml @@ -50,6 +50,7 @@ references: tags: analytic_story: - Windows Privilege Escalation + - BlackSuit Ransomware asset_type: Endpoint confidence: 80 impact: 100 diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index 7df5ea8be0..60b313f4bd 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -40,6 +40,7 @@ tags: analytic_story: - Active Directory Lateral Movement - CISA AA23-347A + - BlackSuit Ransomware asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml index 4d62b4d31a..190d6aa77c 100644 --- a/detections/endpoint/windows_remote_services_rdp_enable.yml +++ b/detections/endpoint/windows_remote_services_rdp_enable.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Azorult + - BlackSuit Ransomware asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index a30da724a5..2b1beb2283 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -44,6 +44,7 @@ tags: - Data Destruction - Amadey - Scheduled Tasks + - BlackSuit Ransomware asset_type: Endpoint confidence: 100 impact: 80 diff --git a/stories/blacksuit_ransomware.yml b/stories/blacksuit_ransomware.yml new file mode 100644 index 0000000000..836f605316 --- /dev/null +++ b/stories/blacksuit_ransomware.yml @@ -0,0 +1,25 @@ +name: BlackSuit Ransomware +id: 4c7bef12-679f-433c-92dd-d9feccc1432b +version: 1 +date: '2024-08-26' +author: Michael Haag, Splunk +description: This analytic story covers the tactics, techniques, and procedures (TTPs) associated with BlackSuit ransomware, as observed in a December 2023 intrusion. The story encompasses the full attack lifecycle, from initial access via Cobalt Strike beacons to lateral movement, credential access, and ultimately the deployment of BlackSuit ransomware. It aims to help security teams detect and respond to similar attacks by focusing on key behaviors such as Cobalt Strike activity, use of tools like ADFind and Sharphound, and the final ransomware deployment phase. +narrative: In December 2023, a sophisticated intrusion culminating in the deployment of BlackSuit ransomware was observed. The attack began with the execution of a Cobalt Strike beacon, which initially communicated through CloudFlare to conceal the true C2 server. The threat actors leveraged various tools throughout the intrusion, including Sharphound, Rubeus, SystemBC, and ADFind, alongside built-in Windows utilities. + + The attackers conducted extensive reconnaissance and lateral movement, using techniques such as AS-REP Roasting, Kerberoasting, and accessing LSASS memory for credential theft. They deployed multiple Cobalt Strike beacons across the environment and utilized RDP for further lateral movement. SystemBC was employed on a file server, providing additional command and control capabilities and proxy functionality. + + After a period of intermittent activity spanning 15 days, the threat actors executed their final objective. They used ADFind for additional discovery, ran the Get-DataInfo.ps1 PowerShell script to gather system information, and ultimately deployed the BlackSuit ransomware. The ransomware binary (qwe.exe) was distributed via SMB to remote systems through admin shares, and executed manually via RDP sessions. Upon execution, the ransomware deleted shadow copies before encrypting files across the compromised systems. + + This analytic story provides detections for various stages of this attack, including Cobalt Strike beacon activity, use of reconnaissance tools, suspicious PowerShell executions, and indicators of ransomware deployment. By monitoring for these behaviors, security teams can potentially detect and mitigate BlackSuit ransomware attacks before they reach their final, destructive stage. + +references: + - https://thedfirreport.com/2024/08/26/blacksuit-ransomware/ +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + cve: [] \ No newline at end of file From a94e51bb74b2e77a21ca8f8780bbf08ec5874250 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 27 Aug 2024 10:42:47 +0200 Subject: [PATCH 20/54] linux_auditd_detection --- .../linux_auditd_add_user_account.yml | 13 ++++---- .../linux_auditd_add_user_account_type.yml | 5 +-- .../linux_auditd_at_application_execution.yml | 15 ++++----- .../linux_auditd_auditd_service_stop.yml | 5 +-- .../linux_auditd_base64_decode_files.yml | 19 +++++++----- ...linux_auditd_change_file_owner_to_root.yml | 15 ++++----- .../linux_auditd_clipboard_data_copy.yml | 13 ++++---- .../linux_auditd_data_destruction_command.yml | 15 ++++----- ...td_data_transfer_size_limits_via_split.yml | 22 +++++++------ ...transfer_size_limits_via_split_syscall.yml | 20 ++++++------ ..._database_file_and_directory_discovery.yml | 20 ++++++------ .../linux_auditd_dd_file_overwrite.yml | 5 +-- ...ditd_disable_or_modify_system_firewall.yml | 5 +-- .../linux_auditd_doas_conf_file_creation.yml | 3 +- .../linux_auditd_doas_tool_execution.yml | 3 +- ...linux_auditd_edit_cron_table_parameter.yml | 11 ++++--- ...ux_auditd_file_and_directory_discovery.yml | 19 +++++++----- ...file_permission_modification_via_chmod.yml | 19 +++++++----- ...le_permissions_modification_via_chattr.yml | 19 +++++++----- ...ind_credentials_from_password_managers.yml | 19 +++++++----- ..._find_credentials_from_password_stores.yml | 25 ++++++++------- .../linux_auditd_find_private_keys.yml | 20 ++++++------ .../linux_auditd_find_ssh_private_keys.yml | 20 ++++++------ ...linux_auditd_hardware_addition_swapoff.yml | 5 +-- ..._hidden_files_and_directories_creation.yml | 19 +++++++----- ...ert_kernel_module_using_insmod_utility.yml | 5 +-- ...l_kernel_module_using_modprobe_utility.yml | 5 +-- ...linux_auditd_kernel_module_enumeration.yml | 3 +- ...ditd_kernel_module_using_rmmod_utility.yml | 20 ++++++------ ..._auditd_nopasswd_entry_in_sudoers_file.yml | 3 +- .../linux_auditd_osquery_service_stop.yml | 20 ++++++------ ...ss_or_modification_of_sshd_config_file.yml | 5 +-- ...td_possible_access_to_credential_files.yml | 5 +-- ...auditd_possible_access_to_sudoers_file.yml | 3 +- ...cronjob_entry_on_existing_cronjob_file.yml | 5 +-- ...ux_auditd_preload_hijack_library_calls.yml | 3 +- ...auditd_preload_hijack_via_preload_file.yml | 20 ++++++------ .../linux_auditd_service_restarted.yml | 7 +++-- .../endpoint/linux_auditd_service_started.yml | 5 +-- ...inux_auditd_setuid_using_chmod_utility.yml | 5 +-- ...nux_auditd_setuid_using_setcap_utility.yml | 3 +- .../linux_auditd_shred_overwrite_command.yml | 5 +-- .../endpoint/linux_auditd_stop_services.yml | 7 +++-- .../linux_auditd_sudo_or_su_execution.yml | 3 +- .../linux_auditd_sysmon_service_stop.yml | 5 +-- ...system_network_configuration_discovery.yml | 31 ++++++++++--------- ..._unix_shell_configuration_modification.yml | 19 +++++++----- ...inux_auditd_unload_module_via_modprobe.yml | 19 +++++++----- ...tual_disk_file_and_directory_discovery.yml | 20 ++++++------ .../linux_auditd_whoami_user_discovery.yml | 20 ++++++------ stories/compromised_linux_host.yml | 25 +++++++++++++++ 51 files changed, 364 insertions(+), 261 deletions(-) create mode 100644 stories/compromised_linux_host.yml diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 1407ca4662..35a243b502 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -1,7 +1,7 @@ name: Linux Auditd Add User Account id: aae66dc0-74b4-4807-b480-b35f8027abb4 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ description: The following analytic detects the creation of new user accounts on to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk. -data_source: +data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, "%useradd%") OR LIKE (process_exec, "%adduser%") | stats count min(_time) as firstTime @@ -21,10 +21,10 @@ search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -33,6 +33,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 185f0123bc..01dd06178e 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -1,7 +1,7 @@ name: Linux Auditd Add User Account Type id: f8c325ea-506e-4105-8ccf-da1492e90115 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -30,9 +30,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index 495a755af4..0aadf0cd36 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd At Application Execution id: 9f306e0a-1c36-469e-8892-968ca12470dd version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ description: The following analytic detects the execution of the "At" applicatio this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks. -data_source: +data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") AND NOT (UID IN("daemon")) | stats count min(_time) as firstTime max(_time) as lastTime @@ -23,10 +23,10 @@ search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/ how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -34,10 +34,11 @@ references: - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ tags: analytic_story: + - Scheduled Tasks - Linux Privilege Escalation - Linux Persistence Techniques - Linux Living Off The Land - - Scheduled Tasks + - Compromised Linux Host asset_type: Endpoint confidence: 30 impact: 30 diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index ba863c9d6f..2c920316fb 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Auditd Service Stop id: 6cb9d0e1-eabe-41de-a11a-5efade354e9d version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -30,9 +30,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index fd857bb1c2..0b307ba051 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -1,16 +1,18 @@ name: Linux Auditd Base64 Decode Files id: 5890ba10-4e48-4dc0-8a40-3e1ebe75e737 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, - such as data exfiltration or execution of encoded commands. Base64 is commonly used to encode data for safe transmission, - but attackers may abuse it to conceal malicious payloads. This detection focuses on identifying unusual or unexpected - Base64 decoding processes, particularly when associated with critical files or directories. By monitoring these activities, - the analytic helps uncover potential threats, enabling security teams to respond promptly and mitigate risks associated - with encoded malware or unauthorized data access. +description: The following analytic detects suspicious Base64 decode operations that + may indicate malicious activity, such as data exfiltration or execution of encoded + commands. Base64 is commonly used to encode data for safe transmission, but attackers + may abuse it to conceal malicious payloads. This detection focuses on identifying + unusual or unexpected Base64 decoding processes, particularly when associated with + critical files or directories. By monitoring these activities, the analytic helps + uncover potential threats, enabling security teams to respond promptly and mitigate + risks associated with encoded malware or unauthorized data access. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, @@ -31,9 +33,10 @@ references: - https://gtfobins.github.io/gtfobins/dd/ tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index b5cd53a70f..5410314fa4 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -1,7 +1,7 @@ name: Linux Auditd Change File Owner To Root id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -12,7 +12,7 @@ description: The following analytic detects the use of the 'chown' command to ch by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised host and potential persistence within the environment. -data_source: +data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE (process_exec, "%chown %") AND LIKE (process_exec, "% root %") | stats count min(_time) as firstTime @@ -21,10 +21,10 @@ search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -32,9 +32,10 @@ references: - https://askubuntu.com/questions/617850/changing-from-user-to-superuser tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 60b67b26a6..813c452001 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -1,7 +1,7 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ description: The following analytic detects the use of the Linux 'xclip' command data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment. -data_source: +data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") @@ -23,10 +23,10 @@ search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(pr how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed. references: @@ -35,6 +35,7 @@ references: tags: analytic_story: - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 40 impact: 40 diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index b724b6ca98..c3c9b7d176 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -1,7 +1,7 @@ name: Linux Auditd Data Destruction Command id: 4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -13,7 +13,7 @@ description: The following analytic detects the execution of a Unix shell comman Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage. -data_source: +data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") @@ -22,18 +22,19 @@ search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (p how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. + you must ingest logs that contain the process complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that + are specific to the EDR product. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. known_false_positives: unknown references: - https://cert.gov.ua/article/3718487 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ tags: analytic_story: - - AwfulShred - Data Destruction + - AwfulShred + - Compromised Linux Host asset_type: Endpoint confidence: 90 impact: 100 diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index 13b1b5027e..9f18f3ffa1 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -1,17 +1,18 @@ name: Linux Auditd Data Transfer Size Limits Via Split id: 4669561d-3bbd-44e3-857c-0e3c6ef2120c version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious data transfer activities - that involve the use of the `split` syscall, potentially indicating an attempt to - evade detection by breaking large files into smaller parts. Attackers may use this - technique to bypass size-based security controls, facilitating the covert exfiltration - of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, - this analytic helps identify potential data exfiltration attempts, allowing security teams - to intervene and prevent the unauthorized transfer of critical information from the network. +description: The following analytic detects suspicious data transfer activities that + involve the use of the `split` syscall, potentially indicating an attempt to evade + detection by breaking large files into smaller parts. Attackers may use this technique + to bypass size-based security controls, facilitating the covert exfiltration of + sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, + this analytic helps identify potential data exfiltration attempts, allowing security + teams to intervene and prevent the unauthorized transfer of critical information + from the network. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, @@ -31,14 +32,15 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 70 impact: 70 message: $process_exec$ event occurred on host. - mitre_attack_id: + mitre_attack_id: - T1030 observable: - name: process_exec diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index 35a5d24daa..cc4217d76e 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -1,17 +1,18 @@ name: Linux Auditd Data Transfer Size Limits Via Split Syscall id: c03d4a49-cf9d-435b-86e9-c6f8c9b6c42e version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious data transfer activities - that involve the use of the `split` syscall, potentially indicating an attempt to - evade detection by breaking large files into smaller parts. Attackers may use this - technique to bypass size-based security controls, facilitating the covert exfiltration - of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, - this analytic helps identify potential data exfiltration attempts, allowing security teams - to intervene and prevent the unauthorized transfer of critical information from the network. +description: The following analytic detects suspicious data transfer activities that + involve the use of the `split` syscall, potentially indicating an attempt to evade + detection by breaking large files into smaller parts. Attackers may use this technique + to bypass size-based security controls, facilitating the covert exfiltration of + sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, + this analytic helps identify potential data exfiltration attempts, allowing security + teams to intervene and prevent the unauthorized transfer of critical information + from the network. data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | stats count min(_time) @@ -30,9 +31,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index 00568a6b9c..63b611de31 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -1,17 +1,18 @@ name: Linux Auditd Database File And Directory Discovery id: f616c4f3-bde9-41cf-856c-019b65f668bb version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious database file and directory discovery activities, - which may signal an attacker’s attempt to locate and assess critical database assets on a compromised system. - This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, - as attackers seek to identify valuable information stored in databases. - By monitoring for unusual or unauthorized attempts to locate database files and directories, - this analytic aids in early detection of potential reconnaissance or data breach efforts, - enabling security teams to respond swiftly and mitigate the risk of further compromise. +description: "The following analytic detects suspicious database file and directory\ + \ discovery activities, which may signal an attacker\u2019s attempt to locate and\ + \ assess critical database assets on a compromised system. This behavior is often\ + \ a precursor to data theft, unauthorized access, or privilege escalation, as attackers\ + \ seek to identify valuable information stored in databases. By monitoring for unusual\ + \ or unauthorized attempts to locate database files and directories, this analytic\ + \ aids in early detection of potential reconnaissance or data breach efforts, enabling\ + \ security teams to respond swiftly and mitigate the risk of further compromise." data_source: - Linux Auditd Execve search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, @@ -38,9 +39,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index b699f1c420..d4fae94e93 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -1,7 +1,7 @@ name: Linux Auditd Dd File Overwrite id: d1b74420-4cea-4752-a123-9b40dfcca49a version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -32,8 +32,9 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md tags: analytic_story: - - Data Destruction - Industroyer2 + - Data Destruction + - Compromised Linux Host asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 398462b62e..875e301732 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -1,7 +1,7 @@ name: Linux Auditd Disable Or Modify System Firewall id: 07052556-d4b5-4bae-89aa-cbdc1bb11250 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -30,9 +30,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index df628c7592..9dbadb1748 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Auditd Doas Conf File Creation id: 61059783-574b-40d2-ac2f-69b898afd6b4 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -33,6 +33,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index c2965cb62a..0e6152adf5 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd Doas Tool Execution id: 91b8ca78-f205-4826-a3ef-cd8d6b24e97b version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index ef9b3c3f2b..44a55edf43 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -1,7 +1,7 @@ name: Linux Auditd Edit Cron Table Parameter id: f4bb7321-7e64-4d1e-b1aa-21f8b019a91f version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,9 +14,9 @@ description: The following analytic detects the suspicious editing of cron jobs compromise. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN ("*/crontab")) - success=yes AND NOT (UID IN("daemon")) | stats count min(_time) as firstTime max(_time) - as lastTime by comm exe SYSCALL UID ppid pid | `security_content_ctime(firstTime)` +search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN + ("*/crontab")) success=yes AND NOT (UID IN("daemon")) | stats count min(_time) as + firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_edit_cron_table_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -31,10 +31,11 @@ references: - https://attack.mitre.org/techniques/T1053/003/ tags: analytic_story: + - Scheduled Tasks - Linux Privilege Escalation - Linux Persistence Techniques - Linux Living Off The Land - - Scheduled Tasks + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 80c7de17fd..a9c3d69fee 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -1,16 +1,18 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious file and directory discovery activities, - which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. - This behavior often precedes data exfiltration, as adversaries seek to identify valuable or confidential - information for theft. By identifying unusual or unauthorized attempts to browse or enumerate files and - directories, this analytic helps security teams detect potential reconnaissance or preparatory actions - by an attacker, enabling timely intervention to prevent data breaches or unauthorized access. +description: The following analytic detects suspicious file and directory discovery + activities, which may indicate an attacker's effort to locate sensitive documents + and files on a compromised system. This behavior often precedes data exfiltration, + as adversaries seek to identify valuable or confidential information for theft. + By identifying unusual or unauthorized attempts to browse or enumerate files and + directories, this analytic helps security teams detect potential reconnaissance + or preparatory actions by an attacker, enabling timely intervention to prevent data + breaches or unauthorized access. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, @@ -42,9 +44,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index 8e34e3af6b..d43c4d6f51 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -1,16 +1,18 @@ name: Linux Auditd File Permission Modification Via Chmod id: 5f1d2ea7-eec0-4790-8b24-6875312ad492 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious file permission modifications using the `chmod` command, - which may indicate an attacker attempting to alter access controls on critical files or directories. - Such modifications can be used to grant unauthorized users elevated privileges or to conceal malicious - activities by restricting legitimate access. By monitoring for unusual or unauthorized `chmod` usage, - this analytic helps identify potential security breaches, allowing security teams to respond promptly - to prevent privilege escalation, data tampering, or other unauthorized actions on the system. +description: The following analytic detects suspicious file permission modifications + using the `chmod` command, which may indicate an attacker attempting to alter access + controls on critical files or directories. Such modifications can be used to grant + unauthorized users elevated privileges or to conceal malicious activities by restricting + legitimate access. By monitoring for unusual or unauthorized `chmod` usage, this + analytic helps identify potential security breaches, allowing security teams to + respond promptly to prevent privilege escalation, data tampering, or other unauthorized + actions on the system. data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE(process_exec, @@ -32,9 +34,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index b1018f726d..32b5b0c9e5 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,16 +1,18 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious file permissions modifications using the chattr command, - which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. - The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect - malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, - this analytic helps identify potential tampering with critical files, enabling security teams to quickly - respond to and mitigate threats associated with unauthorized file attribute changes. +description: The following analytic detects suspicious file permissions modifications + using the chattr command, which may indicate an attacker attempting to manipulate + file attributes to evade detection or prevent alteration. The chattr command can + be used to make files immutable or restrict deletion, which can be leveraged to + protect malicious files or disrupt system operations. By monitoring for unusual + or unauthorized chattr usage, this analytic helps identify potential tampering with + critical files, enabling security teams to quickly respond to and mitigate threats + associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE(process_exec, @@ -30,9 +32,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 4bf58b2a01..820a69bf44 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,16 +1,18 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious attempts to find credentials stored in password managers, - which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often - targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. - By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps - identify potential credential theft attempts, enabling security teams to respond quickly to protect critical - accounts and prevent further unauthorized access. +description: The following analytic detects suspicious attempts to find credentials + stored in password managers, which may indicate an attacker's effort to retrieve + sensitive login information. Password managers are often targeted by adversaries + seeking to access stored passwords for further compromise or lateral movement within + a network. By monitoring for unusual or unauthorized access to password manager + files or processes, this analytic helps identify potential credential theft attempts, + enabling security teams to respond quickly to protect critical accounts and prevent + further unauthorized access. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, @@ -37,9 +39,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 99511b40e2..7c2bb59f58 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -1,24 +1,26 @@ name: Linux Auditd Find Credentials From Password Stores id: 4de73044-9a1d-4a51-a1c2-85267d8dcab3 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious attempts to find credentials stored in password stores, - indicating a potential attacker's effort to access sensitive login information. Password stores are critical - repositories that contain valuable credentials, and unauthorized access to them can lead to significant - security breaches. By monitoring for unusual or unauthorized activities related to password store access, - this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly - and prevent unauthorized access to critical systems and data. +description: The following analytic detects suspicious attempts to find credentials + stored in password stores, indicating a potential attacker's effort to access sensitive + login information. Password stores are critical repositories that contain valuable + credentials, and unauthorized access to them can lead to significant security breaches. + By monitoring for unusual or unauthorized activities related to password store access, + this analytic helps identify potential credential theft attempts, allowing security + teams to respond promptly and prevent unauthorized access to critical systems and + data. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE - (process_exec, "%creds%")) | stats count min(_time) - as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' + (process_exec, "%creds%")) | stats count min(_time) as firstTime max(_time) as lastTime + by argc process_exec | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_find_credentials_from_password_stores_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -33,9 +35,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_find_private_keys.yml index 5500d7d1b4..9037ac0f77 100644 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_private_keys.yml @@ -1,17 +1,18 @@ name: Linux Auditd Find Private Keys id: 80bb9988-190b-4ee0-a3c3-509545a8f678 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious attempts to find private keys, - which may indicate an attacker’s effort to access sensitive cryptographic information. - Private keys are crucial for securing encrypted communications and data, and unauthorized access - to them can lead to severe security breaches, including data decryption and identity theft. - By monitoring for unusual or unauthorized searches for private keys, - this analytic helps identify potential threats to cryptographic security, enabling security teams - to take swift action to protect the integrity and confidentiality of encrypted information. +description: "The following analytic detects suspicious attempts to find private keys,\ + \ which may indicate an attacker\u2019s effort to access sensitive cryptographic\ + \ information. Private keys are crucial for securing encrypted communications and\ + \ data, and unauthorized access to them can lead to severe security breaches, including\ + \ data decryption and identity theft. By monitoring for unusual or unauthorized\ + \ searches for private keys, this analytic helps identify potential threats to cryptographic\ + \ security, enabling security teams to take swift action to protect the integrity\ + \ and confidentiality of encrypted information." data_source: - Linux Auditd Execve search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, @@ -36,9 +37,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index c1219214f9..d3b901e6a4 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -1,17 +1,18 @@ name: Linux Auditd Find Ssh Private Keys id: e2d2bd10-dcd1-4b2f-8a76-0198eab32ba5 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious attempts to find SSH private keys, - which may indicate an attacker’s effort to compromise secure access to systems. - SSH private keys are essential for secure authentication, and unauthorized access to t - hese keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. - By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify - potential threats to network security, allowing security teams to quickly respond and safeguard against - unauthorized access and potential breaches. +description: "The following analytic detects suspicious attempts to find SSH private\ + \ keys, which may indicate an attacker\u2019s effort to compromise secure access\ + \ to systems. SSH private keys are essential for secure authentication, and unauthorized\ + \ access to t hese keys can enable attackers to gain unauthorized access to servers\ + \ and other critical infrastructure. By monitoring for unusual or unauthorized searches\ + \ for SSH private keys, this analytic helps identify potential threats to network\ + \ security, allowing security teams to quickly respond and safeguard against unauthorized\ + \ access and potential breaches." data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, @@ -34,9 +35,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index 57374c7ae1..b39fcf05e1 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -1,7 +1,7 @@ name: Linux Auditd Hardware Addition Swapoff id: 5728bb16-1a0b-4b66-bce2-0074ac839770 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -32,8 +32,9 @@ references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ tags: analytic_story: - - AwfulShred - Data Destruction + - AwfulShred + - Compromised Linux Host asset_type: Endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index e96a44637b..f976dbfaa7 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,16 +1,18 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious creation of hidden files and directories, - which may indicate an attacker’s attempt to conceal malicious activities or unauthorized data. - Hidden files and directories are often used to evade detection by security tools and administrators, - providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for - unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential - attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. +description: "The following analytic detects suspicious creation of hidden files and\ + \ directories, which may indicate an attacker\u2019s attempt to conceal malicious\ + \ activities or unauthorized data. Hidden files and directories are often used to\ + \ evade detection by security tools and administrators, providing a stealthy means\ + \ for storing malware, logs, or sensitive information. By monitoring for unusual\ + \ or unauthorized creation of hidden files and directories, this analytic helps\ + \ identify potential attempts to hide malicious operations, enabling security teams\ + \ to uncover and address hidden threats effectively." data_source: - Linux Auditd Execve search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec,"%touch @@ -33,9 +35,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index 2da923652d..f9103a4e2b 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Insert Kernel Module Using Insmod Utility id: bc0ca53f-dea6-4906-9b12-09c396fdf1d3 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -34,8 +34,9 @@ references: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Linux Rootkit + - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 6d71355646..9f7ae6d9f0 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Install Kernel Module Using Modprobe Utility id: 95165985-ace5-4d42-9c42-93a89a5af901 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -34,8 +34,9 @@ references: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Linux Rootkit + - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml index 0844627f27..5d3b99f9f8 100644 --- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -1,7 +1,7 @@ name: Linux Auditd Kernel Module Enumeration id: d1b088de-c47a-4572-9339-bdcc26493b32 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: tags: analytic_story: - Linux Rootkit + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index 671cf1f5ac..20aa3d0ddc 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -1,17 +1,18 @@ name: Linux Auditd Kernel Module Using Rmmod Utility id: 31810b7a-0abe-42be-a210-0dec8106afee version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious use of the `rmmod` utility - for kernel module removal, which may indicate an attacker’s attempt to unload critical - or security-related kernel modules. The `rmmod` command is used to remove modules from - the Linux kernel, and unauthorized use can be a tactic to disable security features, - conceal malicious activities, or disrupt system operations. By monitoring for unusual - or unauthorized `rmmod` activity, this analytic helps identify potential tampering with - kernel modules, enabling security teams to take proactive measures to protect system integrity and security. +description: "The following analytic detects suspicious use of the `rmmod` utility\ + \ for kernel module removal, which may indicate an attacker\u2019s attempt to unload\ + \ critical or security-related kernel modules. The `rmmod` command is used to remove\ + \ modules from the Linux kernel, and unauthorized use can be a tactic to disable\ + \ security features, conceal malicious activities, or disrupt system operations.\ + \ By monitoring for unusual or unauthorized `rmmod` activity, this analytic helps\ + \ identify potential tampering with kernel modules, enabling security teams to take\ + \ proactive measures to protect system integrity and security." data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=rmmod | stats count min(_time) as firstTime @@ -30,9 +31,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 90 diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 28a4d1b157..5b464a1759 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -35,6 +35,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index 8150211f2f..e32dab4fcb 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -1,17 +1,18 @@ name: Linux Auditd Osquery Service Stop id: 0c320fea-6e87-4b99-a884-74d09d4b655d version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious stopping of the `osquery` service, - which may indicate an attempt to disable monitoring and evade detection. `Osquery` - is a powerful tool used for querying system information and detecting anomalies, and - stopping its service can be a sign that an attacker is trying to disrupt security - monitoring or hide malicious activities. By monitoring for unusual or unauthorized stops - of the `osquery` service, this analytic helps identify potential efforts to bypass security - controls, enabling security teams to investigate and respond to possible threats effectively. +description: The following analytic detects suspicious stopping of the `osquery` service, + which may indicate an attempt to disable monitoring and evade detection. `Osquery` + is a powerful tool used for querying system information and detecting anomalies, + and stopping its service can be a sign that an attacker is trying to disrupt security + monitoring or hide malicious activities. By monitoring for unusual or unauthorized + stops of the `osquery` service, this analytic helps identify potential efforts to + bypass security controls, enabling security teams to investigate and respond to + possible threats effectively. data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | stats count min(_time) @@ -30,9 +31,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 98ae86a1ac..4b1cbba6d5 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access Or Modification Of Sshd Config File id: acb3ea33-70f7-47aa-b335-643b3aebcb2f version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -32,9 +32,10 @@ references: - https://attack.mitre.org/techniques/T1098/004/ tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 6b3a821948..1147cffe7a 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -36,6 +36,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 @@ -60,6 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index a3c26304cb..19d666a77a 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index fb692dc1ca..9f0a3554e8 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File id: fea71cf0-fa10-4ef6-9202-9682b2e0c477 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -34,10 +34,11 @@ references: - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ tags: analytic_story: + - Scheduled Tasks - Linux Privilege Escalation - Linux Persistence Techniques - Linux Living Off The Land - - Scheduled Tasks + - Compromised Linux Host asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index 8ce1a22a29..e83cabb6ee 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -34,6 +34,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 37c17c1fba..22c5240b3f 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -1,17 +1,18 @@ name: Linux Auditd Preload Hijack Via Preload File id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious preload hijacking via the `preload` file, - which may indicate an attacker’s attempt to intercept or manipulate library loading processes. - The `preload` file can be used to force the loading of specific libraries before others, - potentially allowing malicious code to execute or alter application behavior. By monitoring - for unusual or unauthorized modifications to the `preload` file, this analytic helps identify - attempts to hijack preload mechanisms, enabling security teams to investigate and address - potential threats to system integrity and security. +description: "The following analytic detects suspicious preload hijacking via the\ + \ `preload` file, which may indicate an attacker\u2019s attempt to intercept or\ + \ manipulate library loading processes. The `preload` file can be used to force\ + \ the loading of specific libraries before others, potentially allowing malicious\ + \ code to execute or alter application behavior. By monitoring for unusual or unauthorized\ + \ modifications to the `preload` file, this analytic helps identify attempts to\ + \ hijack preload mechanisms, enabling security teams to investigate and address\ + \ potential threats to system integrity and security." data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | stats count min(_time) @@ -30,9 +31,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index afedced865..d5e7f54fc9 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -1,7 +1,7 @@ name: Linux Auditd Service Restarted id: 8eb3e858-18d3-44a4-a514-52cfa39f154a version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -34,12 +34,13 @@ references: tags: analytic_story: - AwfulShred + - Scheduled Tasks - Linux Privilege Escalation - - Linux Living Off The Land - Data Destruction - Linux Persistence Techniques - - Scheduled Tasks + - Linux Living Off The Land - Gomir + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 43e4966d58..1abee15461 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -1,7 +1,7 @@ name: Linux Auditd Service Started id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -32,9 +32,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index f89c95db1a..b3f00ad6f7 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Setuid Using Chmod Utility id: 8230c407-1b47-4d95-ac2e-718bd6381386 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,9 +33,10 @@ references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index df0df0811c..ad5f783716 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Setuid Using Setcap Utility id: 1474459a-302b-4255-8add-d82f96d14cd9 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -36,6 +36,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index 7396707986..d9eda2c39e 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -1,7 +1,7 @@ name: Linux Auditd Shred Overwrite Command id: ce2bde4d-a1d4-4452-8c87-98440e5adfb3 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -34,11 +34,12 @@ references: - https://cert.gov.ua/article/39518 tags: analytic_story: - - Industroyer2 - AwfulShred - Linux Privilege Escalation - Data Destruction - Linux Persistence Techniques + - Industroyer2 + - Compromised Linux Host asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 0f5c062b65..a9495c2713 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -1,7 +1,7 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -32,9 +32,10 @@ references: - https://cert.gov.ua/article/39518 tags: analytic_story: - - AwfulShred - - Data Destruction - Industroyer2 + - Data Destruction + - AwfulShred + - Compromised Linux Host asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index c926954b12..10651ab3bb 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd Sudo Or Su Execution id: 817a5c89-5b92-4818-a22d-aa35e1361afe version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index af315cd7fe..a80b13ec80 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Sysmon Service Stop id: 20901256-633a-40de-8753-7b88811a460f version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -30,9 +30,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index f35a5242de..467d9f53ed 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -1,26 +1,26 @@ name: Linux Auditd System Network Configuration Discovery id: 5db16825-81bd-4923-a8d6-d6a13a59832a version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious system network configuration discovery activities, - which may indicate an adversary's attempt to gather information about the network environment. - Such actions typically involve commands or tools used to identify network interfaces, routing tables, - and active connections. Detecting these activities is crucial, as they often precede more targeted - attacks like lateral movement or data exfiltration. By identifying unusual or unauthorized network - discovery efforts, this analytic helps security teams to swiftly detect and respond to potential +description: The following analytic detects suspicious system network configuration + discovery activities, which may indicate an adversary's attempt to gather information + about the network environment. Such actions typically involve commands or tools + used to identify network interfaces, routing tables, and active connections. Detecting + these activities is crucial, as they often precede more targeted attacks like lateral + movement or data exfiltration. By identifying unusual or unauthorized network discovery + efforts, this analytic helps security teams to swiftly detect and respond to potential reconnaissance operations, mitigating the risk of further compromise. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route") - | bucket _time span=15m - | stats dc(comm) as unique_commands, values(comm) as comm, values(exe) as exe, values(SYSCALL) as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) as pid, count, - min(_time) as firstTime, max(_time) as lastTime by success - | where unique_commands >= 4 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '`linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", + "firewall-cmd", "ufw", "iptables", "ss", "route") | bucket _time span=15m | stats + dc(comm) as unique_commands, values(comm) as comm, values(exe) as exe, values(SYSCALL) + as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) as pid, count, + min(_time) as firstTime, max(_time) as lastTime by success | where unique_commands + >= 4 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_system_network_configuration_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -35,9 +35,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 8fac5695b4..7227761b80 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -1,16 +1,18 @@ name: Linux Auditd Unix Shell Configuration Modification id: 66f737c6-3f7f-46ed-8e9b-cc0e5bf01f04 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious modifications to Unix shell configuration files, - which may indicate an attempt to alter system behavior or gain unauthorized access. - Unix shell configuration files, such as `.bashrc` or `.profile`, control user environment settings and command execution. - Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, - or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, - this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks. +description: The following analytic detects suspicious modifications to Unix shell + configuration files, which may indicate an attempt to alter system behavior or gain + unauthorized access. Unix shell configuration files, such as `.bashrc` or `.profile`, + control user environment settings and command execution. Unauthorized changes to + these files can be used to execute malicious commands, escalate privileges, or hide + malicious activities. By monitoring for unusual or unauthorized modifications to + shell configuration files, this analytic helps identify potential security threats, + allowing security teams to respond quickly and mitigate risks. data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/profile.d", @@ -35,9 +37,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index 9f1c2ace78..9bd1815482 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -1,16 +1,18 @@ name: Linux Auditd Unload Module Via Modprobe id: 90964d6a-4b5f-409a-85bd-95e261e03fe9 version: 1 -date: '2024-08-09' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious use of the `modprobe` command to unload kernel modules, - which may indicate an attempt to disable critical system components or evade detection. The `modprobe` utility - manages kernel modules, and unauthorized unloading of modules can disrupt system security features, remove - logging capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized `modprobe` - operations involving module unloading, this analytic helps identify potential tampering with kernel functionality, - enabling security teams to investigate and address possible threats to system integrity. +description: The following analytic detects suspicious use of the `modprobe` command + to unload kernel modules, which may indicate an attempt to disable critical system + components or evade detection. The `modprobe` utility manages kernel modules, and + unauthorized unloading of modules can disrupt system security features, remove logging + capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized + `modprobe` operations involving module unloading, this analytic helps identify potential + tampering with kernel functionality, enabling security teams to investigate and + address possible threats to system integrity. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, @@ -30,9 +32,10 @@ references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index a2293dce3a..150dac6c61 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -1,17 +1,18 @@ name: Linux Auditd Virtual Disk File And Directory Discovery id: eec78cef-d4c8-4b35-8f5b-6922102a4a41 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious discovery of virtual disk files and directories, - which may indicate an attacker’s attempt to locate and access virtualized storage environments. - Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery - attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring - for unusual or unauthorized searches for virtual disk files and directories, this analytic helps - identify potential reconnaissance activities, enabling security teams to respond promptly and - safeguard against unauthorized access and data breaches. +description: "The following analytic detects suspicious discovery of virtual disk\ + \ files and directories, which may indicate an attacker\u2019s attempt to locate\ + \ and access virtualized storage environments. Virtual disks can contain sensitive\ + \ data or critical system configurations, and unauthorized discovery attempts could\ + \ signify preparatory actions for data exfiltration or further compromise. By monitoring\ + \ for unusual or unauthorized searches for virtual disk files and directories, this\ + \ analytic helps identify potential reconnaissance activities, enabling security\ + \ teams to respond promptly and safeguard against unauthorized access and data breaches." data_source: - Linux Auditd Execve search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, @@ -33,9 +34,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index 3225bd9db1..16dc4a544c 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -1,17 +1,18 @@ name: Linux Auditd Whoami User Discovery id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 version: 1 -date: '2024-08-19' +date: '2024-08-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the suspicious use of the whoami command, - which may indicate an attacker trying to gather information about the current user - account on a compromised system. The whoami command is commonly used to verify user - privileges and identity, especially during initial stages of an attack to assess the - level of access. By monitoring for unusual or unauthorized executions of whoami, - this analytic helps in identifying potential reconnaissance activities, enabling security - teams to take action before the attacker escalates privileges or conducts further malicious operations. +description: The following analytic detects the suspicious use of the whoami command, + which may indicate an attacker trying to gather information about the current user + account on a compromised system. The whoami command is commonly used to verify user + privileges and identity, especially during initial stages of an attack to assess + the level of access. By monitoring for unusual or unauthorized executions of whoami, + this analytic helps in identifying potential reconnaissance activities, enabling + security teams to take action before the attacker escalates privileges or conducts + further malicious operations. data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | stats count @@ -32,9 +33,10 @@ references: - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - Linux Persistence Techniques - - Linux Living Off The Land + - Compromised Linux Host asset_type: Endpoint confidence: 50 impact: 50 diff --git a/stories/compromised_linux_host.yml b/stories/compromised_linux_host.yml new file mode 100644 index 0000000000..7e2902252e --- /dev/null +++ b/stories/compromised_linux_host.yml @@ -0,0 +1,25 @@ +name: Compromised Linux Host +id: d7ea2fc0-3710-4257-b64f-f3c2a6abebd3 +version: 1 +date: '2024-06-25' +author: Teoderick Contreras, Splunk +description: Monitor for activities and techniques associated with Compromised Linux Host attacks. + These include unauthorized access attempts, unusual network traffic patterns, and the presence of + unknown or suspicious processes. Look for unexpected changes in system files, modifications to configuration files, + and the installation of unrecognized software. Pay attention to abnormal resource usage, such as high CPU or memory + consumption. Regularly review logs for signs of privilege escalation or lateral movement, and ensure integrity checks + are in place to detect tampering with critical system components. +narrative: In a tale of digital intrusion, Imagine a system administrator noticing unexpected spikes in network traffic and CPU usage. + Delving deeper, they find unknown processes running and unfamiliar software installed. System files and configurations show + unauthorized modifications, hinting at privilege escalation. Log reviews reveal attempts at lateral movement across the network. + The administrator's vigilance, combined with regular integrity checks, helps uncover and mitigate the threat. This narrative + underscores the importance of monitoring and swift action in maintaining a secure Linux environment. +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From ebf04458c56bbd33a09db6f330fba5503fc0a5a4 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Thu, 29 Aug 2024 13:40:52 +0200 Subject: [PATCH 21/54] Improved how_to_implement --- ...kubernetes_abuse_of_secret_by_unusual_location.yml | 2 ++ ...bernetes_abuse_of_secret_by_unusual_user_agent.yml | 2 ++ ...bernetes_abuse_of_secret_by_unusual_user_group.yml | 2 ++ ...ubernetes_abuse_of_secret_by_unusual_user_name.yml | 2 ++ detections/cloud/kubernetes_access_scanning.yml | 2 ++ ...kubernetes_aws_detect_suspicious_kubectl_calls.yml | 8 ++++++-- .../kubernetes_create_or_update_privileged_pod.yml | 2 ++ detections/cloud/kubernetes_cron_job_creation.yml | 2 ++ detections/cloud/kubernetes_daemonset_deployed.yml | 2 ++ detections/cloud/kubernetes_falco_shell_spawned.yml | 11 ++++++----- detections/cloud/kubernetes_node_port_creation.yml | 2 ++ .../kubernetes_pod_created_in_default_namespace.yml | 2 ++ .../kubernetes_pod_with_host_network_attachment.yml | 2 ++ ...ernetes_scanning_by_unauthenticated_ip_address.yml | 7 ++++++- .../cloud/kubernetes_suspicious_image_pulling.yml | 2 ++ detections/cloud/kubernetes_unauthorized_access.yml | 2 ++ 16 files changed, 44 insertions(+), 8 deletions(-) diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml index d012c1e6ef..0c573114e7 100644 --- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml +++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml @@ -26,6 +26,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml index e26121f0c5..bf02cc46f0 100644 --- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml +++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml @@ -25,6 +25,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml index 6d81b53ba3..a4e2033405 100644 --- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml +++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml @@ -24,6 +24,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml index 5b44d1e7f8..09aa5ce093 100644 --- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml +++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml @@ -25,6 +25,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_access_scanning.yml b/detections/cloud/kubernetes_access_scanning.yml index 55e2362f32..e715e79d09 100644 --- a/detections/cloud/kubernetes_access_scanning.yml +++ b/detections/cloud/kubernetes_access_scanning.yml @@ -26,6 +26,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml index 2c4d27b19c..7b17ca2a8a 100644 --- a/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml +++ b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml @@ -19,8 +19,12 @@ search: '`kube_audit` user.username="system:anonymous" user.groups{} IN ("system requestReceivedTimestamp requestURI responseStatus.code sourceIPs{} stage user.groups{} user.uid user.username userAgent verb | rename sourceIPs{} as src_ip, user.username as user |`kubernetes_aws_detect_suspicious_kubectl_calls_filter`' -how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This - search works with cloudwatch logs. +how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. + Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. + Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. + Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets diff --git a/detections/cloud/kubernetes_create_or_update_privileged_pod.yml b/detections/cloud/kubernetes_create_or_update_privileged_pod.yml index b9f1be1cba..c1548914f4 100644 --- a/detections/cloud/kubernetes_create_or_update_privileged_pod.yml +++ b/detections/cloud/kubernetes_create_or_update_privileged_pod.yml @@ -24,6 +24,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_cron_job_creation.yml b/detections/cloud/kubernetes_cron_job_creation.yml index fd414326bb..afb0a60ad8 100644 --- a/detections/cloud/kubernetes_cron_job_creation.yml +++ b/detections/cloud/kubernetes_cron_job_creation.yml @@ -24,6 +24,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_daemonset_deployed.yml b/detections/cloud/kubernetes_daemonset_deployed.yml index 059055675a..930e108119 100644 --- a/detections/cloud/kubernetes_daemonset_deployed.yml +++ b/detections/cloud/kubernetes_daemonset_deployed.yml @@ -24,6 +24,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_falco_shell_spawned.yml b/detections/cloud/kubernetes_falco_shell_spawned.yml index 71c85b1554..81905e2ade 100644 --- a/detections/cloud/kubernetes_falco_shell_spawned.yml +++ b/detections/cloud/kubernetes_falco_shell_spawned.yml @@ -19,11 +19,12 @@ search: '`kube_container_falco` "A shell was spawned in a container" | fillnull | stats count by container_image container_image_tag container_name parent proc_exepath process user | `kubernetes_falco_shell_spawned_filter`' -how_to_implement: The detection is based on data that originates from Falco, a cloud native runtime security tool. - Falco is designed to detect anomalous activity in your applications and is a crucial component of this detection rule. - To implement this detection rule, you need to install and configure Falco in your Kubernetes environment. - Once Falco is set up, it will monitor the system calls in your Kubernetes infrastructure and generate logs for any suspicious activity. - These logs are then ingested by Splunk for analysis. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. +how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. + Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. + Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. + Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_node_port_creation.yml b/detections/cloud/kubernetes_node_port_creation.yml index 513e043486..b2cfc9d2cd 100644 --- a/detections/cloud/kubernetes_node_port_creation.yml +++ b/detections/cloud/kubernetes_node_port_creation.yml @@ -24,6 +24,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_pod_created_in_default_namespace.yml b/detections/cloud/kubernetes_pod_created_in_default_namespace.yml index c5b94b6782..4ea0899b26 100644 --- a/detections/cloud/kubernetes_pod_created_in_default_namespace.yml +++ b/detections/cloud/kubernetes_pod_created_in_default_namespace.yml @@ -23,6 +23,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_pod_with_host_network_attachment.yml b/detections/cloud/kubernetes_pod_with_host_network_attachment.yml index 763299bf0c..d671a16dd3 100644 --- a/detections/cloud/kubernetes_pod_with_host_network_attachment.yml +++ b/detections/cloud/kubernetes_pod_with_host_network_attachment.yml @@ -24,6 +24,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml b/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml index a94b5cf3fe..5550717c64 100644 --- a/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml +++ b/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml @@ -22,7 +22,12 @@ search: '`kube_audit` "user.groups{}"="system:unauthenticated" "responseStatus.c | where count > 5 | rename sourceIPs{} as src_ip, user.username as user | `kubernetes_scanning_by_unauthenticated_ip_address_filter`' -how_to_implement: You must ingest Kubernetes audit logs. +how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. + Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. + Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. + Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_suspicious_image_pulling.yml b/detections/cloud/kubernetes_suspicious_image_pulling.yml index 4eeaa70812..61e35c50fb 100644 --- a/detections/cloud/kubernetes_suspicious_image_pulling.yml +++ b/detections/cloud/kubernetes_suspicious_image_pulling.yml @@ -25,6 +25,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ diff --git a/detections/cloud/kubernetes_unauthorized_access.yml b/detections/cloud/kubernetes_unauthorized_access.yml index 893a445494..1eb5382e69 100644 --- a/detections/cloud/kubernetes_unauthorized_access.yml +++ b/detections/cloud/kubernetes_unauthorized_access.yml @@ -24,6 +24,8 @@ how_to_implement: The detection is based on data that originates from Kubernetes Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. + When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then + you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/. known_false_positives: unknown references: - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ From 3cf30fca12f4027f2c41c022f603f8adeb4137dd Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Thu, 29 Aug 2024 13:48:23 +0200 Subject: [PATCH 22/54] Improvements AWS ASL detection --- ..._aws_concurrent_sessions_from_different_ips.yml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml index 2edc3ae569..81be1a542e 100644 --- a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml @@ -15,14 +15,12 @@ description: The following analytic identifies an AWS IAM account with concurren to sensitive corporate resources, leading to potential data breaches or further exploitation. data_source: [] -search: ' `amazon_security_lake` api.operation=DescribeEventAggregates "http_request.user_agent"!="AWS Internal" "src_endpoint.domain"!="health.amazonaws.com" -| eval time = time/pow(10,3) -| `security_content_ctime(time)` -| bin span=5m time -| stats values(src_endpoint.ip) as src_ip dc(src_endpoint.ip) as distinct_ip_count values(cloud.region) as cloud.region by time api.operation actor.user.account_uid actor.user.uid -| where distinct_ip_count > 1 -| rename cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id, actor.user.uid as user -| `asl_aws_concurrent_sessions_from_different_ips_filter`' +search: ' `amazon_security_lake` api.operation=DescribeEventAggregates src_endpoint.domain!="AWS Internal" + | bin span=5m _time + | stats values(src_endpoint.ip) as src_endpoint.ip dc(src_endpoint.ip) as distinct_ip_count + by _time identity.user.credential_uid identity.user.name + | where distinct_ip_count > 1 + | `aws_concurrent_sessions_from_different_ips_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or From a27aaff5333b1f9e475ea88c57b2354ec86f213b Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 29 Aug 2024 08:26:15 -0500 Subject: [PATCH 23/54] TR-3868 --- detections/endpoint/excessive_usage_of_taskkill.yml | 4 ---- .../endpoint/windows_disable_or_modify_tools_via_taskkill.yml | 4 ---- 2 files changed, 8 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 06abc48814..e916838efd 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -53,10 +53,6 @@ tags: - T1562.001 - T1562 observable: - - name: dest - type: Endpoint - role: - - Victim - name: dest type: Endpoint role: diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index daf4791997..2b0d48b9a9 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -48,10 +48,6 @@ tags: - T1562 - T1562.001 observable: - - name: dest - type: Endpoint - role: - - Victim - name: dest type: Endpoint role: From 65120c28e0a28b5e25f431617dde107486770841 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Thu, 29 Aug 2024 15:26:54 +0200 Subject: [PATCH 24/54] bug fix --- .../cloud/asl_aws_concurrent_sessions_from_different_ips.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml index 81be1a542e..843d3e54f9 100644 --- a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml @@ -20,7 +20,7 @@ search: ' `amazon_security_lake` api.operation=DescribeEventAggregates src_endpo | stats values(src_endpoint.ip) as src_endpoint.ip dc(src_endpoint.ip) as distinct_ip_count by _time identity.user.credential_uid identity.user.name | where distinct_ip_count > 1 - | `aws_concurrent_sessions_from_different_ips_filter`' + | `asl_aws_concurrent_sessions_from_different_ips_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or From 73c546a54d53ca455b827293fbf136cc34b4e8eb Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 29 Aug 2024 08:26:56 -0500 Subject: [PATCH 25/54] TR-3867 --- .../aws_cloud_provisioning_from_previously_unseen_region.yml | 2 +- .../detect_aws_api_activities_from_unapproved_accounts.yml | 2 +- ...s_pre_authentication_flag_disabled_in_useraccountcontrol.yml | 2 +- .../endpoint/windows_alternate_datastream___base64_content.yml | 2 +- .../windows_alternate_datastream___executable_content.yml | 2 +- .../windows_alternate_datastream___process_execution.yml | 2 +- .../endpoint/windows_uac_bypass_suspicious_child_process.yml | 2 +- .../windows_uac_bypass_suspicious_escalation_behavior.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml index 17c217ab38..f1a7c1ec92 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml @@ -49,7 +49,7 @@ tags: - T1535 observable: - name: user - type: User Name + type: User role: - Victim - name: src_ip diff --git a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml index 81446134ca..39cf8a3869 100644 --- a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml +++ b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml @@ -56,7 +56,7 @@ tags: - T1078.004 observable: - name: user - type: User Name + type: User role: - Victim product: diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 43385ce72c..d66cccde9d 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -38,7 +38,7 @@ tags: - T1558.004 observable: - name: user - type: User Name + type: User role: - Victim product: diff --git a/detections/endpoint/windows_alternate_datastream___base64_content.yml b/detections/endpoint/windows_alternate_datastream___base64_content.yml index 5367f1dac7..e3478f69e7 100644 --- a/detections/endpoint/windows_alternate_datastream___base64_content.yml +++ b/detections/endpoint/windows_alternate_datastream___base64_content.yml @@ -49,7 +49,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: file_name diff --git a/detections/endpoint/windows_alternate_datastream___executable_content.yml b/detections/endpoint/windows_alternate_datastream___executable_content.yml index fe8f8306b1..696ace7ad2 100644 --- a/detections/endpoint/windows_alternate_datastream___executable_content.yml +++ b/detections/endpoint/windows_alternate_datastream___executable_content.yml @@ -44,7 +44,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim diff --git a/detections/endpoint/windows_alternate_datastream___process_execution.yml b/detections/endpoint/windows_alternate_datastream___process_execution.yml index 87fb3f1bde..d094e9df91 100644 --- a/detections/endpoint/windows_alternate_datastream___process_execution.yml +++ b/detections/endpoint/windows_alternate_datastream___process_execution.yml @@ -49,7 +49,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: process_name diff --git a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml index 043391f020..36293207a7 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml @@ -54,7 +54,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: process_name diff --git a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml index e52844bd6f..e661bb5fd5 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml @@ -66,7 +66,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: process_name From 40370bbcf94496cca6494478f4dc8139931fad36 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Thu, 29 Aug 2024 15:31:25 +0200 Subject: [PATCH 26/54] bug fix --- .../cloud/asl_aws_concurrent_sessions_from_different_ips.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml index 843d3e54f9..6cb20deee1 100644 --- a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml @@ -17,9 +17,10 @@ description: The following analytic identifies an AWS IAM account with concurren data_source: [] search: ' `amazon_security_lake` api.operation=DescribeEventAggregates src_endpoint.domain!="AWS Internal" | bin span=5m _time - | stats values(src_endpoint.ip) as src_endpoint.ip dc(src_endpoint.ip) as distinct_ip_count + | stats values(src_endpoint.ip) as src_ip dc(src_endpoint.ip) as distinct_ip_count by _time identity.user.credential_uid identity.user.name | where distinct_ip_count > 1 + | rename identity.user.name as user | `asl_aws_concurrent_sessions_from_different_ips_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, From 72c4ca1f1ed2c27190f43d047154787a1d59c8a1 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Thu, 29 Aug 2024 16:49:29 +0200 Subject: [PATCH 27/54] manual testing --- .../cloud/asl_aws_concurrent_sessions_from_different_ips.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml index 6cb20deee1..48dbeea690 100644 --- a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml @@ -68,6 +68,7 @@ tags: - cloud.region risk_score: 42 security_domain: threat + manual_test: Can't be tested automatically because of time span. tests: - name: True Positive Test attack_data: From 676d1a7e18f8282d55a4d67876b87547f0cc7f89 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Fri, 30 Aug 2024 07:43:21 +0200 Subject: [PATCH 28/54] bump aws ta version --- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- 52 files changed, 52 insertions(+), 52 deletions(-) diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index 2ae90e54e6..3072afe9c4 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -9,7 +9,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 5230cb083b..950c084e69 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -10,5 +10,5 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index c5738f8dee..310c8f6c18 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index cdbe7a49df..96f9e92804 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index b632e6926d..3f2d51f81d 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 71199a2ca4..1039eb23be 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 0470b8cb3b..96991dc1e6 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index abeb97372b..5c7a0eafe2 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index 52a545ca68..95541fa4ab 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 47e1dcbf41..303eb014a6 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index 883dbf7df6..cc50c8c5cc 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 7bbd4c6690..8a4682fa86 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 734e236dca..9710c82d05 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index 98f7b43725..e0110fc907 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index d05dfd1796..738682463b 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index f386f3a8ac..afa67dcffc 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 66f43c2593..ff5a1ea250 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index 2bd9310f35..d8ceeabb9b 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 29c2dd686f..db3537f9bd 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 32d487d65f..58962e5032 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 8f7a92c3e0..11d3a33a40 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 534106dc32..363d322419 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 7012fa6ed9..a3918a3610 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index d857e41e47..3ab3eaf43d 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 45be13588c..b2ca515c08 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 07f58db804..c5cc623566 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 821f144e7f..48f5a3f577 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index a177153e90..2a31e3d682 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 919a2d3be2..48db84fd22 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 831d5975da..d8b9d33380 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 52c3247f8f..a2d51c0989 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 202531ea99..ebf3d788ea 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 16185f9770..0db535958e 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 0c12590897..9be9e2fb97 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 2accf99155..1873888fa1 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index b2bdddff08..e55497168f 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index dc09302ede..b375933610 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 2a31c5adbe..a952b9a63b 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index fc20e9a7aa..c09cb998c7 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index 3a0a6e093c..6dbf254e24 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index b4019b7926..1e078ec5b4 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index 2f99322eba..0c9ac4c1b1 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 28d36464c3..42060d8194 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 4544f65574..9feaa44932 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 6193228164..c06285fa73 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index db15c8e372..c2a6b50c4e 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 6e2cab06ca..43e8359afd 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 0f21f975bb..15561da71c 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 40c704a7be..b3ac874b2f 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index 448209d713..7e840ba557 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -10,7 +10,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 2bf06edc58..c6c83b636c 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -9,7 +9,7 @@ sourcetype: aws:cloudwatchlogs:vpcflow separator: eventName supported_TA: - name: Splunk Add-on for AWS - version: 7.6.0 + version: 7.7.0 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index a37b28ca37..e9c1a8ca4b 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -9,7 +9,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.7.0 fields: - _time - AwsAccountId From b6ade7259fe300fe40747491f58973278a064d25 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 2 Sep 2024 14:59:47 +0200 Subject: [PATCH 29/54] linux_auditd_detection --- .../endpoint/linux_auditd_add_user_account.yml | 6 +++--- .../linux_auditd_at_application_execution.yml | 8 ++++---- .../endpoint/linux_auditd_auditd_service_stop.yml | 8 ++++---- .../endpoint/linux_auditd_base64_decode_files.yml | 8 ++++---- .../linux_auditd_change_file_owner_to_root.yml | 8 ++++---- .../endpoint/linux_auditd_clipboard_data_copy.yml | 8 ++++---- .../linux_auditd_data_destruction_command.yml | 8 ++++---- ...ux_auditd_data_transfer_size_limits_via_split.yml | 12 +++++++----- ...d_data_transfer_size_limits_via_split_syscall.yml | 8 ++++---- ..._auditd_database_file_and_directory_discovery.yml | 8 ++++---- .../endpoint/linux_auditd_dd_file_overwrite.yml | 8 ++++---- ...inux_auditd_disable_or_modify_system_firewall.yml | 8 ++++---- .../linux_auditd_doas_conf_file_creation.yml | 8 ++++---- .../endpoint/linux_auditd_doas_tool_execution.yml | 8 ++++---- .../linux_auditd_edit_cron_table_parameter.yml | 8 ++++---- .../linux_auditd_file_and_directory_discovery.yml | 8 ++++---- ...auditd_file_permission_modification_via_chmod.yml | 8 ++++---- ...ditd_file_permissions_modification_via_chattr.yml | 8 ++++---- ...uditd_find_credentials_from_password_managers.yml | 8 ++++---- ..._auditd_find_credentials_from_password_stores.yml | 8 ++++---- .../endpoint/linux_auditd_find_private_keys.yml | 8 ++++---- .../endpoint/linux_auditd_find_ssh_private_keys.yml | 8 ++++---- .../linux_auditd_hardware_addition_swapoff.yml | 8 ++++---- ..._auditd_hidden_files_and_directories_creation.yml | 8 ++++---- ...itd_insert_kernel_module_using_insmod_utility.yml | 8 ++++---- ..._install_kernel_module_using_modprobe_utility.yml | 8 ++++---- .../linux_auditd_kernel_module_enumeration.yml | 8 ++++---- ...inux_auditd_kernel_module_using_rmmod_utility.yml | 8 ++++---- .../linux_auditd_nopasswd_entry_in_sudoers_file.yml | 8 ++++---- .../endpoint/linux_auditd_osquery_service_stop.yml | 8 ++++---- ...le_access_or_modification_of_sshd_config_file.yml | 8 ++++---- ...ux_auditd_possible_access_to_credential_files.yml | 8 ++++---- .../linux_auditd_possible_access_to_sudoers_file.yml | 8 ++++---- ...append_cronjob_entry_on_existing_cronjob_file.yml | 7 ++++--- .../linux_auditd_preload_hijack_library_calls.yml | 8 ++++---- .../linux_auditd_preload_hijack_via_preload_file.yml | 8 ++++---- .../endpoint/linux_auditd_service_restarted.yml | 8 ++++---- detections/endpoint/linux_auditd_service_started.yml | 8 ++++---- .../linux_auditd_setuid_using_chmod_utility.yml | 8 ++++---- .../linux_auditd_setuid_using_setcap_utility.yml | 8 ++++---- .../linux_auditd_shred_overwrite_command.yml | 8 ++++---- detections/endpoint/linux_auditd_stop_services.yml | 8 ++++---- .../endpoint/linux_auditd_sudo_or_su_execution.yml | 8 ++++---- .../endpoint/linux_auditd_sysmon_service_stop.yml | 8 ++++---- ...auditd_system_network_configuration_discovery.yml | 8 ++++---- ..._auditd_unix_shell_configuration_modification.yml | 8 ++++---- .../linux_auditd_unload_module_via_modprobe.yml | 8 ++++---- ...itd_virtual_disk_file_and_directory_discovery.yml | 8 ++++---- .../endpoint/linux_auditd_whoami_user_discovery.yml | 8 ++++---- 49 files changed, 198 insertions(+), 195 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 35a243b502..743a210ad0 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -14,9 +14,9 @@ description: The following analytic detects the creation of new user accounts on the system, posing a severe security risk. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, "%useradd%") OR LIKE (process_exec, "%adduser%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle | `security_content_ctime(firstTime)`| + max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -43,7 +43,7 @@ tags: - T1136 observable: - name: process_exec - type: Other + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index 0aadf0cd36..fcce76e012 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -17,8 +17,8 @@ description: The following analytic detects the execution of the "At" applicatio data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") - AND NOT (UID IN("daemon")) | stats count min(_time) as firstTime max(_time) as lastTime - by comm exe SYSCALL UID ppid pid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime + by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_at_application_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -47,8 +47,8 @@ tags: - T1053.002 - T1053 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 2c920316fb..27ada7ebed 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -14,8 +14,8 @@ description: The following analytic detects the suspicious auditd service stop. to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe unit | `security_content_ctime(firstTime)` +search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_auditd_service_stop_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -41,8 +41,8 @@ tags: mitre_attack_id: - T1489 observable: - - name: type - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 0b307ba051..1d4c1eae40 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -15,9 +15,9 @@ description: The following analytic detects suspicious Base64 decode operations risks associated with encoded malware or unauthorized data access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, "%base64%") AND (LIKE(process_exec, "%-d %") OR LIKE(process_exec, "% --d%")) | - stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_base64_decode_files_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -44,8 +44,8 @@ tags: mitre_attack_id: - T1140 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 5410314fa4..63c9bb8ff3 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -14,9 +14,9 @@ description: The following analytic detects the use of the 'chown' command to ch host and potential persistence within the environment. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, "%chown %") AND LIKE (process_exec, "% root %") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_change_file_owner_to_root_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -44,8 +44,8 @@ tags: - T1222.002 - T1222 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 813c452001..001fe1c28b 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -14,11 +14,11 @@ description: The following analytic detects the use of the Linux 'xclip' command sensitive information and potentially aiding further attacks within the environment. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -43,8 +43,8 @@ tags: mitre_attack_id: - T1115 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index c3c9b7d176..c254a194c2 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -15,9 +15,9 @@ description: The following analytic detects the execution of a Unix shell comman investigation and response are crucial to mitigate potential damage. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: mitre_attack_id: - T1485 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index 9f18f3ffa1..f64caec546 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -15,9 +15,11 @@ description: The following analytic detects suspicious data transfer activities from the network. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE(process_exec, - "%split %") AND LIKE(process_exec, "% -b %") | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` +search: '`linux_auditd` `linux_auditd_normalized_execve_process` + | rename host as dest + | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") + | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -43,8 +45,8 @@ tags: mitre_attack_id: - T1030 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index cc4217d76e..33a6885e6b 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -15,8 +15,8 @@ description: The following analytic detects suspicious data transfer activities from the network. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | stats count min(_time) - as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | +search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: mitre_attack_id: - T1030 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index 63b611de31..9b7950091e 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -15,7 +15,7 @@ description: "The following analytic detects suspicious database file and direct \ security teams to respond swiftly and mitigate the risk of further compromise." data_source: - Linux Auditd Execve -search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR LIKE (process_exec, "%.mdf%")OR LIKE @@ -23,7 +23,7 @@ search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE LIKE (process_exec, "%.idb%")OR LIKE (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, "%.fpt%")OR LIKE (process_exec, "%.ora%")) - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -50,8 +50,8 @@ tags: mitre_attack_id: - T1083 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index d4fae94e93..a713739cc4 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -14,9 +14,9 @@ description: The following analytic detects the use of the 'dd' command to overw difficult and potentially causing significant operational disruptions. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%dd %") AND LIKE(process_exec, "% of=%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_dd_file_overwrite_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: mitre_attack_id: - T1485 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 875e301732..ea725bf507 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -14,8 +14,8 @@ description: The following analytic detects the suspicious disable or modify sys early is essential to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | stats count - min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit | `security_content_ctime(firstTime)`| +search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_disable_or_modify_system_firewall_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: - T1562.004 - T1562 observable: - - name: type - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 9dbadb1748..0a4bd848f4 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -14,8 +14,8 @@ description: The following analytic detects the creation of the doas.conf file o commands with root privileges, leading to full system compromise. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | stats count min(_time) - as firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| +search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_doas_conf_file_creation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: - T1548.003 - T1548 observable: - - name: name - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 0e6152adf5..f14b17d52e 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -14,8 +14,8 @@ description: The following analytic detects the execution of the 'doas' tool on access, potentially compromising the entire system. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=doas | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)` +search: '`linux_auditd` type=SYSCALL comm=doas | rename host as dest | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_doas_tool_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: - T1548.003 - T1548 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index 44a55edf43..aa80df8ed6 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -15,8 +15,8 @@ description: The following analytic detects the suspicious editing of cron jobs data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN - ("*/crontab")) success=yes AND NOT (UID IN("daemon")) | stats count min(_time) as - firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid | `security_content_ctime(firstTime)` + ("*/crontab")) success=yes AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as + firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_edit_cron_table_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -44,8 +44,8 @@ tags: - T1053.003 - T1053 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index a9c3d69fee..6b053478fd 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -15,7 +15,7 @@ description: The following analytic detects suspicious file and directory discov breaches or unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE (process_exec, "%.jif%")OR LIKE @@ -28,7 +28,7 @@ search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE LIKE (process_exec, "%.wav%")OR LIKE (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats count min(_time) as firstTime max(_time) as lastTime - by argc process_exec | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -55,8 +55,8 @@ tags: mitre_attack_id: - T1083 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index d43c4d6f51..9804a27064 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -15,11 +15,11 @@ description: The following analytic detects suspicious file permission modificat actions on the system. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%chmod%") AND (LIKE(process_exec, "% 777 %") OR LIKE(process_exec, "% 755 %") OR LIKE(process_exec, "%x%") OR LIKE(process_exec, "% 754 %") OR LIKE(process_exec, "% 700 %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec - proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + proctitle dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permission_modification_via_chmod_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -46,8 +46,8 @@ tags: - T1222.002 - T1222 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 32b5b0c9e5..8f918d124f 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -15,9 +15,9 @@ description: The following analytic detects suspicious file permissions modifica associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -44,8 +44,8 @@ tags: - T1222.002 - T1222 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 820a69bf44..df27e4a854 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -15,7 +15,7 @@ description: The following analytic detects suspicious attempts to find credenti further unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, @@ -23,7 +23,7 @@ search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) - as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -51,8 +51,8 @@ tags: - T1555.005 - T1555 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 7c2bb59f58..987080515b 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -15,11 +15,11 @@ description: The following analytic detects suspicious attempts to find credenti data. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime max(_time) as lastTime - by argc process_exec | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -47,8 +47,8 @@ tags: - T1555.005 - T1555 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_find_private_keys.yml index 9037ac0f77..6f5525990d 100644 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_private_keys.yml @@ -15,13 +15,13 @@ description: "The following analytic detects suspicious attempts to find private \ and confidentiality of encrypted information." data_source: - Linux Auditd Execve -search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%")OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_private_keys_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -49,8 +49,8 @@ tags: - T1552.004 - T1552 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index d3b901e6a4..2b2218f676 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -15,11 +15,11 @@ description: "The following analytic detects suspicious attempts to find SSH pri \ access and potential breaches." data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) | stats count min(_time) - as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_ssh_private_keys_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -47,8 +47,8 @@ tags: - T1552.004 - T1552 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index b39fcf05e1..7e43836b72 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -15,9 +15,9 @@ description: The following analytic detects the execution of the "swapoff" comma of memory-based detection mechanisms. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: mitre_attack_id: - T1200 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index f976dbfaa7..9d6a2866ad 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -15,11 +15,11 @@ description: "The following analytic detects suspicious creation of hidden files \ to uncover and address hidden threats effectively." data_source: - Linux Auditd Execve -search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec,"%touch +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -46,8 +46,8 @@ tags: mitre_attack_id: - T1083 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index f9103a4e2b..fdbbf5f1f8 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -15,8 +15,8 @@ description: The following analytic detects the insertion of a Linux kernel modu of the affected system. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=insmod | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)` +search: '`linux_auditd` type=SYSCALL comm=insmod | rename host as dest | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_insert_kernel_module_using_insmod_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -45,8 +45,8 @@ tags: - T1547.006 - T1547 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 9f7ae6d9f0..3a2703f6ce 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -15,8 +15,8 @@ description: The following analytic detects the installation of a Linux kernel m its integrity and security. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=modprobe | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)`| +search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -45,8 +45,8 @@ tags: - T1547.006 - T1547 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml index 5d3b99f9f8..b29ad629e2 100644 --- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -14,8 +14,8 @@ description: The following analytic identifies the use of the 'kmod' process to escalation, persistence, or other malicious actions within the system. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=lsmod | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)`| +search: '`linux_auditd` type=SYSCALL comm=lsmod | rename host as dest | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `linux_auditd_kernel_module_enumeration_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -40,8 +40,8 @@ tags: - T1082 - T1014 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index 20aa3d0ddc..0406085d1d 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -15,8 +15,8 @@ description: "The following analytic detects suspicious use of the `rmmod` utili \ proactive measures to protect system integrity and security." data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=rmmod | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success | `security_content_ctime(firstTime)`| +search: '`linux_auditd` type=SYSCALL comm=rmmod | rename host as dest | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_kernel_module_using_rmmod_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -43,8 +43,8 @@ tags: - T1547.006 - T1547 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 5b464a1759..65a57e3b2f 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -15,9 +15,9 @@ description: The following analytic detects the addition of NOPASSWD entries to and system integrity. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%NOPASSWD%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec - proctitle normalized_proctitle_delimiter | `security_content_ctime(firstTime)`| + proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -44,8 +44,8 @@ tags: - T1548.003 - T1548 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index e32dab4fcb..10a46722d2 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -15,8 +15,8 @@ description: The following analytic detects suspicious stopping of the `osquery` possible threats effectively. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe unit | `security_content_ctime(firstTime)` +search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_osquery_service_stop_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: mitre_attack_id: - T1489 observable: - - name: type - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 4b1cbba6d5..e6aa5054c9 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -15,8 +15,8 @@ description: The following analytic detects suspicious access or modification of escalation, or persistent backdoor access, posing a severe security risk. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | stats count min(_time) - as firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| +search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -44,8 +44,8 @@ tags: - T1098.004 - T1098 observable: - - name: name - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 1147cffe7a..c9ee590e26 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -14,11 +14,11 @@ description: The following analytic detects attempts to access or dump the conte offline cracking, leading to unauthorized access and potential system compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where (LIKE +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE (process_exec, "%shadow%") OR LIKE (process_exec, "%passwd%")) AND (LIKE (process_exec, "%cat %") OR LIKE (process_exec, "%nano %")OR LIKE (process_exec, "%vim %") OR LIKE (process_exec, "%vi %")) | stats count min(_time) as firstTime max(_time) as lastTime - by process_exec proctitle normalized_proctitle_delimiter | `security_content_ctime(firstTime)` + by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_credential_files_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -45,8 +45,8 @@ tags: - T1003.008 - T1003 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 19d666a77a..10365c1938 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -14,8 +14,8 @@ description: The following analytic detects potential access or modification of compromising the security of the targeted host. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/sudoers*" | stats count min(_time) as - firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| +search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats count min(_time) as + firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_sudoers_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -42,8 +42,8 @@ tags: - T1548.003 - T1548 observable: - - name: name - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 9f0a3554e8..336404db50 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -16,7 +16,8 @@ description: The following analytic detects potential tampering with cronjob fil data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") - | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID | + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -47,8 +48,8 @@ tags: - T1053.003 - T1053 observable: - - name: name - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index e83cabb6ee..abc1aff249 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -15,9 +15,9 @@ description: The following analytic detects the use of the LD_PRELOAD environmen maintain long-term access to the system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -43,8 +43,8 @@ tags: - T1574.006 - T1574 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 22c5240b3f..143ed4374d 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -15,8 +15,8 @@ description: "The following analytic detects suspicious preload hijacking via th \ potential threats to system integrity and security." data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | stats count min(_time) - as firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| +search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_via_preload_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -43,8 +43,8 @@ tags: - T1574.006 - T1574 observable: - - name: name - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index d5e7f54fc9..31ff73a755 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -15,10 +15,10 @@ description: The following analytic detects the restarting or re-enabling of ser risks and prevent further compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| where (LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "%restart%") OR LIKE(process_exec, "%reenable%") OR LIKE(process_exec, "%reload%")) | stats count - min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -49,8 +49,8 @@ tags: - T1053.006 - T1053 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 1abee15461..4758e506c4 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -14,10 +14,10 @@ description: The following analytic detects the suspicious service started. This prevent potential security incidents. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where (LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "% start %") OR LIKE(process_exec, "% enable %")) | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter | + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_service_started_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -44,8 +44,8 @@ tags: - T1569.002 - T1569 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index b3f00ad6f7..76f58fd376 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the chmod utility t system functions. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%chmod %") AND (LIKE (process_exec, "% u+s %") OR LIKE (process_exec, "% g+s %") OR LIKE (process_exec, "% 4777 %") OR LIKE (process_exec, "% 4577 %")) | stats count - min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter | + min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_chmod_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -45,8 +45,8 @@ tags: - T1548.001 - T1548 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index ad5f783716..7a3ea48a48 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -15,11 +15,11 @@ description: The following analytic detects the execution of the 'setcap' utilit system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep - %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_setcap_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -45,8 +45,8 @@ tags: - T1548.001 - T1548 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index d9eda2c39e..2dd499f594 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the 'shred' command and data availability. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%shred%") AND (LIKE (process_exec, "%-n%") OR LIKE (process_exec, "%-z%") OR LIKE (process_exec, "%-u%") OR LIKE (process_exec, "%-s%")) | stats count min(_time) - as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_shred_overwrite_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -47,8 +47,8 @@ tags: mitre_attack_id: - T1485 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index a9495c2713..1597d07b2a 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -15,8 +15,8 @@ description: The following analytic detects attempts to stop or clear a service severely impacting system integrity and availability. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP | stats count min(_time) as firstTime max(_time) - as lastTime by type pid UID comm exe | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| +search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) as firstTime max(_time) + as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -43,8 +43,8 @@ tags: mitre_attack_id: - T1489 observable: - - name: type - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index 10651ab3bb..cdd016a735 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -15,9 +15,9 @@ description: The following analytic detects the execution of the "sudo" or "su" or further system compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | where LIKE(process_exec, +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%sudo %") OR LIKE(process_exec, "%su %") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sudo_or_su_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -43,8 +43,8 @@ tags: - T1548.003 - T1548 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index a80b13ec80..a1b256cf6b 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -14,8 +14,8 @@ description: The following analytic detects the suspicious sysmon service stop. to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe unit | `security_content_ctime(firstTime)` +search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sysmon_service_stop_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -41,8 +41,8 @@ tags: mitre_attack_id: - T1489 observable: - - name: type - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 467d9f53ed..47ff4037ee 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -16,10 +16,10 @@ description: The following analytic detects suspicious system network configurat data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", - "firewall-cmd", "ufw", "iptables", "ss", "route") | bucket _time span=15m | stats + "firewall-cmd", "ufw", "iptables", "ss", "route") | bucket _time span=15m | rename host as dest | stats dc(comm) as unique_commands, values(comm) as comm, values(exe) as exe, values(SYSCALL) as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) as pid, count, - min(_time) as firstTime, max(_time) as lastTime by success | where unique_commands + min(_time) as firstTime, max(_time) as lastTime by success dest | where unique_commands >= 4 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_system_network_configuration_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -46,8 +46,8 @@ tags: mitre_attack_id: - T1016 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 7227761b80..c234c577ad 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -20,8 +20,8 @@ search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/ "/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile", "root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc", "/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login", - "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | stats count min(_time) - as firstTime max(_time) as lastTime by name nametype OGID | `security_content_ctime(firstTime)`| + "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unix_shell_configuration_modification_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -49,8 +49,8 @@ tags: - T1546.004 - T1546 observable: - - name: name - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index 9bd1815482..25cd69f7df 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -15,9 +15,9 @@ description: The following analytic detects suspicious use of the `modprobe` com address possible threats to system integrity. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | where LIKE (process_exec, +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)`| + max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unload_module_via_modprobe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -44,8 +44,8 @@ tags: - T1547.006 - T1547 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index 150dac6c61..9a23e7ac66 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -15,10 +15,10 @@ description: "The following analytic detects suspicious discovery of virtual dis \ teams to respond promptly and safeguard against unauthorized access and data breaches." data_source: - Linux Auditd Execve -search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | where (LIKE (process_exec, +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count - min(_time) as firstTime max(_time) as lastTime by argc process_exec | `security_content_ctime(firstTime)` + min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -45,8 +45,8 @@ tags: mitre_attack_id: - T1083 observable: - - name: process_exec - type: Other + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index 16dc4a544c..a89c6f5d99 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -15,8 +15,8 @@ description: The following analytic detects the suspicious use of the whoami com further malicious operations. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | stats count - min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid +search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest success | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_whoami_user_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -44,8 +44,8 @@ tags: mitre_attack_id: - T1033 observable: - - name: comm - type: Other + - name: dest + type: Endpoint role: - Victim product: From c1176e3fcd787fc85319b68f3afe17602dd15847 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 2 Sep 2024 15:17:26 +0200 Subject: [PATCH 30/54] linux_auditd_detection --- detections/endpoint/linux_auditd_add_user_account.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 743a210ad0..6b2850a921 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -42,7 +42,7 @@ tags: - T1136.001 - T1136 observable: - - name: process_exec + - name: dest type: Endpoint role: - Victim From 43675dc5562a8a9a40499f65c97c4dd7a7e87d4b Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 11:32:03 +0530 Subject: [PATCH 31/54] adding data-sources-dependabot --- .github/workflows/datasource-dependabot.yml | 54 ++++++++++++++++++ .github/workflows/update_data_sources_ta.py | 62 +++++++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 .github/workflows/datasource-dependabot.yml create mode 100644 .github/workflows/update_data_sources_ta.py diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml new file mode 100644 index 0000000000..8552c6fb45 --- /dev/null +++ b/.github/workflows/datasource-dependabot.yml @@ -0,0 +1,54 @@ +name: Splunk TA Update + +on: + workflow_dispatch: # Manually trigger the workflow + schedule: + - cron: '55 06 * * *' # Runs daily at midnight + +jobs: + modify-code: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + ref: 'develop' + token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} # Add this line to use the PAT for checkout + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.11' # or the version your script requires + + - name: Install Python Dependencies and ContentCTL and Atomic Red Team + run: | + pip install contentctl>=4.0.0 + git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git + + - name: Run ContentCTL Data source TA validation + run: | + contentctl validate --data-source-TA-validation >> data_source_validation.log + + - name: Check for changes + id: changes + run: | + git fetch origin develop + if git diff --exit-code origin/develop -- configs/attack_range_default.yml; then + echo "No changes detected in configs/attack_range_default.yml compared to develop branch" + echo "changes_detected=false" >> $GITHUB_ENV + else + echo "Changes detected in configs/attack_range_default.yml compared to develop branch" + echo "changes_detected=true" >> $GITHUB_ENV + fi + + - name: Create Pull Request + if: env.changes_detected == 'true' + uses: peter-evans/create-pull-request@v6 + with: + token: ${{ secrets.GH_PAT }} + commit-message: Updated TAs + branch: auto-ta-update-${{ github.run_number }} + base: develop + title: Automated Splunk TA Update ${{ github.run_number }} + body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." \ No newline at end of file diff --git a/.github/workflows/update_data_sources_ta.py b/.github/workflows/update_data_sources_ta.py new file mode 100644 index 0000000000..83239de4bc --- /dev/null +++ b/.github/workflows/update_data_sources_ta.py @@ -0,0 +1,62 @@ +import os +import yaml +from collections import OrderedDict + +# Custom YAML loader to preserve the order of keys +class OrderedLoader(yaml.SafeLoader): + pass + +def construct_mapping(loader, node): + loader.flatten_mapping(node) + return OrderedDict(loader.construct_pairs(node)) + +OrderedLoader.add_constructor( + yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, + construct_mapping +) + +# Custom YAML dumper to preserve the order of keys +class OrderedDumper(yaml.SafeDumper): + pass + +def dict_representer(dumper, data): + return dumper.represent_dict(data.items()) + +OrderedDumper.add_representer(OrderedDict, dict_representer) + +# Define the paths +log_file_path = 'data_source_validation.log' +data_sources_dir = 'data_sources' + +# Read the log file to find version mismatches +with open(log_file_path, 'r') as log_file: + log_lines = log_file.readlines() + +# Parse the log file to find the TA name and the latest version +for i, line in enumerate(log_lines): + if 'Version mismatch' in line: + ta_name = log_lines[i].split("'")[3].strip() + latest_version = log_lines[i + 1].split(':')[1].strip() + print(f"Found version mismatch for TA: {ta_name}, updating to version: {latest_version}") + + # Update the YAML files in the data sources directory + for filename in os.listdir(data_sources_dir): + if filename.endswith('.yml'): + file_path = os.path.join(data_sources_dir, filename) + with open(file_path, 'r') as yml_file: + data = yaml.load(yml_file, Loader=OrderedLoader) + + # Check if the TA name matches and update the version + updated = False + for ta in data.get('supported_TA', []): + if ta['name'] == ta_name: + if ta['version'] != latest_version: + ta['version'] = latest_version + updated = True + + # Write the updated data back to the YAML file + if updated: + with open(file_path, 'w') as yml_file: + yaml.dump(data, yml_file, Dumper=OrderedDumper) + +print("Version updates completed.") \ No newline at end of file From 63d82962a2ba5a6f87c3d044c5b652831a9b7ef2 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 11:36:15 +0530 Subject: [PATCH 32/54] trigger conditions --- .github/workflows/datasource-dependabot.yml | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 8552c6fb45..b19d83f090 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -1,6 +1,9 @@ name: Splunk TA Update on: + push: + branches: + - update_data_sources workflow_dispatch: # Manually trigger the workflow schedule: - cron: '55 06 * * *' # Runs daily at midnight @@ -14,7 +17,7 @@ jobs: uses: actions/checkout@v4 with: ref: 'develop' - token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} # Add this line to use the PAT for checkout + token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} - name: Set up Python uses: actions/setup-python@v5 @@ -27,23 +30,17 @@ jobs: git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git - name: Run ContentCTL Data source TA validation + id: validate run: | contentctl validate --data-source-TA-validation >> data_source_validation.log - - name: Check for changes - id: changes + - name: Update Data Sources if Validation Fails + if: failure() run: | - git fetch origin develop - if git diff --exit-code origin/develop -- configs/attack_range_default.yml; then - echo "No changes detected in configs/attack_range_default.yml compared to develop branch" - echo "changes_detected=false" >> $GITHUB_ENV - else - echo "Changes detected in configs/attack_range_default.yml compared to develop branch" - echo "changes_detected=true" >> $GITHUB_ENV - fi + python .github/workflows/update_data_sources_ta.py - name: Create Pull Request - if: env.changes_detected == 'true' + if: failure() # Only create a PR if the validation step failed uses: peter-evans/create-pull-request@v6 with: token: ${{ secrets.GH_PAT }} From 7cf933cd5c452230c251f6d9c2aae5e558a8ace0 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 11:40:50 +0530 Subject: [PATCH 33/54] updates to name --- .github/workflows/datasource-dependabot.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index b19d83f090..b01dd24669 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -9,7 +9,7 @@ on: - cron: '55 06 * * *' # Runs daily at midnight jobs: - modify-code: + data-source-validation-and-update: runs-on: ubuntu-latest steps: @@ -22,17 +22,19 @@ jobs: - name: Set up Python uses: actions/setup-python@v5 with: - python-version: '3.11' # or the version your script requires + python-version: '3.11' + architecture: 'x64' # or the version your script requires - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | pip install contentctl>=4.0.0 - git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git + - name: Run ContentCTL Data source TA validation id: validate run: | contentctl validate --data-source-TA-validation >> data_source_validation.log + continue-on-error: true - name: Update Data Sources if Validation Fails if: failure() From 2061218e7fbd2b1c69bc08915b6a2c9d5ade7844 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 11:46:02 +0530 Subject: [PATCH 34/54] remove > --- .github/workflows/datasource-dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index b01dd24669..de5525891c 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -33,7 +33,7 @@ jobs: - name: Run ContentCTL Data source TA validation id: validate run: | - contentctl validate --data-source-TA-validation >> data_source_validation.log + contentctl validate --data-source-TA-validation > data_source_validation.log continue-on-error: true - name: Update Data Sources if Validation Fails From b15a7a10be61477f8eacff1485a339b1445ff840 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 11:55:12 +0530 Subject: [PATCH 35/54] remove output --- .github/workflows/datasource-dependabot.yml | 2 +- contentctl | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) create mode 160000 contentctl diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index de5525891c..132760bcef 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -33,7 +33,7 @@ jobs: - name: Run ContentCTL Data source TA validation id: validate run: | - contentctl validate --data-source-TA-validation > data_source_validation.log + contentctl validate --data-source-TA-validation continue-on-error: true - name: Update Data Sources if Validation Fails diff --git a/contentctl b/contentctl new file mode 160000 index 0000000000..b3e7330c2b --- /dev/null +++ b/contentctl @@ -0,0 +1 @@ +Subproject commit b3e7330c2bc71ee5054c8a9bc46f4456c7972d55 From 8a8358a88fa2c6535cec3ad43e41e4fc7cff2223 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 11:58:42 +0530 Subject: [PATCH 36/54] stder --- .github/workflows/datasource-dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 132760bcef..a920f892e2 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -33,7 +33,7 @@ jobs: - name: Run ContentCTL Data source TA validation id: validate run: | - contentctl validate --data-source-TA-validation + contentctl validate --data-source-TA-validation 2>&1 | tee data_source_validation.log continue-on-error: true - name: Update Data Sources if Validation Fails From b8aa86d2cf1185f5f70b3ab6cf2f97e6f4b4fbf4 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:01:20 +0530 Subject: [PATCH 37/54] cat cat --- .github/workflows/datasource-dependabot.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index a920f892e2..eb16b2b62c 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -28,21 +28,18 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | pip install contentctl>=4.0.0 - - name: Run ContentCTL Data source TA validation id: validate run: | contentctl validate --data-source-TA-validation 2>&1 | tee data_source_validation.log - continue-on-error: true + cat data_source_validation.log - name: Update Data Sources if Validation Fails - if: failure() run: | python .github/workflows/update_data_sources_ta.py - name: Create Pull Request - if: failure() # Only create a PR if the validation step failed uses: peter-evans/create-pull-request@v6 with: token: ${{ secrets.GH_PAT }} From 9dbbe3647907714af9e33c1df092f768e84e7599 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:09:14 +0530 Subject: [PATCH 38/54] remove last step for debug --- .github/workflows/datasource-dependabot.yml | 26 +++++++++++++-------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index eb16b2b62c..2b6ee60ac1 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -32,19 +32,25 @@ jobs: - name: Run ContentCTL Data source TA validation id: validate run: | + pw contentctl validate --data-source-TA-validation 2>&1 | tee data_source_validation.log - cat data_source_validation.log + continue-on-error: true + + - name: Print Validation Log + run: cat data_source_validation.log - name: Update Data Sources if Validation Fails run: | + pwd + ls -la .github/workflows/ python .github/workflows/update_data_sources_ta.py - - name: Create Pull Request - uses: peter-evans/create-pull-request@v6 - with: - token: ${{ secrets.GH_PAT }} - commit-message: Updated TAs - branch: auto-ta-update-${{ github.run_number }} - base: develop - title: Automated Splunk TA Update ${{ github.run_number }} - body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." \ No newline at end of file + # - name: Create Pull Request + # uses: peter-evans/create-pull-request@v6 + # with: + # token: ${{ secrets.GH_PAT }} + # commit-message: Updated TAs + # branch: auto-ta-update-${{ github.run_number }} + # base: develop + # title: Automated Splunk TA Update ${{ github.run_number }} + # body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." \ No newline at end of file From 9f11d1adee3997064468d757aacea1cd8bb550d7 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:12:16 +0530 Subject: [PATCH 39/54] pwd --- .github/workflows/datasource-dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 2b6ee60ac1..4053e08728 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -32,7 +32,7 @@ jobs: - name: Run ContentCTL Data source TA validation id: validate run: | - pw + pwd contentctl validate --data-source-TA-validation 2>&1 | tee data_source_validation.log continue-on-error: true From 67f00707ad5983fb3c2459feb4a75e45d0a3922c Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:14:02 +0530 Subject: [PATCH 40/54] branch name shenanigans --- .github/workflows/datasource-dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 4053e08728..261b649566 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -16,7 +16,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 with: - ref: 'develop' + ref: 'update_data_sources' token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} - name: Set up Python From 9d619417b2038100dde9f7c3ced122ddeed72328 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:18:41 +0530 Subject: [PATCH 41/54] git status --- .github/workflows/datasource-dependabot.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 261b649566..59a9ecb1dd 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -44,13 +44,14 @@ jobs: pwd ls -la .github/workflows/ python .github/workflows/update_data_sources_ta.py + git status - # - name: Create Pull Request - # uses: peter-evans/create-pull-request@v6 - # with: - # token: ${{ secrets.GH_PAT }} - # commit-message: Updated TAs - # branch: auto-ta-update-${{ github.run_number }} - # base: develop - # title: Automated Splunk TA Update ${{ github.run_number }} - # body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." \ No newline at end of file + - name: Create Pull Request + uses: peter-evans/create-pull-request@v6 + with: + token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} + commit-message: Updated TAs + branch: auto-ta-update-${{ github.run_number }} + base: develop + title: Automated Splunk TA Update ${{ github.run_number }} + body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." \ No newline at end of file From 18eccfc430ebe17134f1f285c846e2b0db546e32 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:23:58 +0530 Subject: [PATCH 42/54] adding only datasources --- .github/workflows/datasource-dependabot.yml | 4 ++- .github/workflows/datasource-ta-check.yml | 27 --------------------- 2 files changed, 3 insertions(+), 28 deletions(-) delete mode 100644 .github/workflows/datasource-ta-check.yml diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 59a9ecb1dd..115235f5fb 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -54,4 +54,6 @@ jobs: branch: auto-ta-update-${{ github.run_number }} base: develop title: Automated Splunk TA Update ${{ github.run_number }} - body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." \ No newline at end of file + body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." + paths: | + security_content/data_sources/** \ No newline at end of file diff --git a/.github/workflows/datasource-ta-check.yml b/.github/workflows/datasource-ta-check.yml deleted file mode 100644 index 20e50d5841..0000000000 --- a/.github/workflows/datasource-ta-check.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: datasource-ta-check -on: - pull_request_target: - push: - branches: - - develop - -jobs: - datasource-ta-check: - runs-on: ubuntu-latest - continue-on-error: true - steps: - - name: Check out the repository code - uses: actions/checkout@v4 - - - uses: actions/setup-python@v5 - with: - python-version: '3.11' - architecture: 'x64' - - - name: Install Python Dependencies and contentctl - run: | - pip install contentctl>=4.0.0 - - - name: Run datasource TA check - run: | - contentctl validate --data-source-TA-validation \ No newline at end of file From d7e01bd8b9f9a78bdf0d7e517352bee3916a8144 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:29:47 +0530 Subject: [PATCH 43/54] remove an added file --- .github/workflows/datasource-dependabot.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 115235f5fb..730fbde68d 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -27,7 +27,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl>=4.0.0 + pip install "contentctl>=4.0.0" - name: Run ContentCTL Data source TA validation id: validate @@ -37,12 +37,12 @@ jobs: continue-on-error: true - name: Print Validation Log - run: cat data_source_validation.log + run: | + cat data_source_validation.log + rm -f =4.0.0 - name: Update Data Sources if Validation Fails run: | - pwd - ls -la .github/workflows/ python .github/workflows/update_data_sources_ta.py git status From 9d889a265726a37e9f591b3c8487bfdae4f3e4fd Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:30:50 +0530 Subject: [PATCH 44/54] indent --- .github/workflows/datasource-dependabot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 730fbde68d..6a6ecbf1c9 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -38,8 +38,8 @@ jobs: - name: Print Validation Log run: | - cat data_source_validation.log - rm -f =4.0.0 + cat data_source_validation.log + rm -f =4.0.0 - name: Update Data Sources if Validation Fails run: | From aa403af48438b5401039108154e7e686ba44f16c Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 12:35:00 +0530 Subject: [PATCH 45/54] remove prints and change brnach name --- .github/workflows/datasource-dependabot.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 6a6ecbf1c9..b61cf6cdde 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -1,9 +1,6 @@ name: Splunk TA Update on: - push: - branches: - - update_data_sources workflow_dispatch: # Manually trigger the workflow schedule: - cron: '55 06 * * *' # Runs daily at midnight @@ -16,7 +13,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 with: - ref: 'update_data_sources' + ref: 'develop' token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} - name: Set up Python From eeb8a932ac07e6ba1358f57cc64d44f933019a30 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 3 Sep 2024 18:50:47 +0530 Subject: [PATCH 46/54] rm contentctl --- contentctl | 1 - 1 file changed, 1 deletion(-) delete mode 160000 contentctl diff --git a/contentctl b/contentctl deleted file mode 160000 index b3e7330c2b..0000000000 --- a/contentctl +++ /dev/null @@ -1 +0,0 @@ -Subproject commit b3e7330c2bc71ee5054c8a9bc46f4456c7972d55 From df72a5e60520be4077d273167574d3e27372f11e Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 4 Sep 2024 00:29:03 +0530 Subject: [PATCH 47/54] trigger From dafa859f553e6afc4bfb51ed5e3340c93c26638f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 3 Sep 2024 13:03:21 -0600 Subject: [PATCH 48/54] The Haag Element: Breaking Down AA24-241A --- ...ate_local_admin_accounts_using_net_exe.yml | 1 + .../detect_new_local_admin_account.yml | 1 + ...tect_remote_access_software_usage_file.yml | 1 + ...t_remote_access_software_usage_process.yml | 1 + .../disable_defender_antivirus_registry.yml | 1 + .../endpoint/powershell_4104_hunting.yml | 1 + ...powershell_disable_security_monitoring.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 1 + ...s_scheduled_task_from_public_directory.yml | 1 + .../endpoint/windows_abused_web_services.yml | 1 + .../endpoint/windows_create_local_account.yml | 1 + ..._modify_registry_delete_firewall_rules.yml | 1 + ...egistry_to_add_or_modify_firewall_rule.yml | 1 + .../windows_ngrok_reverse_proxy_usage.yml | 1 + ...ws_task_scheduler_event_action_started.yml | 1 + ...rovhost_lolbas_execution_process_spawn.yml | 1 + ...etect_remote_access_software_usage_dns.yml | 1 + ...ntrol_rest_vulnerability_cve_2022_1388.yml | 1 + .../ngrok_reverse_proxy_on_network.yml | 1 + ...vanti_connect_secure_bookmark_endpoint.yml | 1 + .../citrix_adc_exploitation_cve_2023_3519.yml | 1 + ...etect_remote_access_software_usage_url.yml | 1 + ...nect_secure_command_injection_attempts.yml | 1 + ...tem_information_access_via_auth_bypass.yml | 1 + stories/cisa_aa24_241a.yml | 25 +++++++++++++++++++ 25 files changed, 49 insertions(+) create mode 100644 stories/cisa_aa24_241a.yml diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index ba8cbe5360..ef030a83c0 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -37,6 +37,7 @@ tags: - Azorult - CISA AA22-257A - DarkGate Malware + - CISA AA24-241A asset_type: Endpoint confidence: 60 impact: 50 diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 3713d9963f..d347d12505 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -26,6 +26,7 @@ tags: - DHS Report TA18-074A - HAFNIUM Group - CISA AA22-257A + - CISA AA24-241A asset_type: Windows confidence: 70 impact: 60 diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index aaf1b8c515..58187a2203 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -47,6 +47,7 @@ tags: - Command And Control - Ransomware - Gozi Malware + - CISA AA24-241A asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 0ce8bcbe32..4c96567bb5 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -51,6 +51,7 @@ tags: - Command And Control - Ransomware - Gozi Malware + - CISA AA24-241A asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 9ed2c7f702..a0b2e38264 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -35,6 +35,7 @@ tags: analytic_story: - IcedID - Windows Registry Abuse + - CISA AA24-241A asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index e02d365720..7ac3ab7592 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -66,6 +66,7 @@ tags: - Flax Typhoon - CISA AA23-347A - Data Destruction + - CISA AA24-241A asset_type: Endpoint confidence: 100 impact: 80 diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 1cf9ea9210..2a3f2c4fec 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -41,6 +41,7 @@ tags: analytic_story: - Ransomware - Revil Ransomware + - CISA AA24-241A asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index d54251bb8d..1cfac44126 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -64,6 +64,7 @@ tags: - Phemedrone Stealer - ShrinkLocker - MoonPeak + - CISA AA24-241A asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 46b3ca408b..7d0fe2ce97 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -50,6 +50,7 @@ tags: - DarkCrystal RAT - CISA AA23-347A - MoonPeak + - CISA AA24-241A asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/windows_abused_web_services.yml b/detections/endpoint/windows_abused_web_services.yml index 1095d267ba..e4c75832e0 100644 --- a/detections/endpoint/windows_abused_web_services.yml +++ b/detections/endpoint/windows_abused_web_services.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - NjRAT + - CISA AA24-241A asset_type: Endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml index c50b25d2b5..9e51cef468 100644 --- a/detections/endpoint/windows_create_local_account.yml +++ b/detections/endpoint/windows_create_local_account.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Active Directory Password Spraying + - CISA AA24-241A asset_type: Endpoint confidence: 90 impact: 20 diff --git a/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml b/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml index 6cd4fdb20c..b8f2bb0b9b 100644 --- a/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml +++ b/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - ShrinkLocker + - CISA AA24-241A asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml index e55a319353..7aecc13f3f 100644 --- a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml +++ b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - ShrinkLocker + - CISA AA24-241A asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index 8b541cebe7..8bd35aefa4 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -40,6 +40,7 @@ tags: analytic_story: - Reverse Network Proxy - CISA AA22-320A + - CISA AA24-241A asset_type: Endpoint confidence: 100 impact: 50 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index a30da724a5..03e9a04b3b 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -44,6 +44,7 @@ tags: - Data Destruction - Amadey - Scheduled Tasks + - CISA AA24-241A asset_type: Endpoint confidence: 100 impact: 80 diff --git a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml index 2d595d3285..9e44ff5ded 100644 --- a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml @@ -51,6 +51,7 @@ references: tags: analytic_story: - Active Directory Lateral Movement + - CISA AA24-241A asset_type: Endpoint confidence: 60 impact: 90 diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index a48285b7ee..ca583ad547 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -36,6 +36,7 @@ tags: - Insider Threat - Command And Control - Ransomware + - CISA AA24-241A asset_type: Endpoint confidence: 20 impact: 20 diff --git a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml index 2cb77c3b2f..e7d1485054 100644 --- a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml +++ b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - F5 BIG-IP Vulnerability CVE-2022-1388 + - CISA AA24-241A asset_type: Web Server confidence: 70 cve: diff --git a/detections/network/ngrok_reverse_proxy_on_network.yml b/detections/network/ngrok_reverse_proxy_on_network.yml index d1b33bc26b..a2e9843020 100644 --- a/detections/network/ngrok_reverse_proxy_on_network.yml +++ b/detections/network/ngrok_reverse_proxy_on_network.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Reverse Network Proxy - CISA AA22-320A + - CISA AA24-241A asset_type: Endpoint confidence: 100 impact: 50 diff --git a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml index 2ee10a8f52..b397568f3d 100644 --- a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml +++ b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml @@ -37,6 +37,7 @@ tags: - CVE-2024-21887 analytic_story: - Ivanti Connect Secure VPN Vulnerabilities + - CISA AA24-241A asset_type: VPN Appliance atomic_guid: [] confidence: 80 diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml index a7bdea2439..1083aca874 100644 --- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml +++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Citrix Netscaler ADC CVE-2023-3519 + - CISA AA24-241A cve: - CVE-2023-3519 asset_type: Network diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 9e20cc85a2..1b900606b3 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -43,6 +43,7 @@ tags: - Insider Threat - Command And Control - Ransomware + - CISA AA24-241A asset_type: Network confidence: 50 impact: 50 diff --git a/detections/web/ivanti_connect_secure_command_injection_attempts.yml b/detections/web/ivanti_connect_secure_command_injection_attempts.yml index c65d92aa41..f963215ccf 100644 --- a/detections/web/ivanti_connect_secure_command_injection_attempts.yml +++ b/detections/web/ivanti_connect_secure_command_injection_attempts.yml @@ -40,6 +40,7 @@ tags: - CVE-2024-21887 analytic_story: - Ivanti Connect Secure VPN Vulnerabilities + - CISA AA24-241A asset_type: VPN Appliance atomic_guid: [] confidence: 90 diff --git a/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml b/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml index a3724e46c5..f23dc3adc2 100644 --- a/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml +++ b/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml @@ -37,6 +37,7 @@ tags: - CVE-2024-21887 analytic_story: - Ivanti Connect Secure VPN Vulnerabilities + - CISA AA24-241A asset_type: VPN Appliance atomic_guid: [] confidence: 80 diff --git a/stories/cisa_aa24_241a.yml b/stories/cisa_aa24_241a.yml new file mode 100644 index 0000000000..63f341a44f --- /dev/null +++ b/stories/cisa_aa24_241a.yml @@ -0,0 +1,25 @@ +name: CISA AA24-241A +id: f075adb6-76a6-4476-b24a-ce9d471a1bdc +version: 1 +date: '2024-09-03' +author: Michael Haag, Splunk +description: This story covers the tactics of Iran-based cyber actors exploiting U.S. and foreign organizations across multiple sectors, as detailed in CISA Alert AA24-241A. It focuses on their methods of gaining initial access, establishing persistence, and enabling ransomware attacks through vulnerabilities in public-facing networking devices. +narrative: As of August 2024, Iran-based cyber actors continue to exploit organizations across several U.S. sectors and other countries. The FBI assesses that a significant percentage of these operations aim to obtain network access for collaboration with ransomware affiliates. The actors typically use Shodan to identify vulnerable devices, then exploit public-facing networking equipment such as Citrix Netscaler, F5 BIG-IP, and various VPNs. They deploy webshells, create local accounts, and manipulate existing ones to maintain access. Post-exploitation, they repurpose credentials, disable security software, and use remote access tools. The group collaborates with ransomware affiliates like NoEscape, Ransomhouse, and ALPHV, actively participating in network lockdowns and extortion strategies. Defenders should prioritize patching public-facing devices, monitoring for unauthorized accounts and suspicious PowerShell activity, implementing strong access controls, and regularly reviewing logs for signs of compromise. +references: + - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a + - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41 +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + cve: + - CVE-2024-24919 + - CVE-2024-3400 + - CVE-2019-19781 + - CVE-2023-3519 + - CVE-2022-1388 + - CVE-2024-21887 \ No newline at end of file From 66b2576b06535f8f91b3549785b86d52f5c7330c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 3 Sep 2024 13:58:54 -0600 Subject: [PATCH 49/54] two new analytics --- ...ows_dism_install_powershell_web_access.yml | 70 +++++++++++++++++++ .../windows_enable_powershell_web_access.yml | 57 +++++++++++++++ 2 files changed, 127 insertions(+) create mode 100644 detections/endpoint/windows_dism_install_powershell_web_access.yml create mode 100644 detections/endpoint/windows_enable_powershell_web_access.yml diff --git a/detections/endpoint/windows_dism_install_powershell_web_access.yml b/detections/endpoint/windows_dism_install_powershell_web_access.yml new file mode 100644 index 0000000000..bed78829ac --- /dev/null +++ b/detections/endpoint/windows_dism_install_powershell_web_access.yml @@ -0,0 +1,70 @@ +name: Windows DISM Install PowerShell Web Access +id: fa6142a7-c364-4d11-9954-895dd9efb2d4 +version: 1 +date: '2024-09-03' +author: Michael Haag, Splunk +data_sources: +- Windows Event Log Security 4688 +- Sysmon EventID 1 +type: TTP +status: production +description: The following analytic detects the installation of PowerShell Web Access using the Deployment Image Servicing and Management (DISM) tool. It leverages Sysmon Event ID 1 to identify the execution of `dism.exe` with specific parameters related to enabling the WindowsPowerShellWebAccess feature. This activity is significant because enabling PowerShell Web Access can facilitate remote execution of PowerShell commands, potentially allowing an attacker to gain unauthorized access to systems and networks. If confirmed malicious, this action could lead to further exploitation and compromise of the affected system. +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes + where Processes.process_name=dism.exe + (Processes.process="*WindowsPowerShellWebAccess*" AND Processes.process="*/online*" AND Processes.process="*/enable-feature*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_dism_install_powershell_web_access_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators using the DISM tool to update and install Windows features may cause false positives that can be filtered with `windows_dism_install_powershell_web_access_filter`. +references: +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a +- https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41 +tags: + analytic_story: + - CISA AA24-241A + asset_type: Endpoint + confidence: 80 + impact: 90 + message: PowerShell Web Access has been installed on $dest$. + mitre_attack_id: + - T1548.002 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - user + - parent_process_name + - process_name + - original_file_name + - process + - process_id + - parent_process_id + risk_score: 72 + security_domain: endpoint + cve: [] +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/dism_pswa_4688_windows-security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/detections/endpoint/windows_enable_powershell_web_access.yml b/detections/endpoint/windows_enable_powershell_web_access.yml new file mode 100644 index 0000000000..4725b38add --- /dev/null +++ b/detections/endpoint/windows_enable_powershell_web_access.yml @@ -0,0 +1,57 @@ +name: Windows Enable PowerShell Web Access +id: 175bb2de-6227-416b-9678-9b61999cd21f +version: 1 +date: '2024-09-03' +author: Michael Haag, Splunk +data_sources: + - Powershell Script Block Logging 4104 +type: TTP +status: production +description: The following analytic detects the enabling of PowerShell Web Access via PowerShell commands. It leverages PowerShell script block logging (EventCode 4104) to identify the execution of the `Install-WindowsFeature` cmdlet with the `WindowsPowerShellWebAccess` parameter. This activity is significant because enabling PowerShell Web Access can facilitate remote execution of PowerShell commands, potentially allowing an attacker to gain unauthorized access to systems and networks. +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Install-WindowsFeature*WindowsPowerShellWebAccess*","*Install-PswaWebApplication*","*Add-PswaAuthorizationRule*UserName *ComputerName *") + | rename Computer as dest + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_enable_powershell_web_access_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: It is possible that legitimate scripts or network administrators + may enable PowerShell Web Access. Monitor and escalate as needed. +references: +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a +- https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41 +tags: + analytic_story: + - CISA AA24-241A + - Malicious PowerShell + asset_type: Endpoint + confidence: 80 + impact: 90 + message: PowerShell Web Access has been enabled on $dest$. + mitre_attack_id: + - T1059.001 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ScriptBlockText + - dest + - UserID + risk_score: 72 + security_domain: endpoint + cve: [] +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pswa_powershell.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational From 3df08f2db0a668d9c7034bc8b7f1da57432b737c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 3 Sep 2024 14:12:12 -0600 Subject: [PATCH 50/54] fix --- .../endpoint/windows_dism_install_powershell_web_access.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_dism_install_powershell_web_access.yml b/detections/endpoint/windows_dism_install_powershell_web_access.yml index bed78829ac..a8d8e8c986 100644 --- a/detections/endpoint/windows_dism_install_powershell_web_access.yml +++ b/detections/endpoint/windows_dism_install_powershell_web_access.yml @@ -15,6 +15,7 @@ search: ' | tstats `security_content_summariesonly` count min(_time) as firstTim (Processes.process="*WindowsPowerShellWebAccess*" AND Processes.process="*/online*" AND Processes.process="*/enable-feature*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dism_install_powershell_web_access_filter`' From 95559144fc32c8b608a9e45127a8ac10e13b9e5e Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 4 Sep 2024 11:10:43 +0200 Subject: [PATCH 51/54] linux_auditd_detection --- .../linux_auditd_add_user_account.yml | 29 ++++++----- .../linux_auditd_add_user_account_type.yml | 24 +++++---- .../linux_auditd_at_application_execution.yml | 26 +++++----- .../linux_auditd_auditd_service_stop.yml | 27 +++++----- .../linux_auditd_base64_decode_files.yml | 29 ++++++----- ...linux_auditd_change_file_owner_to_root.yml | 29 ++++++----- .../linux_auditd_clipboard_data_copy.yml | 32 ++++++------ .../linux_auditd_data_destruction_command.yml | 29 ++++++----- ...td_data_transfer_size_limits_via_split.yml | 30 +++++------ ...transfer_size_limits_via_split_syscall.yml | 27 +++++----- ..._database_file_and_directory_discovery.yml | 41 ++++++++------- .../linux_auditd_dd_file_overwrite.yml | 29 ++++++----- ...ditd_disable_or_modify_system_firewall.yml | 27 +++++----- .../linux_auditd_doas_conf_file_creation.yml | 27 +++++----- .../linux_auditd_doas_tool_execution.yml | 27 +++++----- ...linux_auditd_edit_cron_table_parameter.yml | 27 +++++----- ...ux_auditd_file_and_directory_discovery.yml | 50 ++++++++++--------- ...file_permission_modification_via_chmod.yml | 32 ++++++------ ...le_permissions_modification_via_chattr.yml | 29 ++++++----- ...ind_credentials_from_password_managers.yml | 41 ++++++++------- ..._find_credentials_from_password_stores.yml | 32 ++++++------ .../linux_auditd_find_private_keys.yml | 36 ++++++------- .../linux_auditd_find_ssh_private_keys.yml | 33 ++++++------ ...linux_auditd_hardware_addition_swapoff.yml | 29 ++++++----- ..._hidden_files_and_directories_creation.yml | 33 ++++++------ ...ert_kernel_module_using_insmod_utility.yml | 27 +++++----- ...l_kernel_module_using_modprobe_utility.yml | 27 +++++----- ...linux_auditd_kernel_module_enumeration.yml | 27 +++++----- ...ditd_kernel_module_using_rmmod_utility.yml | 27 +++++----- ..._auditd_nopasswd_entry_in_sudoers_file.yml | 29 ++++++----- .../linux_auditd_osquery_service_stop.yml | 27 +++++----- ...ss_or_modification_of_sshd_config_file.yml | 27 +++++----- ...td_possible_access_to_credential_files.yml | 33 ++++++------ ...auditd_possible_access_to_sudoers_file.yml | 26 +++++----- ...cronjob_entry_on_existing_cronjob_file.yml | 26 +++++----- ...ux_auditd_preload_hijack_library_calls.yml | 28 ++++++----- ...auditd_preload_hijack_via_preload_file.yml | 27 +++++----- .../linux_auditd_service_restarted.yml | 31 ++++++------ .../endpoint/linux_auditd_service_started.yml | 31 ++++++------ ...inux_auditd_setuid_using_chmod_utility.yml | 31 ++++++------ ...nux_auditd_setuid_using_setcap_utility.yml | 33 ++++++------ .../linux_auditd_shred_overwrite_command.yml | 31 ++++++------ .../endpoint/linux_auditd_stop_services.yml | 26 +++++----- .../linux_auditd_sudo_or_su_execution.yml | 29 ++++++----- .../linux_auditd_sysmon_service_stop.yml | 27 +++++----- ...system_network_configuration_discovery.yml | 30 +++++------ ..._unix_shell_configuration_modification.yml | 27 +++++----- ...inux_auditd_unload_module_via_modprobe.yml | 29 ++++++----- ...tual_disk_file_and_directory_discovery.yml | 31 ++++++------ .../linux_auditd_whoami_user_discovery.yml | 26 +++++----- 50 files changed, 811 insertions(+), 677 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 6b2850a921..1aaf58d8f1 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -1,7 +1,7 @@ name: Linux Auditd Add User Account id: aae66dc0-74b4-4807-b480-b35f8027abb4 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,17 +14,20 @@ description: The following analytic detects the creation of new user accounts on the system, posing a severe security risk. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, - "%useradd%") OR LIKE (process_exec, "%adduser%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as + dest | where LIKE (process_exec, "%useradd%") OR LIKE (process_exec, "%adduser%") + | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_add_user_account_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -37,7 +40,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1136.001 - T1136 diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 01dd06178e..93e4666efa 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -1,7 +1,7 @@ name: Linux Auditd Add User Account Type id: f8c325ea-506e-4105-8ccf-da1492e90115 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,16 +14,18 @@ description: The following analytic detects the suspicious add user account type early is essential to prevent potential security incidents. data_source: - Linux Auditd Add User -search: ' `linux_auditd` type=ADD_USER | stats count min(_time) as firstTime max(_time) - as lastTime by exe pid hostname res UID type | `security_content_ctime(firstTime)` +search: ' `linux_auditd` type=ADD_USER | rename hostname as dest| stats count min(_time) + as firstTime max(_time) as lastTime by exe pid dest res UID type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_type_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -37,7 +39,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a $type$ added on host. + message: New [$type$] event on host - [$dest$]. mitre_attack_id: - T1136 - T1136.001 diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index fcce76e012..c2813ae768 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd At Application Execution id: 9f306e0a-1c36-469e-8892-968ca12470dd version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -17,16 +17,18 @@ description: The following analytic detects the execution of the "At" applicatio data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") - AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime - by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_at_application_execution_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. + AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_at_application_execution_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -42,7 +44,7 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1053.002 - T1053 diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 27ada7ebed..14e3ceb4a2 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Auditd Service Stop id: 6cb9d0e1-eabe-41de-a11a-5efade354e9d version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,16 +14,19 @@ description: The following analytic detects the suspicious auditd service stop. to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_auditd_service_stop_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_auditd_service_stop_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -37,7 +40,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a $type$ event occured on host. + message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 1d4c1eae40..77ae2394c1 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -1,7 +1,7 @@ name: Linux Auditd Base64 Decode Files id: 5890ba10-4e48-4dc0-8a40-3e1ebe75e737 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,17 +15,20 @@ description: The following analytic detects suspicious Base64 decode operations risks associated with encoded malware or unauthorized data access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, - "%base64%") AND (LIKE(process_exec, "%-d %") OR LIKE(process_exec, "% --d%")) | - stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_base64_decode_files_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where LIKE(process_exec, "%base64%") AND (LIKE(process_exec, "%-d %") OR + LIKE(process_exec, "% --d%")) | stats count min(_time) as firstTime max(_time) as + lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_base64_decode_files_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -40,7 +43,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1140 observable: diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 63c9bb8ff3..540f551fb1 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -1,7 +1,7 @@ name: Linux Auditd Change File Owner To Root id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,17 +14,20 @@ description: The following analytic detects the use of the 'chown' command to ch host and potential persistence within the environment. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, - "%chown %") AND LIKE (process_exec, "% root %") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_change_file_owner_to_root_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as + dest | where LIKE (process_exec, "%chown %") AND LIKE (process_exec, "% root %") + | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle + normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_change_file_owner_to_root_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -39,7 +42,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1222.002 - T1222 diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 001fe1c28b..63dcf8f640 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -1,7 +1,7 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,19 +14,21 @@ description: The following analytic detects the use of the Linux 'xclip' command sensitive information and potentially aiding further attacks within the environment. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, - "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") - OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, - "%sel %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_clipboard_data_copy_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") + OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, + "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed. references: @@ -39,7 +41,7 @@ tags: asset_type: Endpoint confidence: 40 impact: 40 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1115 observable: diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index c254a194c2..2d30a2d070 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -1,7 +1,7 @@ name: Linux Auditd Data Destruction Command id: 4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,17 +15,20 @@ description: The following analytic detects the execution of a Unix shell comman investigation and response are crucial to mitigate potential damage. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, - "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND + LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: unknown references: - https://cert.gov.ua/article/3718487 @@ -38,7 +41,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 100 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1485 observable: diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index f64caec546..5998085cd7 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -1,7 +1,7 @@ name: Linux Auditd Data Transfer Size Limits Via Split id: 4669561d-3bbd-44e3-857c-0e3c6ef2120c version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,19 +15,19 @@ description: The following analytic detects suspicious data transfer activities from the network. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` - | rename host as dest - | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") | stats + count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -41,7 +41,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1030 observable: diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index 33a6885e6b..887e3147fd 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -1,7 +1,7 @@ name: Linux Auditd Data Transfer Size Limits Via Split Syscall id: c03d4a49-cf9d-435b-86e9-c6f8c9b6c42e version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,16 +15,19 @@ description: The following analytic detects suspicious data transfer activities from the network. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | rename host as + dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL + UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -38,7 +41,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1030 observable: diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index 9b7950091e..ba8bb7d272 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -1,7 +1,7 @@ name: Linux Auditd Database File And Directory Discovery id: f616c4f3-bde9-41cf-856c-019b65f668bb version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,23 +15,26 @@ description: "The following analytic detects suspicious database file and direct \ security teams to respond swiftly and mitigate the risk of further compromise." data_source: - Linux Auditd Execve -search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, - "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.db%") OR - LIKE (process_exec, "%.sql%") OR LIKE (process_exec, "%.sqlite%") OR LIKE (process_exec, - "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR LIKE (process_exec, "%.mdf%")OR LIKE - (process_exec, "%.ndf%")OR LIKE (process_exec, "%.ldf%")OR LIKE (process_exec, "%.frm%")OR - LIKE (process_exec, "%.idb%")OR LIKE (process_exec, "%.myd%")OR LIKE (process_exec, - "%.myi%")OR LIKE (process_exec, "%.dbf%")OR LIKE (process_exec, "%.db2%")OR LIKE - (process_exec, "%.dbc%")OR LIKE (process_exec, "%.fpt%")OR LIKE (process_exec, "%.ora%")) - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, + "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR + LIKE (process_exec, "%.mdf%")OR LIKE (process_exec, "%.ndf%")OR LIKE (process_exec, + "%.ldf%")OR LIKE (process_exec, "%.frm%")OR LIKE (process_exec, "%.idb%")OR LIKE + (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR + LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, + "%.fpt%")OR LIKE (process_exec, "%.ora%")) | stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -46,7 +49,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1083 observable: diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index a713739cc4..9a2821d038 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -1,7 +1,7 @@ name: Linux Auditd Dd File Overwrite id: d1b74420-4cea-4752-a123-9b40dfcca49a version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,17 +14,20 @@ description: The following analytic detects the use of the 'dd' command to overw difficult and potentially causing significant operational disruptions. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, - "%dd %") AND LIKE(process_exec, "% of=%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_dd_file_overwrite_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE(process_exec, "%dd %") AND LIKE(process_exec, "% of=%") | stats + count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_dd_file_overwrite_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -38,7 +41,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1485 observable: diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index ea725bf507..22686f05a0 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -1,7 +1,7 @@ name: Linux Auditd Disable Or Modify System Firewall id: 07052556-d4b5-4bae-89aa-cbdc1bb11250 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,16 +14,19 @@ description: The following analytic detects the suspicious disable or modify sys early is essential to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | rename host as dest | stats count - min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_disable_or_modify_system_firewall_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | rename host + as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid + UID comm exe unit dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_disable_or_modify_system_firewall_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -37,7 +40,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: a firewall $type$ event occured on host. + message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. mitre_attack_id: - T1562.004 - T1562 diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 0a4bd848f4..97ff9ee566 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Auditd Doas Conf File Creation id: 61059783-574b-40d2-ac2f-69b898afd6b4 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,16 +14,19 @@ description: The following analytic detects the creation of the doas.conf file o commands with root privileges, leading to full system compromise. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_doas_conf_file_creation_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest | + stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_doas_conf_file_creation_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -37,7 +40,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: a $PATH$ has been accessed/modified on host. + message: A [$PATH$] has been accessed/modified on host - [$dest$]. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index f14b17d52e..4f76f80446 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd Doas Tool Execution id: 91b8ca78-f205-4826-a3ef-cd8d6b24e97b version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,16 +14,19 @@ description: The following analytic detects the execution of the 'doas' tool on access, potentially compromising the entire system. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=doas | rename host as dest | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_doas_tool_execution_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SYSCALL comm=doas | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_doas_tool_execution_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -37,7 +40,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index aa80df8ed6..c8f35c9835 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -1,7 +1,7 @@ name: Linux Auditd Edit Cron Table Parameter id: f4bb7321-7e64-4d1e-b1aa-21f8b019a91f version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,16 +15,19 @@ description: The following analytic detects the suspicious editing of cron jobs data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN - ("*/crontab")) success=yes AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as - firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_edit_cron_table_parameter_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. + ("*/crontab")) success=yes AND NOT (UID IN("daemon")) | rename host as dest | stats + count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid + pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_edit_cron_table_parameter_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -39,7 +42,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1053.003 - T1053 diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 6b053478fd..e91012ef2e 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -1,7 +1,7 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,28 +15,30 @@ description: The following analytic detects suspicious file and directory discov breaches or unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, - "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.tif%") OR - LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, "%.gif%") OR LIKE (process_exec, - "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE (process_exec, "%.jif%")OR LIKE - (process_exec, "%.jfif%")OR LIKE (process_exec, "%.jp2%")OR LIKE (process_exec, - "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE (process_exec, "%.j2c%")OR LIKE - (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR LIKE (process_exec, "%.png%")OR - LIKE (process_exec, "%.flv%") OR LIKE (process_exec, "%.pdf%")OR LIKE (process_exec, - "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE (process_exec, "%.gifv%")OR LIKE - (process_exec, "%.avi%")OR LIKE (process_exec, "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR - LIKE (process_exec, "%.wav%")OR LIKE (process_exec, "%.doc%")OR LIKE (process_exec, - "%.docx%")OR LIKE (process_exec, "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE - (process_exec, "%.svg%")) | stats count min(_time) as firstTime max(_time) as lastTime - by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_file_and_directory_discovery_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, + "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE + (process_exec, "%.jif%")OR LIKE (process_exec, "%.jfif%")OR LIKE (process_exec, + "%.jp2%")OR LIKE (process_exec, "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE + (process_exec, "%.j2c%")OR LIKE (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR + LIKE (process_exec, "%.png%")OR LIKE (process_exec, "%.flv%") OR LIKE (process_exec, + "%.pdf%")OR LIKE (process_exec, "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE + (process_exec, "%.gifv%")OR LIKE (process_exec, "%.avi%")OR LIKE (process_exec, + "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR LIKE (process_exec, "%.wav%")OR LIKE + (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, + "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats + count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -51,7 +53,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1083 observable: diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index 9804a27064..1cb12a9493 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -1,7 +1,7 @@ name: Linux Auditd File Permission Modification Via Chmod id: 5f1d2ea7-eec0-4790-8b24-6875312ad492 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,19 +15,21 @@ description: The following analytic detects suspicious file permission modificat actions on the system. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, - "%chmod%") AND (LIKE(process_exec, "% 777 %") OR LIKE(process_exec, "% 755 %") OR - LIKE(process_exec, "%x%") OR LIKE(process_exec, "% 754 %") OR LIKE(process_exec, - "% 700 %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec - proctitle dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_file_permission_modification_via_chmod_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE(process_exec, "%chmod%") AND (LIKE(process_exec, "% 777 %") + OR LIKE(process_exec, "% 755 %") OR LIKE(process_exec, "%x%") OR LIKE(process_exec, + "% 754 %") OR LIKE(process_exec, "% 700 %")) | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_file_permission_modification_via_chmod_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -41,7 +43,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1222.002 - T1222 diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 8f918d124f..46d62934cf 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,7 +1,7 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,17 +15,20 @@ description: The following analytic detects suspicious file permissions modifica associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, - "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") + | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle + normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_file_permissions_modification_via_chattr_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -39,7 +42,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1222.002 - T1222 diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index df27e4a854..5ce6125368 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,7 +1,7 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,23 +15,26 @@ description: The following analytic detects suspicious attempts to find credenti further unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, - "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") - OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") - OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, - "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR - LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, - "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR - LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) - as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, + "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR + LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE + (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, + "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR + LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, + "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc + process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_find_credentials_from_password_managers_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -46,7 +49,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1555.005 - T1555 diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 987080515b..940206c8a2 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -1,7 +1,7 @@ name: Linux Auditd Find Credentials From Password Stores id: 4de73044-9a1d-4a51-a1c2-85267d8dcab3 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,19 +15,21 @@ description: The following analytic detects suspicious attempts to find credenti data. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, - "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") - OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE - (process_exec, "%creds%")) | stats count min(_time) as firstTime max(_time) as lastTime - by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_find_credentials_from_password_stores_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, + "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -42,7 +44,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1555.005 - T1555 diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_find_private_keys.yml index 6f5525990d..a750c463b6 100644 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_private_keys.yml @@ -1,7 +1,7 @@ name: Linux Auditd Find Private Keys id: 80bb9988-190b-4ee0-a3c3-509545a8f678 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,21 +15,23 @@ description: "The following analytic detects suspicious attempts to find private \ and confidentiality of encrypted information." data_source: - Linux Auditd Execve -search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, - "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR - LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, - "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE - (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%")OR LIKE (process_exec, - "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_find_private_keys_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, + "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE + (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, + "%.p12%")OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats + count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_private_keys_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -44,7 +46,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1552.004 - T1552 diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 2b2218f676..760d29d173 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -1,7 +1,7 @@ name: Linux Auditd Find Ssh Private Keys id: e2d2bd10-dcd1-4b2f-8a76-0198eab32ba5 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,19 +15,22 @@ description: "The following analytic detects suspicious attempts to find SSH pri \ access and potential breaches." data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, - "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%id_rsa%") - OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, - "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) | stats count min(_time) - as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_find_ssh_private_keys_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, + "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) + | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_find_ssh_private_keys_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -42,7 +45,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1552.004 - T1552 diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index 7e43836b72..cba79369c3 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -1,7 +1,7 @@ name: Linux Auditd Hardware Addition Swapoff id: 5728bb16-1a0b-4b66-bce2-0074ac839770 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,17 +15,20 @@ description: The following analytic detects the execution of the "swapoff" comma of memory-based detection mechanisms. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, - "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") + | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle + normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_hardware_addition_swapoff_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed. references: @@ -38,7 +41,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1200 observable: diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index 9d6a2866ad..d5ba8f05bb 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,7 +1,7 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,19 +15,22 @@ description: "The following analytic detects suspicious creation of hidden files \ to uncover and address hidden threats effectively." data_source: - Linux Auditd Execve -search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec,"%touch - %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi - %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE - (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR + LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano + %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," + /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_hidden_files_and_directories_creation_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -42,7 +45,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1083 observable: diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index fdbbf5f1f8..20d20b4efa 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Insert Kernel Module Using Insmod Utility id: bc0ca53f-dea6-4906-9b12-09c396fdf1d3 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,16 +15,19 @@ description: The following analytic detects the insertion of a Linux kernel modu of the affected system. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=insmod | rename host as dest | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_insert_kernel_module_using_insmod_utility_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SYSCALL comm=insmod | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_insert_kernel_module_using_insmod_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -40,7 +43,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1547.006 - T1547 diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 3a2703f6ce..bb05c6d634 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Install Kernel Module Using Modprobe Utility id: 95165985-ace5-4d42-9c42-93a89a5af901 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,16 +15,19 @@ description: The following analytic detects the installation of a Linux kernel m its integrity and security. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -40,7 +43,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1547.006 - T1547 diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml index b29ad629e2..1cd842bb29 100644 --- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -1,7 +1,7 @@ name: Linux Auditd Kernel Module Enumeration id: d1b088de-c47a-4572-9339-bdcc26493b32 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,16 +14,19 @@ description: The following analytic identifies the use of the 'kmod' process to escalation, persistence, or other malicious actions within the system. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=lsmod | rename host as dest | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `linux_auditd_kernel_module_enumeration_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SYSCALL comm=lsmod | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `linux_auditd_kernel_module_enumeration_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: @@ -35,7 +38,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 30 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1082 - T1014 diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index 0406085d1d..3c9a38ea97 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Kernel Module Using Rmmod Utility id: 31810b7a-0abe-42be-a210-0dec8106afee version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,16 +15,19 @@ description: "The following analytic detects suspicious use of the `rmmod` utili \ proactive measures to protect system integrity and security." data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=rmmod | rename host as dest | stats count min(_time) as firstTime - max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_kernel_module_using_rmmod_utility_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SYSCALL comm=rmmod | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_kernel_module_using_rmmod_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -38,7 +41,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 90 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1547.006 - T1547 diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 65a57e3b2f..b7a4578b8b 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,17 +15,20 @@ description: The following analytic detects the addition of NOPASSWD entries to and system integrity. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, - "%NOPASSWD%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec - proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE (process_exec, "%NOPASSWD%") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -39,7 +42,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index 10a46722d2..80508a4a02 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Osquery Service Stop id: 0c320fea-6e87-4b99-a884-74d09d4b655d version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,16 +15,19 @@ description: The following analytic detects suspicious stopping of the `osquery` possible threats effectively. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_osquery_service_stop_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_osquery_service_stop_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -38,7 +41,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: an auditd $type$ event occured on host. + message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index e6aa5054c9..68e1f368f6 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access Or Modification Of Sshd Config File id: acb3ea33-70f7-47aa-b335-643b3aebcb2f version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,16 +15,19 @@ description: The following analytic detects suspicious access or modification of escalation, or persistent backdoor access, posing a severe security risk. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. references: @@ -39,7 +42,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a $PATH$ has been accessed/modified on host. + message: A [$PATH$] has been accessed/modified on host - [$dest$]. mitre_attack_id: - T1098.004 - T1098 diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index c9ee590e26..74badc051b 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,19 +14,22 @@ description: The following analytic detects attempts to access or dump the conte offline cracking, leading to unauthorized access and potential system compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE - (process_exec, "%shadow%") OR LIKE (process_exec, "%passwd%")) AND (LIKE (process_exec, - "%cat %") OR LIKE (process_exec, "%nano %")OR LIKE (process_exec, "%vim %") OR LIKE - (process_exec, "%vi %")) | stats count min(_time) as firstTime max(_time) as lastTime - by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_credential_files_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where (LIKE (process_exec, "%shadow%") OR LIKE (process_exec, "%passwd%")) + AND (LIKE (process_exec, "%cat %") OR LIKE (process_exec, "%nano %")OR LIKE (process_exec, + "%vim %") OR LIKE (process_exec, "%vi %")) | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_possible_access_to_credential_files_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -40,7 +43,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1003.008 - T1003 diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 10365c1938..9a199203be 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,16 +14,18 @@ description: The following analytic detects potential access or modification of compromising the security of the targeted host. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats count min(_time) as - firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_sudoers_file_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats + count min(_time) as firstTime max(_time) as lastTime by name nametype OGID dest + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_sudoers_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -37,7 +39,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a $PATH$ has been accessed/modified on host. + message: A [$PATH$] has been accessed/modified on host - [$dest$]. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 336404db50..0e20bf79b9 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File id: fea71cf0-fa10-4ef6-9202-9682b2e0c477 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -16,16 +16,18 @@ description: The following analytic detects potential tampering with cronjob fil data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") - | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID dest | - `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. + | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime + by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: False positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes. Therefore, it's recommended to adjust filter macros to eliminate such false positives. @@ -43,7 +45,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: a $PATH$ has been accessed/modified on host. + message: A [$PATH$] has been accessed/modified on host - [$dest$]. mitre_attack_id: - T1053.003 - T1053 diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index abc1aff249..cb7a1c7b16 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,17 +15,19 @@ description: The following analytic detects the use of the LD_PRELOAD environmen maintain long-term access to the system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, - "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_preload_hijack_library_calls_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime + max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -38,7 +40,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1574.006 - T1574 diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 143ed4374d..31cbd513f5 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Preload Hijack Via Preload File id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,16 +15,19 @@ description: "The following analytic detects suspicious preload hijacking via th \ potential threats to system integrity and security." data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_via_preload_file_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_preload_hijack_via_preload_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -38,7 +41,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: a $PATH$ has been accessed/modified on host. + message: A [$PATH$] has been accessed/modified on host - [$dest$]. mitre_attack_id: - T1574.006 - T1574 diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index 31ff73a755..2a836f872a 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -1,7 +1,7 @@ name: Linux Auditd Service Restarted id: 8eb3e858-18d3-44a4-a514-52cfa39f154a version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,18 +15,21 @@ description: The following analytic detects the restarting or re-enabling of ser risks and prevent further compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE(process_exec, - "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "%restart%") - OR LIKE(process_exec, "%reenable%") OR LIKE(process_exec, "%reload%")) | stats count - min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service + %") ) AND(LIKE(process_exec, "%restart%") OR LIKE(process_exec, "%reenable%") OR + LIKE(process_exec, "%reload%")) | stats count min(_time) as firstTime max(_time) + as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. references: @@ -44,7 +47,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1053.006 - T1053 diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 4758e506c4..9126a42838 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -1,7 +1,7 @@ name: Linux Auditd Service Started id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,18 +14,21 @@ description: The following analytic detects the suspicious service started. This prevent potential security incidents. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE(process_exec, - "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "% - start %") OR LIKE(process_exec, "% enable %")) | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_service_started_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service + %") ) AND(LIKE(process_exec, "% start %") OR LIKE(process_exec, "% enable %")) | + stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle + normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_service_started_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -39,7 +42,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1569.002 - T1569 diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index 76f58fd376..9cafc5af9f 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Setuid Using Chmod Utility id: 8230c407-1b47-4d95-ac2e-718bd6381386 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,18 +15,21 @@ description: The following analytic detects the execution of the chmod utility t system functions. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, - "%chmod %") AND (LIKE (process_exec, "% u+s %") OR LIKE (process_exec, "% g+s %") - OR LIKE (process_exec, "% 4777 %") OR LIKE (process_exec, "% 4577 %")) | stats count - min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_chmod_utility_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE (process_exec, "%chmod %") AND (LIKE (process_exec, "% u+s + %") OR LIKE (process_exec, "% g+s %") OR LIKE (process_exec, "% 4777 %") OR LIKE + (process_exec, "% 4577 %")) | stats count min(_time) as firstTime max(_time) as + lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_chmod_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -40,7 +43,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1548.001 - T1548 diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index 7a3ea48a48..459e7b3cda 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Setuid Using Setcap Utility id: 1474459a-302b-4255-8add-d82f96d14cd9 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,19 +15,22 @@ description: The following analytic detects the execution of the 'setcap' utilit system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, - "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep %") OR LIKE (process_exec, - "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p %") OR LIKE - (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep - %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_setcap_utility_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep + %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p + %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep + %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_setuid_using_setcap_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -40,7 +43,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1548.001 - T1548 diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index 2dd499f594..bd8ac26812 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -1,7 +1,7 @@ name: Linux Auditd Shred Overwrite Command id: ce2bde4d-a1d4-4452-8c87-98440e5adfb3 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,18 +15,21 @@ description: The following analytic detects the execution of the 'shred' command and data availability. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, - "%shred%") AND (LIKE (process_exec, "%-n%") OR LIKE (process_exec, "%-z%") OR LIKE - (process_exec, "%-u%") OR LIKE (process_exec, "%-s%")) | stats count min(_time) - as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_shred_overwrite_command_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE (process_exec, "%shred%") AND (LIKE (process_exec, "%-n%") + OR LIKE (process_exec, "%-z%") OR LIKE (process_exec, "%-u%") OR LIKE (process_exec, + "%-s%")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec + proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_shred_overwrite_command_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -43,7 +46,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1485 observable: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 1597d07b2a..db27066074 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -1,7 +1,7 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,16 +15,18 @@ description: The following analytic detects attempts to stop or clear a service severely impacting system integrity and availability. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) as firstTime max(_time) - as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_stop_services_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -39,7 +41,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: a service stop event occured on host. + message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index cdd016a735..59d5781ce4 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd Sudo Or Su Execution id: 817a5c89-5b92-4818-a22d-aa35e1361afe version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,17 +15,20 @@ description: The following analytic detects the execution of the "sudo" or "su" or further system compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, - "%sudo %") OR LIKE(process_exec, "%su %") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sudo_or_su_execution_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE(process_exec, "%sudo %") OR LIKE(process_exec, "%su %") | stats + count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_sudo_or_su_execution_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: @@ -38,7 +41,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index a1b256cf6b..530c05dfa7 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Sysmon Service Stop id: 20901256-633a-40de-8753-7b88811a460f version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,16 +14,19 @@ description: The following analytic detects the suspicious sysmon service stop. to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_sysmon_service_stop_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_sysmon_service_stop_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -37,7 +40,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: a sysmon $type$ event occured on host. + message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 47ff4037ee..0a43aa8eff 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -1,7 +1,7 @@ name: Linux Auditd System Network Configuration Discovery id: 5db16825-81bd-4923-a8d6-d6a13a59832a version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,19 +16,21 @@ description: The following analytic detects suspicious system network configurat data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", - "firewall-cmd", "ufw", "iptables", "ss", "route") | bucket _time span=15m | rename host as dest | stats - dc(comm) as unique_commands, values(comm) as comm, values(exe) as exe, values(SYSCALL) - as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) as pid, count, - min(_time) as firstTime, max(_time) as lastTime by success dest | where unique_commands - >= 4 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + "firewall-cmd", "ufw", "iptables", "ss", "route") | bucket _time span=15m | rename + host as dest | stats dc(comm) as unique_commands, values(comm) as comm, values(exe) + as exe, values(SYSCALL) as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) + as pid, count, min(_time) as firstTime, max(_time) as lastTime by success dest | + where unique_commands >= 4 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_system_network_configuration_discovery_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -42,7 +44,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1016 observable: diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index c234c577ad..aed53a1698 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -1,7 +1,7 @@ name: Linux Auditd Unix Shell Configuration Modification id: 66f737c6-3f7f-46ed-8e9b-cc0e5bf01f04 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -20,16 +20,19 @@ search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/ "/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile", "root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc", "/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login", - "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by name nametype OGID dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_unix_shell_configuration_modification_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. + "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as + dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype + OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_unix_shell_configuration_modification_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -44,7 +47,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: a $PATH$ has been accessed/modified on host. + message: A [$PATH$] has been accessed/modified on host - [$dest$]. mitre_attack_id: - T1546.004 - T1546 diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index 25cd69f7df..044fe75fa3 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -1,7 +1,7 @@ name: Linux Auditd Unload Module Via Modprobe id: 90964d6a-4b5f-409a-85bd-95e261e03fe9 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,17 +15,20 @@ description: The following analytic detects suspicious use of the `modprobe` com address possible threats to system integrity. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, - "%modprobe%") AND LIKE (process_exec, "%-r %") | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_unload_module_via_modprobe_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") + | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_unload_module_via_modprobe_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -39,7 +42,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1547.006 - T1547 diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index 9a23e7ac66..0bf29f501e 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -1,7 +1,7 @@ name: Linux Auditd Virtual Disk File And Directory Discovery id: eec78cef-d4c8-4b35-8f5b-6922102a4a41 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,18 +15,21 @@ description: "The following analytic detects suspicious discovery of virtual dis \ teams to respond promptly and safeguard against unauthorized access and data breaches." data_source: - Linux Auditd Execve -search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, - "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR - LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count - min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, + "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc + process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -41,7 +44,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $process_exec$ event occurred on host. + message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1083 observable: diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index a89c6f5d99..77ddd9801e 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -1,7 +1,7 @@ name: Linux Auditd Whoami User Discovery id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 version: 1 -date: '2024-08-27' +date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,17 +15,19 @@ description: The following analytic detects the suspicious use of the whoami com further malicious operations. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | rename host as dest | stats count - min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest - success | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| +search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | rename host + as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL + UID ppid pid dest success | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_whoami_user_discovery_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process complete command-line executions. - These logs must be processed using the appropriate Splunk Technology Add-ons that - are specific to the EDR product. Use the Splunk Common Information Model (CIM) to - normalize the field names and speed up the data modeling process. +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: @@ -40,7 +42,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: $comm$ was executed on host. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. mitre_attack_id: - T1033 observable: From 5c34169c53d573ff8b5e15577adcdd804c6bc380 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 4 Sep 2024 11:29:09 +0200 Subject: [PATCH 52/54] linux_auditd_detection --- detections/endpoint/linux_auditd_add_user_account_type.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 93e4666efa..800046859b 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -44,7 +44,7 @@ tags: - T1136 - T1136.001 observable: - - name: hostname + - name: dest type: Hostname role: - Victim From e557fd760e256ca1b94cdaceb44be24cb255af39 Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 4 Sep 2024 15:43:55 +0530 Subject: [PATCH 53/54] updating message and text --- .../endpoint/linux_auditd_add_user_account.yml | 2 +- .../linux_auditd_add_user_account_type.yml | 2 +- .../linux_auditd_at_application_execution.yml | 2 +- .../linux_auditd_auditd_service_stop.yml | 2 +- .../linux_auditd_base64_decode_files.yml | 2 +- .../linux_auditd_change_file_owner_to_root.yml | 5 ++--- .../linux_auditd_clipboard_data_copy.yml | 4 ++-- .../linux_auditd_data_destruction_command.yml | 6 ++---- ...ditd_data_transfer_size_limits_via_split.yml | 2 +- ...a_transfer_size_limits_via_split_syscall.yml | 2 +- ...td_database_file_and_directory_discovery.yml | 11 ++--------- .../endpoint/linux_auditd_dd_file_overwrite.yml | 3 +-- ...auditd_disable_or_modify_system_firewall.yml | 2 +- .../linux_auditd_doas_conf_file_creation.yml | 10 +++++----- .../linux_auditd_doas_tool_execution.yml | 5 ++--- .../linux_auditd_edit_cron_table_parameter.yml | 2 +- ...inux_auditd_file_and_directory_discovery.yml | 2 +- ...d_file_permission_modification_via_chmod.yml | 2 +- ...file_permissions_modification_via_chattr.yml | 2 +- ..._find_credentials_from_password_managers.yml | 2 +- ...td_find_credentials_from_password_stores.yml | 2 +- .../endpoint/linux_auditd_find_private_keys.yml | 11 ++--------- .../linux_auditd_find_ssh_private_keys.yml | 11 ++--------- .../linux_auditd_hardware_addition_swapoff.yml | 3 ++- ...td_hidden_files_and_directories_creation.yml | 17 +++++++++-------- ...nsert_kernel_module_using_insmod_utility.yml | 5 ++--- ...all_kernel_module_using_modprobe_utility.yml | 5 ++--- .../linux_auditd_kernel_module_enumeration.yml | 5 ++--- ...auditd_kernel_module_using_rmmod_utility.yml | 11 ++--------- ...ux_auditd_nopasswd_entry_in_sudoers_file.yml | 5 ++--- .../linux_auditd_osquery_service_stop.yml | 2 +- ...cess_or_modification_of_sshd_config_file.yml | 5 ++--- ...ditd_possible_access_to_credential_files.yml | 10 +++++----- ...x_auditd_possible_access_to_sudoers_file.yml | 5 ++--- ...d_cronjob_entry_on_existing_cronjob_file.yml | 5 ++--- ...inux_auditd_preload_hijack_library_calls.yml | 5 ++--- ...x_auditd_preload_hijack_via_preload_file.yml | 11 ++--------- .../endpoint/linux_auditd_service_restarted.yml | 13 ++++++------- .../endpoint/linux_auditd_service_started.yml | 2 +- .../linux_auditd_setuid_using_chmod_utility.yml | 5 ++--- ...linux_auditd_setuid_using_setcap_utility.yml | 5 ++--- .../linux_auditd_shred_overwrite_command.yml | 9 ++------- .../endpoint/linux_auditd_stop_services.yml | 5 ++--- .../linux_auditd_sudo_or_su_execution.yml | 5 ++--- .../linux_auditd_sysmon_service_stop.yml | 2 +- ...d_system_network_configuration_discovery.yml | 2 +- ...td_unix_shell_configuration_modification.yml | 2 +- .../linux_auditd_unload_module_via_modprobe.yml | 2 +- ...irtual_disk_file_and_directory_discovery.yml | 11 ++--------- .../linux_auditd_whoami_user_discovery.yml | 2 +- 50 files changed, 95 insertions(+), 158 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 1aaf58d8f1..c33bc16d25 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -40,7 +40,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to add a user account. mitre_attack_id: - T1136.001 - T1136 diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 800046859b..1b7d6b8f9f 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -39,7 +39,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: New [$type$] event on host - [$dest$]. + message: New [$type$] event on host - [$dest$] to add a user account type. mitre_attack_id: - T1136 - T1136.001 diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index c2813ae768..49d5a50c87 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to execute the "at" application. mitre_attack_id: - T1053.002 - T1053 diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 14e3ceb4a2..20ddf0f391 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -40,7 +40,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. + message: A service event - [$type$] event occured on host - [$dest$]. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 77ae2394c1..15b0b91e2d 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -43,7 +43,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to decode a file using base64. mitre_attack_id: - T1140 observable: diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 540f551fb1..23917623b0 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the use of the 'chown' command to change - a file owner to 'root' on a Linux system. It leverages Endpoint Detection and Response - (EDR) telemetry, specifically monitoring command-line executions and process details. + a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically monitoring command-line executions and process details. This activity is significant as it may indicate an attempt to escalate privileges by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised @@ -42,7 +41,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to change a file owner to root. mitre_attack_id: - T1222.002 - T1222 diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 63dcf8f640..20b1cf0179 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the use of the Linux 'xclip' command to - copy data from the clipboard. It leverages Endpoint Detection and Response (EDR) + copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed @@ -41,7 +41,7 @@ tags: asset_type: Endpoint confidence: 40 impact: 40 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to copy data from the clipboard. mitre_attack_id: - T1115 observable: diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index 2d30a2d070..0ce3e41f48 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -6,9 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of a Unix shell command - designed to wipe root directories on a Linux host. It leverages data from Endpoint - Detection and Response (EDR) agents, focusing on the 'rm' command with force recursive - deletion and the '--no-preserve-root' option. This activity is significant as it + designed to wipe root directories on a Linux host. It leverages data from Linux Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate @@ -41,7 +39,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 100 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to destroy data. mitre_attack_id: - T1485 observable: diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index 5998085cd7..742d1323bb 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -41,7 +41,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to split a file. mitre_attack_id: - T1030 observable: diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index 887e3147fd..45a7e337e4 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -41,7 +41,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] that limits the size of data transfer. mitre_attack_id: - T1030 observable: diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index ba8bb7d272..b6d0662dfe 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -5,14 +5,7 @@ date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: "The following analytic detects suspicious database file and directory\ - \ discovery activities, which may signal an attacker\u2019s attempt to locate and\ - \ assess critical database assets on a compromised system. This behavior is often\ - \ a precursor to data theft, unauthorized access, or privilege escalation, as attackers\ - \ seek to identify valuable information stored in databases. By monitoring for unusual\ - \ or unauthorized attempts to locate database files and directories, this analytic\ - \ aids in early detection of potential reconnaissance or data breach efforts, enabling\ - \ security teams to respond swiftly and mitigate the risk of further compromise." +description: "The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, as attackers seek to identify valuable information stored in databases. By monitoring for unusual or unauthorized attempts to locate database files and directories, this analytic aids in early detection of potential reconnaissance or data breach efforts, enabling security teams to respond swiftly and mitigate the risk of further compromise." data_source: - Linux Auditd Execve search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as @@ -49,7 +42,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to discover database files and directories. mitre_attack_id: - T1083 observable: diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index 9a2821d038..4dfca37b55 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the use of the 'dd' command to overwrite - files on a Linux system. It leverages data from Endpoint Detection and Response - (EDR) agents, focusing on process execution logs that include command-line details. + files on a Linux system. It leverages data from Linux Auditd telemetry, focusing on process execution logs that include command-line details. This activity is significant because adversaries often use the 'dd' command to destroy or irreversibly overwrite files, disrupting system availability and services. If confirmed malicious, this behavior could lead to data destruction, making recovery diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 22686f05a0..c06023c1cc 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -40,7 +40,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. + message: A service event - [$type$] to disable or modify system firewall occured on host - [$dest$] . mitre_attack_id: - T1562.004 - T1562 diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 97ff9ee566..563cd85b6c 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -7,10 +7,10 @@ status: production type: TTP description: The following analytic detects the creation of the doas.conf file on a Linux host. This file is used by the doas utility to allow standard users to perform - tasks as root, similar to sudo. The detection leverages filesystem data from the - Endpoint data model, focusing on the creation of the doas.conf file. This activity - is significant because it can indicate an attempt to gain elevated privileges, potentially - by an adversary. If confirmed malicious, this could allow an attacker to execute + tasks as root, similar to sudo. The detection leverages Linux Auditd data, focusing on + the creation of the doas.conf file. This activity is significant because it can + indicate an attempt to gain elevated privileges, potentially by an adversary. If + confirmed malicious, this could allow an attacker to execute commands with root commands with root privileges, leading to full system compromise. data_source: - Linux Auditd Path @@ -40,7 +40,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$PATH$] has been accessed/modified on host - [$dest$]. + message: A [$type$] event occured on host - [$dest$] to create a doas.conf file. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 4f76f80446..884e79ac0d 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -7,8 +7,7 @@ status: production type: Anomaly description: The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, - similar to 'sudo'. The detection leverages data from Endpoint Detection and Response - (EDR) agents, focusing on process names and command-line executions. This activity + similar to 'sudo'. The detection leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant as 'doas' can be exploited by adversaries to gain elevated privileges on a compromised host. If confirmed malicious, this could lead to unauthorized administrative access, potentially compromising the entire system. @@ -40,7 +39,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to execute the "doas" tool. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index c8f35c9835..f8a4b96e3b 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -42,7 +42,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to edit the cron table. mitre_attack_id: - T1053.003 - T1053 diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index e91012ef2e..bf39f2489c 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -53,7 +53,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to discover files and directories. mitre_attack_id: - T1083 observable: diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index 1cb12a9493..9ef853f1f3 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -43,7 +43,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to modify file permissions using the "chmod" command. mitre_attack_id: - T1222.002 - T1222 diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 46d62934cf..02dd37610f 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -42,7 +42,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to modify file permissions using the "chattr" command. mitre_attack_id: - T1222.002 - T1222 diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 5ce6125368..fbb9f814e0 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -49,7 +49,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to find credentials stored in password managers. mitre_attack_id: - T1555.005 - T1555 diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 940206c8a2..a6124b82e4 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to find credentials stored in password managers. mitre_attack_id: - T1555.005 - T1555 diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_find_private_keys.yml index a750c463b6..9ff566aa84 100644 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_private_keys.yml @@ -5,14 +5,7 @@ date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP -description: "The following analytic detects suspicious attempts to find private keys,\ - \ which may indicate an attacker\u2019s effort to access sensitive cryptographic\ - \ information. Private keys are crucial for securing encrypted communications and\ - \ data, and unauthorized access to them can lead to severe security breaches, including\ - \ data decryption and identity theft. By monitoring for unusual or unauthorized\ - \ searches for private keys, this analytic helps identify potential threats to cryptographic\ - \ security, enabling security teams to take swift action to protect the integrity\ - \ and confidentiality of encrypted information." +description: "The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information." data_source: - Linux Auditd Execve search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as @@ -46,7 +39,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. mitre_attack_id: - T1552.004 - T1552 diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 760d29d173..c4498b01eb 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -5,14 +5,7 @@ date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: "The following analytic detects suspicious attempts to find SSH private\ - \ keys, which may indicate an attacker\u2019s effort to compromise secure access\ - \ to systems. SSH private keys are essential for secure authentication, and unauthorized\ - \ access to t hese keys can enable attackers to gain unauthorized access to servers\ - \ and other critical infrastructure. By monitoring for unusual or unauthorized searches\ - \ for SSH private keys, this analytic helps identify potential threats to network\ - \ security, allowing security teams to quickly respond and safeguard against unauthorized\ - \ access and potential breaches." +description: "The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches." data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as @@ -45,7 +38,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to find SSH private keys. mitre_attack_id: - T1552.004 - T1552 diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index cba79369c3..fcede5c55c 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -41,7 +41,8 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to disable the swapping + of paging devices on a Linux system. mitre_attack_id: - T1200 observable: diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index d5ba8f05bb..c8a07b3865 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -5,14 +5,15 @@ date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP -description: "The following analytic detects suspicious creation of hidden files and\ - \ directories, which may indicate an attacker\u2019s attempt to conceal malicious\ - \ activities or unauthorized data. Hidden files and directories are often used to\ - \ evade detection by security tools and administrators, providing a stealthy means\ - \ for storing malware, logs, or sensitive information. By monitoring for unusual\ - \ or unauthorized creation of hidden files and directories, this analytic helps\ - \ identify potential attempts to hide malicious operations, enabling security teams\ - \ to uncover and address hidden threats effectively." +description: "The following analytic detects suspicious creation of hidden files and + directories, which may indicate an attacker's attempt to conceal malicious activities + or unauthorized data. Hidden files and directories are often used to evade detection + by security tools and administrators, providing a stealthy means for storing malware, + logs, or sensitive information. By monitoring for unusual or unauthorized creation of + hidden files and directories, this analytic helps identify potential attempts to hide + or unauthorized creation of hidden files and directories, this analytic helps identify + potential attempts to hide malicious operations, enabling security teams to uncover + and address hidden threats effectively." data_source: - Linux Auditd Execve search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index 20d20b4efa..215c54dcc4 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the insertion of a Linux kernel module - using the insmod utility. It leverages data from Endpoint Detection and Response - (EDR) agents, focusing on process execution logs that include process names and + using the insmod utility. It leverages data from Linux Auditd, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this @@ -43,7 +42,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to insert a Linux kernel module using the insmod utility. mitre_attack_id: - T1547.006 - T1547 diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index bb05c6d634..d1753399c9 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the installation of a Linux kernel module - using the modprobe utility. It leverages data from Endpoint Detection and Response - (EDR) agents, focusing on process names and command-line executions. This activity + using the modprobe utility. It leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could @@ -43,7 +42,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to install a Linux kernel module using the modprobe utility. mitre_attack_id: - T1547.006 - T1547 diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml index 1cd842bb29..a9ef21100c 100644 --- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic identifies the use of the 'kmod' process to list - kernel modules on a Linux system. This detection leverages data from Endpoint Detection - and Response (EDR) agents, focusing on process names and command-line executions. + kernel modules on a Linux system. This detection leverages data from Linux Auditd, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege @@ -38,7 +37,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 30 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to list kernel modules. mitre_attack_id: - T1082 - T1014 diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index 3c9a38ea97..0203fa75c1 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -5,14 +5,7 @@ date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP -description: "The following analytic detects suspicious use of the `rmmod` utility\ - \ for kernel module removal, which may indicate an attacker\u2019s attempt to unload\ - \ critical or security-related kernel modules. The `rmmod` command is used to remove\ - \ modules from the Linux kernel, and unauthorized use can be a tactic to disable\ - \ security features, conceal malicious activities, or disrupt system operations.\ - \ By monitoring for unusual or unauthorized `rmmod` activity, this analytic helps\ - \ identify potential tampering with kernel modules, enabling security teams to take\ - \ proactive measures to protect system integrity and security." +description: "The following analytic detects suspicious use of the `rmmod` utility for kernel module removal, which may indicate an attacker attempt to unload critical or security-related kernel modules. The `rmmod` command is used to remove modules from the Linux kernel, and unauthorized use can be a tactic to disable security features, conceal malicious activities, or disrupt system operations. By monitoring for unusual or unauthorized `rmmod` activity, this analytic helps identify potential tampering with kernel modules, enabling security teams to take proactive measures to protect system integrity and security." data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=rmmod | rename host as dest | stats count @@ -41,7 +34,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 90 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to remove a Linux kernel module using the rmmod utility. mitre_attack_id: - T1547.006 - T1547 diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index b7a4578b8b..511e1a611b 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the addition of NOPASSWD entries to the - /etc/sudoers file on Linux systems. It leverages Endpoint Detection and Response - (EDR) telemetry to identify command lines containing "NOPASSWD:". This activity + /etc/sudoers file on Linux systems. It leverages Linux Auditd data to identify command lines containing "NOPASSWD:". This activity is significant because it allows users to execute commands with elevated privileges without requiring a password, which can be exploited by adversaries to maintain persistent, privileged access. If confirmed malicious, this could lead to unauthorized @@ -42,7 +41,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to add NOPASSWD entry in sudoers file. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index 80508a4a02..072d6a1dc6 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -41,7 +41,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. + message: A service event - [$type$] event occured on host - [$dest$] to stop the osquery service. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 68e1f368f6..b7577183a0 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects suspicious access or modification of the - sshd_config file on Linux systems. It leverages data from Endpoint Detection and - Response (EDR) agents, focusing on command-line executions involving processes like + sshd_config file on Linux systems. It leverages data from Linux Auditd, focusing on command-line executions involving processes like "cat," "nano," "vim," and "vi" accessing the sshd_config file. This activity is significant because unauthorized changes to sshd_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising @@ -42,7 +41,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$PATH$] has been accessed/modified on host - [$dest$]. + message: A [$type$] has been accessed/modified on host - [$dest$] to modify the sshd_config file. mitre_attack_id: - T1098.004 - T1098 diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 74badc051b..eb214c17fe 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects attempts to access or dump the contents - of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Endpoint - Detection and Response (EDR) agents, focusing on processes like 'cat', 'nano', 'vim', - and 'vi' accessing these files. This activity is significant as it may indicate - credential dumping, a technique used by adversaries to gain persistence or escalate + of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Linux + Auditd, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these + files. This activity is significant as it may indicate credential dumping, a technique + used by adversaries to gain persistence or escalate privileges. If confirmed malicious, privileges. If confirmed malicious, attackers could obtain hashed passwords for offline cracking, leading to unauthorized access and potential system compromise. data_source: @@ -43,7 +43,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to access or dump the contents of /etc/passwd and /etc/shadow files. mitre_attack_id: - T1003.008 - T1003 diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 9a199203be..7c5b6fc127 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects potential access or modification of the - /etc/sudoers file on a Linux system. It leverages data from Endpoint Detection and - Response (EDR) agents, focusing on processes like "cat," "nano," "vim," and "vi" + /etc/sudoers file on a Linux system. It leverages data from Linux Auditd, focusing on processes like "cat," "nano," "vim," and "vi" accessing the /etc/sudoers file. This activity is significant because the sudoers file controls user permissions for executing commands with elevated privileges. If confirmed malicious, an attacker could gain persistence or escalate privileges, @@ -39,7 +38,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$PATH$] has been accessed/modified on host - [$dest$]. + message: A [$type$] has been accessed/modified on host - [$dest$] to access or modify the sudoers file. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 0e20bf79b9..3dbb2bf6cd 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -7,8 +7,7 @@ status: production type: Hunting description: The following analytic detects potential tampering with cronjob files on a Linux system by identifying 'echo' commands that append code to existing cronjob - files. It leverages logs from Endpoint Detection and Response (EDR) agents, focusing - on process names, parent processes, and command-line executions. This activity is + files. It leverages logs from Linux Auditd, focusing on process names, parent processes, and command-line executions. This activity is significant because adversaries often use it for persistence or privilege escalation. If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby @@ -45,7 +44,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: A [$PATH$] has been accessed/modified on host - [$dest$]. + message: A [$type$] event has occured on host - [$dest$] to append a cronjob entry on an existing cronjob file. mitre_attack_id: - T1053.003 - T1053 diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index cb7a1c7b16..1a1d49c96b 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -7,8 +7,7 @@ status: production type: TTP description: The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. It leverages data - from Endpoint Detection and Response (EDR) agents, focusing on process execution - logs that include command-line details. This activity is significant because adversaries, + from Linux Auditd, focusing on process execution logs that include command-line details. This activity is significant because adversaries, malware authors, and red teamers commonly use this technique to gain elevated privileges and establish persistence on a compromised machine. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, and @@ -40,7 +39,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to hijack or hook library functions using the LD_PRELOAD environment variable. mitre_attack_id: - T1574.006 - T1574 diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 31cbd513f5..109ef8c438 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -5,14 +5,7 @@ date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: TTP -description: "The following analytic detects suspicious preload hijacking via the\ - \ `preload` file, which may indicate an attacker\u2019s attempt to intercept or\ - \ manipulate library loading processes. The `preload` file can be used to force\ - \ the loading of specific libraries before others, potentially allowing malicious\ - \ code to execute or alter application behavior. By monitoring for unusual or unauthorized\ - \ modifications to the `preload` file, this analytic helps identify attempts to\ - \ hijack preload mechanisms, enabling security teams to investigate and address\ - \ potential threats to system integrity and security." +description: "The following analytic detects suspicious preload hijacking via the `preload` file, which may indicate an attacker's attempt to intercept or manipulate library loading processes. The `preload` file can be used to force the loading of specific libraries before others, potentially allowing malicious code to execute or alter application behavior. By monitoring for unusual or unauthorized modifications to the `preload` file, this analytic helps identify attempts to hijack preload mechanisms, enabling security teams to investigate and address potential threats to system integrity and security." data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest @@ -41,7 +34,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: A [$PATH$] has been accessed/modified on host - [$dest$]. + message: A [$type$] event has occured on host - [$dest$] to modify the preload file. mitre_attack_id: - T1574.006 - T1574 diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index 2a836f872a..051df9e2ab 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -7,12 +7,11 @@ status: production type: Anomaly description: The following analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data - from Endpoint Detection and Response (EDR) agents, focusing on process and command-line - execution logs. This activity is significant as adversaries may use it to maintain - persistence or execute unauthorized actions. If confirmed malicious, this behavior - could lead to repeated execution of malicious payloads, unauthorized access, or - data destruction. Security analysts should investigate these events to mitigate - risks and prevent further compromise. + from Linux Auditd, focusing on process and command-line execution logs. This activity + is significant as adversaries may use it to maintain persistence or execute unauthorized + actions. If confirmed malicious, this behavior could lead to repeated execution + of malicious payloads, unauthorized access, or data destruction. Security analysts + should investigate these events to mitigate risks and prevent further compromise. data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host @@ -47,7 +46,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to restart or re-enable a service. mitre_attack_id: - T1053.006 - T1053 diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 9126a42838..0cccf2d1c4 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -42,7 +42,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to start or enable a service. mitre_attack_id: - T1569.002 - T1569 diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index 9cafc5af9f..40d98c4d48 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -7,8 +7,7 @@ status: production type: Anomaly description: The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root - or group-level access. This detection leverages data from Endpoint Detection and - Response (EDR) agents, focusing on process names and command-line arguments related + or group-level access. This detection leverages data from Linux Auditd, focusing on process names and command-line arguments related to chmod. This activity is significant as it can indicate an attempt to escalate privileges or maintain persistence on a system. If confirmed malicious, an attacker could gain elevated access, potentially compromising sensitive data or critical @@ -43,7 +42,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to set the SUID or SGID bit on files using the chmod utility. mitre_attack_id: - T1548.001 - T1548 diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index 459e7b3cda..ba6c251de4 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of the 'setcap' utility - to enable the SUID bit on Linux systems. It leverages Endpoint Detection and Response - (EDR) data, focusing on process names and command-line arguments that indicate the + to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing on process names and command-line arguments that indicate the use of 'setcap' with specific capabilities. This activity is significant because setting the SUID bit allows a user to temporarily gain root access, posing a substantial security risk. If confirmed malicious, an attacker could escalate privileges, execute @@ -43,7 +42,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to set the SUID or SGID bit on files using the setcap utility. mitre_attack_id: - T1548.001 - T1548 diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index bd8ac26812..c139a7582d 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -7,12 +7,7 @@ status: production type: TTP description: The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It - leverages data from Endpoint Detection and Response (EDR) agents, focusing on process - names and command-line arguments. This activity is significant because the 'shred' - command can be used in destructive attacks, such as those seen in the Industroyer2 - malware targeting energy facilities. If confirmed malicious, this activity could - lead to the permanent destruction of critical files, severely impacting system integrity - and data availability. + leverages data from Linux Auditd, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability. data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host @@ -46,7 +41,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to overwrite files using the shred utility. mitre_attack_id: - T1485 observable: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index db27066074..c2ca43a903 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects attempts to stop or clear a service on - Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, - focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. + Linux systems. It leverages data from Linux Auditd, focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. This activity is significant as adversaries often terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, @@ -41,7 +40,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. + message: A service event - [$type$] event occured on host - [$dest$] to stop or disable a service. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index 59d5781ce4..d49703030f 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the execution of the "sudo" or "su" command - on a Linux operating system. It leverages data from Endpoint Detection and Response - (EDR) agents, focusing on process names and parent process names. This activity + on a Linux operating system. It leverages data from Linux Auditd, focusing on process names and parent process names. This activity is significant because "sudo" and "su" commands are commonly used by adversaries to elevate privileges, potentially leading to unauthorized access or control over the system. If confirmed malicious, this activity could allow attackers to execute @@ -41,7 +40,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to execute the sudo or su command. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index 530c05dfa7..b441b1e23a 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -40,7 +40,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A service event - [$SERVICE_STOP$] event occured on host - [$dest$]. + message: A service event - [$type$] event occured on host - [$dest$] to stop or disable the sysmon service. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 0a43aa8eff..299ac8abec 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to discover system network configuration. mitre_attack_id: - T1016 observable: diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index aed53a1698..e1af798091 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -47,7 +47,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$PATH$] has been accessed/modified on host - [$dest$]. + message: A [$type$] event occured on host - [$dest$] to modify the unix shell configuration file. mitre_attack_id: - T1546.004 - T1546 diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index 044fe75fa3..5fb708ae4e 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -42,7 +42,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to unload a kernel module via the modprobe command. mitre_attack_id: - T1547.006 - T1547 diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index 0bf29f501e..abd5c53579 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -5,14 +5,7 @@ date: '2024-09-04' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: "The following analytic detects suspicious discovery of virtual disk\ - \ files and directories, which may indicate an attacker\u2019s attempt to locate\ - \ and access virtualized storage environments. Virtual disks can contain sensitive\ - \ data or critical system configurations, and unauthorized discovery attempts could\ - \ signify preparatory actions for data exfiltration or further compromise. By monitoring\ - \ for unusual or unauthorized searches for virtual disk files and directories, this\ - \ analytic helps identify potential reconnaissance activities, enabling security\ - \ teams to respond promptly and safeguard against unauthorized access and data breaches." +description: "The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring for unusual or unauthorized searches for virtual disk files and directories, this analytic helps identify potential reconnaissance activities, enabling security teams to respond promptly and safeguard against unauthorized access and data breaches." data_source: - Linux Auditd Execve search: ' `linux_auditd` `linux_auditd_normalized_execve_process` | rename host as @@ -44,7 +37,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$]. + message: A [$process_exec$] event occurred on host - [$dest$] to discover virtual disk files and directories. mitre_attack_id: - T1083 observable: diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index 77ddd9801e..ae07759e24 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -42,7 +42,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$]. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to discover virtual disk files and directories. mitre_attack_id: - T1033 observable: From 852b529d40095c396b06243c5842fce9089c2c33 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 4 Sep 2024 15:45:53 +0530 Subject: [PATCH 54/54] trigger