fixlinpe

detections/endpoint/detect_linpeas_execution.yml

@@ -18,11 +18,17 @@ references:
 tags:
   analytic_story:
   - Linux Post-Exploitation
+  confidence: 100
+  context:
+    - Source: endpoint
+    - Stage: discovery
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
+  impact: 90
   kill_chain_phases:
   - Exploitation
   - Privilege Escalation
+  message: LinPEAS post exploitation tool detected
   mitre_attack_id:
   - T1082
   - T1083
@@ -32,6 +38,11 @@ tags:
   - T1057
   - T1518
   - T1033
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -42,17 +53,6 @@ tags:
   - CommandLine
   - user
   - parent_process_exec
-  - process_path
-  security_domain: endpoint
-  impact: 90
-  confidence: 100
-  # (impact * confidence)/100
+  - process_path 
   risk_score: 90
-  context:
-    - Source: endpoint
-    - Stage: discovery
-  message: LinPEAS post exploitation tool detected
-  observable:
-    - name: Computer
-    - Type: Endpoint 
-    - role: Victim
+  security_domain: endpoint