Branch was auto-updated.

detections/endpoint/linux_awk_privilege_escalation.yml

@@ -0,0 +1,68 @@
+name: Linux AWK Privilege Escalation
+id: 4510cae0-96a2-4840-9919-91d262db210a
+version: 1
+date: '2022-07-31'
+author: Gowthamaraj Rajendran, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: Awk is mostly used for processing and scanning patterns. 
+  It checks one or more files to determine whether any lines fit the specified patterns, 
+  and if so, it does the appropriate action. If sudo right is given to AWK binary for the user, then the user 
+  can run system commands as root and possibly get a root shell.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*" AND Processes.process="*awk*"  AND Processes.process="*BEGIN*system*" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
+references:
+- https://www.hacknos.com/awk-privilege-escalation/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: A commandline $process$ with process $process_name$ on $dest$
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 72
+  security_domain: endpoint

detections/endpoint/linux_docker_privilege_escalation.yml

@@ -0,0 +1,68 @@
+name: Linux Docker Privilege Escalation
+id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3
+version: 1
+date: '2022-07-31'
+author: Gowthamaraj Rajendran, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: Docker is an open source containerization platform. It helps programmers to bundle applications into containers, 
+  which are standardized executable parts that include the application source code along with the OS libraries and dependencies needed to run 
+  that code in any setting. The user can add mount the root directory into a container and edit the /etc/password file to add a super user.
+  This requires the user to be privileged enough to run docker, i.e. being in the docker group or being root.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN("*docker*-v*/*:*","*docker*--volume*/*:*") OR Processes.process IN("*docker*exec*sh*","*docker*exec*bash*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
+references:
+- https://gtfobins.github.io/gtfobins/docker/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: A commandline $process$ with process $process_name$ on $dest$
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 24
+  security_domain: endpoint

detections/endpoint/linux_node_privilege_escalation.yml

@@ -0,0 +1,68 @@
+name: Linux Node Privilege Escalation
+id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce
+version: 1
+date: '2022-07-31'
+author: Gowthamaraj Rajendran, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: Node.js is a back-end JavaScript runtime environment that is open-source, cross-platform, runs on the V8 engine, 
+  and executes JavaScript code outside of a web browser. It was created to help create scalable network applications.
+  If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, 
+  escalate or maintain privileged access.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*node*" AND Processes.process="*-e*" AND Processes.process="*child_process.spawn*" AND Processes.process="*stdio*" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
+references:
+- https://gtfobins.github.io/gtfobins/docker/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: A commandline $process$ with process $process_name$ on $dest$
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  risk_score: 72
+  security_domain: endpoint

tests/endpoint/linux_awk_privilege_escalation.test.yml

@@ -0,0 +1,13 @@
+name: Linux AWK Privilege Escalation Unit Test
+tests:
+- name: Linux AWK Privilege Escalation
+  file: endpoint/linux_awk_privilege_escalation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true

tests/endpoint/linux_docker_privilege_escalation.test.yml

@@ -0,0 +1,13 @@
+name: Linux Docker Privilege Escalation Unit Test
+tests:
+- name: Linux Docker Privilege Escalation
+  file: endpoint/linux_docker_privilege_escalation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true

tests/endpoint/linux_node_privilege_escalation.test.yml

@@ -0,0 +1,13 @@
+name: Linux Node Privilege Escalation Unit Test
+tests:
+- name: Linux Node Privilege Escalation
+  file: endpoint/linux_node_privilege_escalation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true