diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml new file mode 100644 index 0000000000..a0f226f099 --- /dev/null +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux AWK Privilege Escalation +id: 4510cae0-96a2-4840-9919-91d262db210a +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Awk is mostly used for processing and scanning patterns. + It checks one or more files to determine whether any lines fit the specified patterns, + and if so, it does the appropriate action. If sudo right is given to AWK binary for the user, then the user + can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*" AND Processes.process="*awk*" AND Processes.process="*BEGIN*system*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://www.hacknos.com/awk-privilege-escalation/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml new file mode 100644 index 0000000000..0978880cdf --- /dev/null +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux Docker Privilege Escalation +id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Docker is an open source containerization platform. It helps programmers to bundle applications into containers, + which are standardized executable parts that include the application source code along with the OS libraries and dependencies needed to run + that code in any setting. The user can add mount the root directory into a container and edit the /etc/password file to add a super user. + This requires the user to be privileged enough to run docker, i.e. being in the docker group or being root. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process IN("*docker*-v*/*:*","*docker*--volume*/*:*") OR Processes.process IN("*docker*exec*sh*","*docker*exec*bash*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/docker/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 24 + security_domain: endpoint diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml new file mode 100644 index 0000000000..8aacf88865 --- /dev/null +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux Node Privilege Escalation +id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Node.js is a back-end JavaScript runtime environment that is open-source, cross-platform, runs on the V8 engine, + and executes JavaScript code outside of a web browser. It was created to help create scalable network applications. + If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, + escalate or maintain privileged access. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*node*" AND Processes.process="*-e*" AND Processes.process="*child_process.spawn*" AND Processes.process="*stdio*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/docker/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/tests/endpoint/linux_awk_privilege_escalation.test.yml b/tests/endpoint/linux_awk_privilege_escalation.test.yml new file mode 100644 index 0000000000..584d69461b --- /dev/null +++ b/tests/endpoint/linux_awk_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux AWK Privilege Escalation Unit Test +tests: +- name: Linux AWK Privilege Escalation + file: endpoint/linux_awk_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_docker_privilege_escalation.test.yml b/tests/endpoint/linux_docker_privilege_escalation.test.yml new file mode 100644 index 0000000000..0ad9f72e83 --- /dev/null +++ b/tests/endpoint/linux_docker_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Docker Privilege Escalation Unit Test +tests: +- name: Linux Docker Privilege Escalation + file: endpoint/linux_docker_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_node_privilege_escalation.test.yml b/tests/endpoint/linux_node_privilege_escalation.test.yml new file mode 100644 index 0000000000..cf29457dfd --- /dev/null +++ b/tests/endpoint/linux_node_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Node Privilege Escalation Unit Test +tests: +- name: Linux Node Privilege Escalation + file: endpoint/linux_node_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true