From 18a9043ff189675eff1cf67f0281e60ba31070d1 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Tue, 25 Jan 2022 16:12:04 -0800
Subject: [PATCH 01/17] added data model to searches

---
 .../endpoint/detect_autosuid_post_exploitation_tool.yml   | 8 +++++---
 detections/endpoint/detect_linenum_execution.yml          | 8 +++++---
 detections/endpoint/detect_linpeas_execution.yml          | 8 ++++----
 .../endpoint/detect_linux_exploit_suggester_execution.yml | 6 +++---
 detections/endpoint/detect_mimipenguin.yml                | 7 ++++---
 5 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
index 32a52632b2..47519d6dd3 100644
--- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
+++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
@@ -8,9 +8,11 @@ datamodel:
 - Endpoint
 description: This search, detects Linux post exploitation tool AutoSUID, which is
   an a tool that searches for SUID executables files in order to escalate privileges.
-search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm
-  -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory
-  process_path | `detect_autosuid_post_exploitation_tool_filter`'
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_autosuid_post_exploitation_tool_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Unless an administrator is using these commands to troubleshoot
diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml
index cea9fb1517..0f4807c25b 100644
--- a/detections/endpoint/detect_linenum_execution.yml
+++ b/detections/endpoint/detect_linenum_execution.yml
@@ -10,9 +10,11 @@ description: LinEnum is a bash script that performs discovery commands for accou
   processes, kernel version, applications, services, and uses the information from
   these commands to present operator with ways of escalating privileges or further
   exploitation of targeted host.
-search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
-  | stats count by Computer CommandLine user process_exec process_current_directory
-  | `detect_linenum_execution_filter` '
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where Processes.process = "grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
+    by Processes.dest Processes.user Processes.parent_process_name Processes.process_current_directory
+    Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | | `detect_linenum_execution_filter` '
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Very rare to perform such an extensive grep on a system, however
diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml
index 527ab77df7..e4863682bf 100644
--- a/detections/endpoint/detect_linpeas_execution.yml
+++ b/detections/endpoint/detect_linpeas_execution.yml
@@ -2,15 +2,15 @@ name: Detect LinPeas Execution
 id: 4ea6fa10-547c-11ec-a4f9-acde48001122
 version: 1
 date: '2021-12-03'
-author: Rod Soto
+author: Rod Soto, Eric McGinnis
 type: TTP
 datamodel:
 - Endpoint
 description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script
   that searches for possible paths to escalate privileges.
-search: ' `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash
-  OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec
-  process_path | `detect_linpeas_execution_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process= "grep -Ev ._history.|.bashrc|.bluemix|.cer|.cloudflared|.crt|.csr|.db|.der|.env|.erlang.cookie|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd|.irssi|.jks|.k5login|.kdbx|.key|.keyring|.keystore|.ldaprc|.lesshst|.mozilla|.msmtprc|.ovpn|.p12|.pem|.pfx|.pgp|.plan|.profile|.pypirc|.rdg|.recently-used.xbel|.rhosts|.secrets.mkey|.service|.socket|.sqlite|.sqlite3|.sudo_as_admin_successful|.svn|.swp|.timer|.vault-token|.viminfo|.vnc|.wgetrc" OR Processes.process="find /var/log/ /private/var/log -type f -exec grep -R -a -E -o (25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) {} ;" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid| `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `detect_linpeas_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: This search may produce false positives as it will display
diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
index 44c9b56699..6d11f54685 100644
--- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml
+++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
@@ -9,9 +9,9 @@ datamodel:
 description: This search detects Linux Exploit Suggester tool execution. This is a
   tool that searches for vulnerabilities based on Kernel and Distribution versions
   then queries public exploit databases.
-search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR
-  CommandLine="*exploit*" OR CommandLine="*exploit-db*"  | stats count by CommandLine,user,Computer,action,signature,
-  process_name | `detect_linux_exploit_suggester_execution_filter`'
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="uname -a" OR Processes.process="cvelist-file:*" OR Processes.process="*exploit*" OR Processes.process="*exploit-db*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_linux_exploit_suggester_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Monitoring tools may produce similar commands although the
diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml
index 50dcd97758..ca58d97f34 100644
--- a/detections/endpoint/detect_mimipenguin.yml
+++ b/detections/endpoint/detect_mimipenguin.yml
@@ -8,9 +8,10 @@ datamodel:
 - Endpoint
 description: MimiPenguin is a tool that dumps login passwords from current linux destop
   users. This search detects execution of this tool.
-search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings
-  -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow"  | stats count
-  by Computer parent_process process_current_directory user CommandLine | `detect_mimipenguin_filter`'
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="strings -e /etc/apache2/apache2.conf" OR Processes.process="strings -e /etc/ssh/sshd_config" OR Processes.process="strings -e /etc/shadow" by Processes.dest 
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimipenguin_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Some of these commands may be executed by sysadmin however

From dd7477c38d1396a784c64d60d2dd60c90122ad80 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Tue, 25 Jan 2022 16:32:00 -0800
Subject: [PATCH 02/17] fixed space before pipe

---
 .../endpoint/detect_autosuid_post_exploitation_tool.yml       | 2 +-
 detections/endpoint/detect_linenum_execution.yml              | 4 ++--
 .../endpoint/detect_linux_exploit_suggester_execution.yml     | 2 +-
 detections/endpoint/detect_mimipenguin.yml                    | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
index 47519d6dd3..0e35feffbf 100644
--- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
+++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: This search, detects Linux post exploitation tool AutoSUID, which is
   an a tool that searches for SUID executables files in order to escalate privileges.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )"
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml
index 0f4807c25b..9325ac2d27 100644
--- a/detections/endpoint/detect_linenum_execution.yml
+++ b/detections/endpoint/detect_linenum_execution.yml
@@ -10,11 +10,11 @@ description: LinEnum is a bash script that performs discovery commands for accou
   processes, kernel version, applications, services, and uses the information from
   these commands to present operator with ways of escalating privileges or further
   exploitation of targeted host.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
     as lastTime from datamodel=Endpoint.Processes where Processes.process = "grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
     by Processes.dest Processes.user Processes.parent_process_name Processes.process_current_directory
     Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | | `detect_linenum_execution_filter` '
+    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  `detect_linenum_execution_filter` '
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Very rare to perform such an extensive grep on a system, however
diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
index 6d11f54685..b7d34df51b 100644
--- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml
+++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This search detects Linux Exploit Suggester tool execution. This is a
   tool that searches for vulnerabilities based on Kernel and Distribution versions
   then queries public exploit databases.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process="uname -a" OR Processes.process="cvelist-file:*" OR Processes.process="*exploit*" OR Processes.process="*exploit-db*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_linux_exploit_suggester_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml
index ca58d97f34..fc82708395 100644
--- a/detections/endpoint/detect_mimipenguin.yml
+++ b/detections/endpoint/detect_mimipenguin.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: MimiPenguin is a tool that dumps login passwords from current linux destop
   users. This search detects execution of this tool.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process="strings -e /etc/apache2/apache2.conf" OR Processes.process="strings -e /etc/ssh/sshd_config" OR Processes.process="strings -e /etc/shadow" by Processes.dest 
   Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimipenguin_filter`'

From b095a626819d2be94ca84de6b4f9fb73b9448b07 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 26 Jan 2022 13:44:57 -0800
Subject: [PATCH 03/17] minor upddates

---
 ...detect_autosuid_post_exploitation_tool.yml | 20 +++++++++++--------
 .../endpoint/detect_linenum_execution.yml     | 15 +++++++++-----
 .../endpoint/detect_linpeas_execution.yml     | 16 +++++++++------
 ...tect_linux_exploit_suggester_execution.yml |  4 ++--
 4 files changed, 34 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
index 0e35feffbf..018d575224 100644
--- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
+++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
@@ -26,20 +26,19 @@ tags:
   automated_detection_testing: passed
   confidence: 90
   context:
-  - Source: Endpoint
-  - Stage: Discovery
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
   impact: 90
   kill_chain_phases:
   - Exploitation
-  - Privilege Escalation
-  message: AutoSUID post exploitation tool detected
+  message: AutoSUID post exploitation tool detected on $dest$
   mitre_attack_id:
   - T1069
   - T1222
   observable:
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim
@@ -49,9 +48,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Computer
+  - dest
+  - user
   - process
-  - process_path
-  - process_current_directory
+  - parent_process_name
+  - user 
+  - process_name
+  - process_id 
+  - parent_process_id 
+  - process_guid
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml
index 9325ac2d27..2e86488d62 100644
--- a/detections/endpoint/detect_linenum_execution.yml
+++ b/detections/endpoint/detect_linenum_execution.yml
@@ -36,7 +36,7 @@ tags:
   impact: 50
   kill_chain_phases:
   - Privilege Escalation
-  message: LinEnum post exploitation tool detected
+  message: LinEnum post exploitation tool detectedonn $dest$
   mitre_attack_id:
   - T1087
   - T1069
@@ -47,7 +47,7 @@ tags:
   - T1016
   - T1033
   observable:
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim
@@ -57,9 +57,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - CommandLine
+  - dest
   - user
-  - process_exec
-  - process_current_directory
+  - process
+  - parent_process_name
+  - user 
+  - process_name
+  - process_id 
+  - parent_process_id 
+  - process_guid
   risk_score: 45
   security_domain: endpoint
diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml
index e4863682bf..1a7ee0715c 100644
--- a/detections/endpoint/detect_linpeas_execution.yml
+++ b/detections/endpoint/detect_linpeas_execution.yml
@@ -33,7 +33,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   - Privilege Escalation
-  message: LinPEAS post exploitation tool detected
+  message: LinPEAS post exploitation tool detected on $dest$
   mitre_attack_id:
   - T1082
   - T1083
@@ -44,7 +44,7 @@ tags:
   - T1518
   - T1033
   observable:
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim
@@ -54,10 +54,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Computer
-  - CommandLine
+  - dest
   - user
-  - parent_process_exec
-  - process_path
+  - process
+  - parent_process_name
+  - user 
+  - process_name
+  - process_id 
+  - parent_process_id 
+  - process_guid
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
index b7d34df51b..3194022906 100644
--- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml
+++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
@@ -25,8 +25,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: endpoint
-  - Stage: discovery
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
   impact: 90

From 3d3638c2e40be2038db71f89f9715025db23e5cd Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 26 Jan 2022 14:20:54 -0800
Subject: [PATCH 04/17] story file

---
 macros/sysmon_linux.yml             | 4 ----
 stories/linux_post_exploitation.yml | 2 +-
 2 files changed, 1 insertion(+), 5 deletions(-)
 delete mode 100644 macros/sysmon_linux.yml

diff --git a/macros/sysmon_linux.yml b/macros/sysmon_linux.yml
deleted file mode 100644
index 7482f5a592..0000000000
--- a/macros/sysmon_linux.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-definition: source=Syslog:Linux-Sysmon/Operational
-description: customer specific splunk configurations(eg- index, source, sourcetype).
-  Replace the macro definition with configurations for your Splunk Environmnent.
-name: sysmon_linux
diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml
index 9ca9a638bb..c6050f86f4 100644
--- a/stories/linux_post_exploitation.yml
+++ b/stories/linux_post_exploitation.yml
@@ -17,4 +17,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  usecase: Security Monitoring
+  usecase: Security Monitoring
\ No newline at end of file

From 328417d4fa6feb2ca2ca2fb878a85ae2c8c653e3 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 26 Jan 2022 14:31:04 -0800
Subject: [PATCH 05/17] test files

---
 .../detect_autosuid_post_exploitation_tool.test.yml  | 12 ++++++++++++
 tests/endpoint/detect_linenum_execution.test.yml     | 12 ++++++++++++
 tests/endpoint/detect_linpeas_execution.test.yml     | 12 ++++++++++++
 ...detect_linux_exploit_suggester_execution.test.yml | 12 ++++++++++++
 tests/endpoint/detect_mimipenguin.test.yml           | 12 ++++++++++++
 5 files changed, 60 insertions(+)
 create mode 100644 tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
 create mode 100644 tests/endpoint/detect_linenum_execution.test.yml
 create mode 100644 tests/endpoint/detect_linpeas_execution.test.yml
 create mode 100644 tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
 create mode 100644 tests/endpoint/detect_mimipenguin.test.yml

diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
new file mode 100644
index 0000000000..29c16b458d
--- /dev/null
+++ b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
@@ -0,0 +1,12 @@
+name: Detect AutoSUID post exploitation tool Unit Test
+tests:
+- name: Detect AutoSUID post exploitation tool
+  file: endpoint/detect_autosuid_post_exploitation_tool.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: autoSUID.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml
new file mode 100644
index 0000000000..85d7de99da
--- /dev/null
+++ b/tests/endpoint/detect_linenum_execution.test.yml
@@ -0,0 +1,12 @@
+name: Detect LinEnum execution unit Test
+tests:
+- name: Detect LinEnum execution
+  file: endpoint/detect_linenum_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: LinuxEnumd.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml
new file mode 100644
index 0000000000..1e7397a056
--- /dev/null
+++ b/tests/endpoint/detect_linpeas_execution.test.yml
@@ -0,0 +1,12 @@
+name: Detect LinPeas Execution Unit Test
+tests:
+- name: Detect LinPeas Execution
+  file: endpoint/detect_linpeas_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: linpeasdataset.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
new file mode 100644
index 0000000000..1efcd32d23
--- /dev/null
+++ b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
@@ -0,0 +1,12 @@
+name: Detect Linux Exploit Suggester Execution Unit Test
+tests:
+- name: Detect Linux Exploit Suggester Execution
+  file: endpoint/detect_linux_exploit_suggester_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: linuxexploitsuggesterdatasets.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml
new file mode 100644
index 0000000000..a2fff212b5
--- /dev/null
+++ b/tests/endpoint/detect_mimipenguin.test.yml
@@ -0,0 +1,12 @@
+name: Detect MimiPenguin Unit Test
+tests:
+- name: Detect MimiPenguin
+  file: endpoint/detect_mimipenguin.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: mimipenguin.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

From 34f231e3a2b112367a47610a9e97bfe3ea89175a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 14 Feb 2022 13:51:34 -0800
Subject: [PATCH 06/17] version 1

---
 .../suspcious_linux_discovery_commands.yml    | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 detections/endpoint/suspcious_linux_discovery_commands.yml

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
new file mode 100644
index 0000000000..4404432843
--- /dev/null
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -0,0 +1,61 @@
+name: Suspcious Linux Discovery Commands
+id: 0edd5112-56c9-11ec-b990-acde48001122
+version: 1
+date: '2021-12-06'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search, detects Linux post exploitation tool AutoSUID, which is
+  an a tool that searches for SUID executables files in order to escalate privileges.
+search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as dc min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where Processes.process
+    IN ("uname -a","cat /proc/version", "cat /etc/*-release","/etc/passwd" ,"cat /etc/*", "lastlog", "id","PermitRootLogin","sestatus *","ps","sudo*","mysql*","netstat*","find *","mysql*","head /var/mail/root","docker","cat /etc/issue","cat /etc/*-release","cat /proc/version","uname -a","uname -mrs","rpm -q kernel","dmesg | grep Linux","ls /boot | grep vmlinuz-","cat /etc/profile","cat /etc/bashrc","cat ~/.bash_profile","cat ~/.bashrc","cat ~/.bash_logout", "ps -aux | grep root","ps -ef | grep root","crontab -l","cat /etc/cron*","cat /etc/cron.allow","cat /etc/cron.deny","cat /etc/crontab","grep -i user *","grep -i pass *","ifconfig","cat /etc/network/interfaces","cat /etc/sysconfig/network","cat /etc/resolv.conf","cat /etc/networks","iptables -L","lsof -i","netstat -antup","netstat -antpx","netstat -tulpn","arp -e","route","cat /etc/passwd","cat /etc/group","cat /etc/shadow","find / -perm -u=s","find / -perm -g=s","find / -perm -4000","find / -perm -2000") by _time span=5m Processes.user Processes.dest
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`| `suspcious_linux_discovery_commands_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/)
+  Please install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Unless an administrator is using these commands to troubleshoot
+  or audit a system, the execution of these commands should be monitored.
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+- https://github.com/IvanGlinkin/AutoSUID
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Suspcious Linux Discovery Commands detected on $dest$
+  mitre_attack_id:
+  - T1059.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - user
+  - process
+  - parent_process_name
+  - user 
+  - process_name
+  - process_id 
+  - parent_process_id 
+  - process_guid
+  risk_score: 81
+  security_domain: endpoint

From c521d07f7d05938f58102d585c043c9883738d87 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 14 Feb 2022 14:59:36 -0800
Subject: [PATCH 07/17] file updates

---
 .../suspcious_linux_discovery_commands.yml    | 28 ++++++++-----------
 ...uspcious_linux_discovery_commands.test.yml |  0
 2 files changed, 12 insertions(+), 16 deletions(-)
 create mode 100644 tests/endpoint/suspcious_linux_discovery_commands.test.yml

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
index 4404432843..e05e41eee2 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -6,21 +6,22 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search, detects Linux post exploitation tool AutoSUID, which is
-  an a tool that searches for SUID executables files in order to escalate privileges.
+description: This search, detects execution of high number of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of vulnerable directories, executables and file permissions on a Linux host. The search logic specifically looks for high number of distinct commands run in a short period of time. 
 search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as dc min(_time) as firstTime max(_time)
     as lastTime from datamodel=Endpoint.Processes where Processes.process
-    IN ("uname -a","cat /proc/version", "cat /etc/*-release","/etc/passwd" ,"cat /etc/*", "lastlog", "id","PermitRootLogin","sestatus *","ps","sudo*","mysql*","netstat*","find *","mysql*","head /var/mail/root","docker","cat /etc/issue","cat /etc/*-release","cat /proc/version","uname -a","uname -mrs","rpm -q kernel","dmesg | grep Linux","ls /boot | grep vmlinuz-","cat /etc/profile","cat /etc/bashrc","cat ~/.bash_profile","cat ~/.bashrc","cat ~/.bash_logout", "ps -aux | grep root","ps -ef | grep root","crontab -l","cat /etc/cron*","cat /etc/cron.allow","cat /etc/cron.deny","cat /etc/crontab","grep -i user *","grep -i pass *","ifconfig","cat /etc/network/interfaces","cat /etc/sysconfig/network","cat /etc/resolv.conf","cat /etc/networks","iptables -L","lsof -i","netstat -antup","netstat -antpx","netstat -tulpn","arp -e","route","cat /etc/passwd","cat /etc/group","cat /etc/shadow","find / -perm -u=s","find / -perm -g=s","find / -perm -4000","find / -perm -2000") by _time span=5m Processes.user Processes.dest
+    IN ("uname -a","cat /proc/version", "cat /etc/*-release","/etc/passwd" ,"cat /etc/*", "lastlog", "id","PermitRootLogin","sestatus *","ps","mysql*","netstat*","find *","mysql*","head /var/mail/root","docker","cat /etc/issue","cat /etc/*-release","cat /proc/version","uname -a","uname -mrs","rpm -q kernel","dmesg | grep Linux","ls /boot | grep vmlinuz-","cat /etc/profile","cat /etc/bashrc","cat ~/.bash_profile","cat ~/.bashrc","cat ~/.bash_logout", "ps -aux | grep root","ps -ef | grep root","crontab -l","cat /etc/cron*","cat /etc/cron.allow","cat /etc/cron.deny","cat /etc/crontab","grep -i user *","grep -i pass *","ifconfig","cat /etc/network/interfaces","cat /etc/sysconfig/network","cat /etc/resolv.conf","cat /etc/networks","iptables -L","lsof -i","netstat -antup","netstat -antpx","netstat -tulpn","arp -e","route","cat /etc/passwd","cat /etc/group","cat /etc/shadow","find / -perm -u=s","find / -perm -g=s","find / -perm -4000","find / -perm -2000") by _time span=5m Processes.user Processes.dest 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`| `suspcious_linux_discovery_commands_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/)
-  Please install this add-on to parse fields correctly and execute detection search.
+| `security_content_ctime(lastTime)`| where dc>40| `suspcious_linux_discovery_commands_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
+  Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
 known_false_positives: Unless an administrator is using these commands to troubleshoot
   or audit a system, the execution of these commands should be monitored.
 references:
 - https://attack.mitre.org/matrices/enterprise/linux/
 - https://github.com/IvanGlinkin/AutoSUID
+- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
+- https://github.com/rebootuser/LinEnum
 tags:
   analytic_story:
   - Linux Post-Exploitation
@@ -30,7 +31,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
   impact: 90
   kill_chain_phases:
   - Exploitation
@@ -48,14 +49,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.user 
+  - Processes.process_name
   risk_score: 81
   security_domain: endpoint
diff --git a/tests/endpoint/suspcious_linux_discovery_commands.test.yml b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
new file mode 100644
index 0000000000..e69de29bb2

From 11ab86fdf4d5cde5f581722fec7945381c8fa78c Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 14 Feb 2022 15:03:24 -0800
Subject: [PATCH 08/17] remove detections aalready covered

---
 ...detect_autosuid_post_exploitation_tool.yml | 61 ----------------
 .../endpoint/detect_linenum_execution.yml     | 70 -------------------
 .../endpoint/detect_linpeas_execution.yml     | 67 ------------------
 ...t_autosuid_post_exploitation_tool.test.yml | 12 ----
 .../detect_linenum_execution.test.yml         | 12 ----
 .../detect_linpeas_execution.test.yml         | 12 ----
 ...uspcious_linux_discovery_commands.test.yml | 12 ++++
 7 files changed, 12 insertions(+), 234 deletions(-)
 delete mode 100644 detections/endpoint/detect_autosuid_post_exploitation_tool.yml
 delete mode 100644 detections/endpoint/detect_linenum_execution.yml
 delete mode 100644 detections/endpoint/detect_linpeas_execution.yml
 delete mode 100644 tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
 delete mode 100644 tests/endpoint/detect_linenum_execution.test.yml
 delete mode 100644 tests/endpoint/detect_linpeas_execution.test.yml

diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
deleted file mode 100644
index 018d575224..0000000000
--- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-name: Detect AutoSUID post exploitation tool
-id: 0edd5862-56c9-11ec-b990-acde48001122
-version: 1
-date: '2021-12-06'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: This search, detects Linux post exploitation tool AutoSUID, which is
-  an a tool that searches for SUID executables files in order to escalate privileges.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process = "find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )"
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_autosuid_post_exploitation_tool_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Unless an administrator is using these commands to troubleshoot
-  or audit a system, the execution of these commands should be monitored.
-references:
-- https://attack.mitre.org/matrices/enterprise/linux/
-- https://github.com/IvanGlinkin/AutoSUID
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 90
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
-  impact: 90
-  kill_chain_phases:
-  - Exploitation
-  message: AutoSUID post exploitation tool detected on $dest$
-  mitre_attack_id:
-  - T1069
-  - T1222
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 81
-  security_domain: endpoint
diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml
deleted file mode 100644
index 2e86488d62..0000000000
--- a/detections/endpoint/detect_linenum_execution.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: Detect LinEnum execution
-id: 570e5278-5479-11ec-89c8-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: LinEnum is a bash script that performs discovery commands for accounts,
-  processes, kernel version, applications, services, and uses the information from
-  these commands to present operator with ways of escalating privileges or further
-  exploitation of targeted host.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.process = "grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
-    by Processes.dest Processes.user Processes.parent_process_name Processes.process_current_directory
-    Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  `detect_linenum_execution_filter` '
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Very rare to perform such an extensive grep on a system, however
-  certain monitoring tools can produce similar results. It is important if monitoring
-  tools are in place to verify what is the actual process directory of execution.
-references:
-- https://github.com/rebootuser/LinEnum
-- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 90
-  context:
-  - Source: endpoint
-  - Stage: discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
-  impact: 50
-  kill_chain_phases:
-  - Privilege Escalation
-  message: LinEnum post exploitation tool detectedonn $dest$
-  mitre_attack_id:
-  - T1087
-  - T1069
-  - T1083
-  - T1057
-  - T1518
-  - T1082
-  - T1016
-  - T1033
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 45
-  security_domain: endpoint
diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml
deleted file mode 100644
index 1a7ee0715c..0000000000
--- a/detections/endpoint/detect_linpeas_execution.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: Detect LinPeas Execution
-id: 4ea6fa10-547c-11ec-a4f9-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto, Eric McGinnis
-type: TTP
-datamodel:
-- Endpoint
-description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script
-  that searches for possible paths to escalate privileges.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process= "grep -Ev ._history.|.bashrc|.bluemix|.cer|.cloudflared|.crt|.csr|.db|.der|.env|.erlang.cookie|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd|.irssi|.jks|.k5login|.kdbx|.key|.keyring|.keystore|.ldaprc|.lesshst|.mozilla|.msmtprc|.ovpn|.p12|.pem|.pfx|.pgp|.plan|.profile|.pypirc|.rdg|.recently-used.xbel|.rhosts|.secrets.mkey|.service|.socket|.sqlite|.sqlite3|.sudo_as_admin_successful|.svn|.swp|.timer|.vault-token|.viminfo|.vnc|.wgetrc" OR Processes.process="find /var/log/ /private/var/log -type f -exec grep -R -a -E -o (25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) {} ;" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid| `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `detect_linpeas_execution_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: This search may produce false positives as it will display
-  many sudo executed processess however, the cve-list within the command line it is
-  a clear indicator, operator is searching for local vulnerabilites.
-references:
-- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
-- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
-- https://attack.mitre.org/matrices/enterprise/linux/
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  confidence: 100
-  context:
-  - Source: endpoint
-  - Stage: discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
-  impact: 90
-  kill_chain_phases:
-  - Exploitation
-  - Privilege Escalation
-  message: LinPEAS post exploitation tool detected on $dest$
-  mitre_attack_id:
-  - T1082
-  - T1083
-  - T1033
-  - T1087
-  - T1046
-  - T1057
-  - T1518
-  - T1033
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 90
-  security_domain: endpoint
diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
deleted file mode 100644
index 29c16b458d..0000000000
--- a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect AutoSUID post exploitation tool Unit Test
-tests:
-- name: Detect AutoSUID post exploitation tool
-  file: endpoint/detect_autosuid_post_exploitation_tool.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: autoSUID.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml
deleted file mode 100644
index 85d7de99da..0000000000
--- a/tests/endpoint/detect_linenum_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect LinEnum execution unit Test
-tests:
-- name: Detect LinEnum execution
-  file: endpoint/detect_linenum_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: LinuxEnumd.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml
deleted file mode 100644
index 1e7397a056..0000000000
--- a/tests/endpoint/detect_linpeas_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect LinPeas Execution Unit Test
-tests:
-- name: Detect LinPeas Execution
-  file: endpoint/detect_linpeas_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: linpeasdataset.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/suspcious_linux_discovery_commands.test.yml b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
index e69de29bb2..c9de874729 100644
--- a/tests/endpoint/suspcious_linux_discovery_commands.test.yml
+++ b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
@@ -0,0 +1,12 @@
+name: Suspcious Linux Discovery Commands
+tests:
+- name: Linux Possible Access To Sudoers File
+  file: endpoint/suspcious_linux_discovery_commands.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file

From e2b0e4c32bfcc62c91f0491c3ca1b9fa244cc25c Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Feb 2022 10:21:43 -0800
Subject: [PATCH 09/17] mionr

---
 detections/endpoint/suspcious_linux_discovery_commands.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
index e05e41eee2..ac97bf33cc 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -19,6 +19,7 @@ known_false_positives: Unless an administrator is using these commands to troubl
   or audit a system, the execution of these commands should be monitored.
 references:
 - https://attack.mitre.org/matrices/enterprise/linux/
+- https://attack.mitre.org/techniques/T1059/004/
 - https://github.com/IvanGlinkin/AutoSUID
 - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
 - https://github.com/rebootuser/LinEnum

From 9d780700de404bc0b469e4816f4041e98d7494bc Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 16 Feb 2022 16:23:19 -0800
Subject: [PATCH 10/17] lookupss

---
 lookups/linux_tool_discovery_process.csv | 56 ++++++++++++++++++++++++
 lookups/linux_tool_discovery_process.yml |  7 +++
 2 files changed, 63 insertions(+)
 create mode 100644 lookups/linux_tool_discovery_process.csv
 create mode 100644 lookups/linux_tool_discovery_process.yml

diff --git a/lookups/linux_tool_discovery_process.csv b/lookups/linux_tool_discovery_process.csv
new file mode 100644
index 0000000000..4075875c08
--- /dev/null
+++ b/lookups/linux_tool_discovery_process.csv
@@ -0,0 +1,56 @@
+process
+cat /proc/version
+cat /etc/*-release
+/etc/passwd 
+cat /etc/*
+lastlog 
+id
+PermitRootLogin
+sestatus *
+ps
+mysql*
+netstat*
+find *
+head /var/mail/root
+docker
+cat /etc/issue
+cat /etc/*-release
+cat /proc/version
+uname -a
+uname -mrs
+rpm -q kernel
+dmesg | grep Linux
+ls /boot | grep vmlinuz-
+cat /etc/profile
+cat /etc/bashrc
+cat ~/.bash_profile
+cat ~/.bashrc
+cat ~/.bash_logout
+ps -aux | grep root
+ps -ef | grep root
+crontab -l
+cat /etc/cron*
+cat /etc/cron.allow
+cat /etc/cron.deny
+cat /etc/crontab
+grep -i user *
+grep -i pass *
+ifconfig
+cat /etc/network/interfaces
+cat /etc/sysconfig/network
+cat /etc/resolv.conf
+cat /etc/networks
+iptables -L
+lsof -i
+netstat -antup
+netstat -antpx
+netstat -tulpn
+arp -e
+route
+cat /etc/passwd
+cat /etc/group
+cat /etc/shadow
+find / -perm -u=s
+find / -perm -g=s
+find / -perm -4000
+find / -perm -2000
\ No newline at end of file
diff --git a/lookups/linux_tool_discovery_process.yml b/lookups/linux_tool_discovery_process.yml
new file mode 100644
index 0000000000..51eee3b99a
--- /dev/null
+++ b/lookups/linux_tool_discovery_process.yml
@@ -0,0 +1,7 @@
+description: A list of suspcious bash commonly used by attackers via scripts
+filename: linux_tool_discovery_process.csv
+name: linux_tool_discovery_process
+default_match: 'false'
+match_type: WILDCARD(process)
+min_matches: 1
+case_sensitive_match: 'false'
\ No newline at end of file

From c80a1fdb8343d8465265c49728857907eba12200 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 16 Feb 2022 16:26:43 -0800
Subject: [PATCH 11/17] spl update

---
 detections/endpoint/suspcious_linux_discovery_commands.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
index ac97bf33cc..0e44085aa0 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -8,8 +8,7 @@ datamodel:
 - Endpoint
 description: This search, detects execution of high number of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of vulnerable directories, executables and file permissions on a Linux host. The search logic specifically looks for high number of distinct commands run in a short period of time. 
 search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as dc min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.process
-    IN ("uname -a","cat /proc/version", "cat /etc/*-release","/etc/passwd" ,"cat /etc/*", "lastlog", "id","PermitRootLogin","sestatus *","ps","mysql*","netstat*","find *","mysql*","head /var/mail/root","docker","cat /etc/issue","cat /etc/*-release","cat /proc/version","uname -a","uname -mrs","rpm -q kernel","dmesg | grep Linux","ls /boot | grep vmlinuz-","cat /etc/profile","cat /etc/bashrc","cat ~/.bash_profile","cat ~/.bashrc","cat ~/.bash_logout", "ps -aux | grep root","ps -ef | grep root","crontab -l","cat /etc/cron*","cat /etc/cron.allow","cat /etc/cron.deny","cat /etc/crontab","grep -i user *","grep -i pass *","ifconfig","cat /etc/network/interfaces","cat /etc/sysconfig/network","cat /etc/resolv.conf","cat /etc/networks","iptables -L","lsof -i","netstat -antup","netstat -antpx","netstat -tulpn","arp -e","route","cat /etc/passwd","cat /etc/group","cat /etc/shadow","find / -perm -u=s","find / -perm -g=s","find / -perm -4000","find / -perm -2000") by _time span=5m Processes.user Processes.dest 
+    as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)`| where dc>40| `suspcious_linux_discovery_commands_filter`'

From 52d0996b0af19d19d1a8fa27aa699a9053b3bcd4 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 17 Feb 2022 16:28:19 -0800
Subject: [PATCH 12/17] combined the rest 2

---
 ...tect_linux_exploit_suggester_execution.yml | 57 -------------------
 detections/endpoint/detect_mimipenguin.yml    | 55 ------------------
 lookups/linux_tool_discovery_process.csv      |  5 ++
 ...linux_exploit_suggester_execution.test.yml | 12 ----
 tests/endpoint/detect_mimipenguin.test.yml    | 12 ----
 5 files changed, 5 insertions(+), 136 deletions(-)
 delete mode 100644 detections/endpoint/detect_linux_exploit_suggester_execution.yml
 delete mode 100644 detections/endpoint/detect_mimipenguin.yml
 delete mode 100644 tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
 delete mode 100644 tests/endpoint/detect_mimipenguin.test.yml

diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
deleted file mode 100644
index 3194022906..0000000000
--- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Detect Linux Exploit Suggester Execution
-id: a4f34d5c-547b-11ec-ba88-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: This search detects Linux Exploit Suggester tool execution. This is a
-  tool that searches for vulnerabilities based on Kernel and Distribution versions
-  then queries public exploit databases.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process="uname -a" OR Processes.process="cvelist-file:*" OR Processes.process="*exploit*" OR Processes.process="*exploit-db*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_linux_exploit_suggester_execution_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Monitoring tools may produce similar commands although the
-  presence of "exploit-db" is very unusual.
-references:
-- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
-- https://attack.mitre.org/matrices/enterprise/linux/
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 100
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
-  impact: 90
-  kill_chain_phases:
-  - Exploitation
-  - Privilege Escalation
-  message: Linux Exploit Suggester post exploitation tool detected.
-  mitre_attack_id:
-  - T1087
-  - T1083
-  - T1069
-  - T1057
-  - T1518
-  - T1082
-  observable:
-  - name: Computer
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - CommandLine
-  risk_score: 90
-  security_domain: endpoint
diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml
deleted file mode 100644
index fc82708395..0000000000
--- a/detections/endpoint/detect_mimipenguin.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Detect MimiPenguin
-id: 1ad20afa-547b-11ec-b4e7-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: MimiPenguin is a tool that dumps login passwords from current linux destop
-  users. This search detects execution of this tool.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process="strings -e /etc/apache2/apache2.conf" OR Processes.process="strings -e /etc/ssh/sshd_config" OR Processes.process="strings -e /etc/shadow" by Processes.dest 
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimipenguin_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Some of these commands may be executed by sysadmin however
-  not in the proximity and frequency, specially if querying for tools are that knonwn
-  not to be installed at target system.
-references:
-- https://github.com/huntergregal/mimipenguin
-- https://attack.mitre.org/matrices/enterprise/linux/
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 70
-  context:
-  - Source: endpoint
-  - Stage: discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
-  impact: 50
-  kill_chain_phases:
-  - Privilege Escalation
-  message: MimiPenguin post exploitation tool detected
-  mitre_attack_id:
-  - T1552
-  observable:
-  - name: Computer
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - user
-  - Computer
-  - parent_process
-  - process_current_directory
-  risk_score: 35
-  security_domain: endpoint
diff --git a/lookups/linux_tool_discovery_process.csv b/lookups/linux_tool_discovery_process.csv
index 4075875c08..98b55d4efc 100644
--- a/lookups/linux_tool_discovery_process.csv
+++ b/lookups/linux_tool_discovery_process.csv
@@ -40,6 +40,11 @@ cat /etc/network/interfaces
 cat /etc/sysconfig/network
 cat /etc/resolv.conf
 cat /etc/networks
+cvelist-file:*
+exploit-db*
+strings -e /etc/apache2/apache2.conf
+strings -e /etc/ssh/sshd_config
+strings -e /etc/shadow
 iptables -L
 lsof -i
 netstat -antup
diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
deleted file mode 100644
index 1efcd32d23..0000000000
--- a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect Linux Exploit Suggester Execution Unit Test
-tests:
-- name: Detect Linux Exploit Suggester Execution
-  file: endpoint/detect_linux_exploit_suggester_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: linuxexploitsuggesterdatasets.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml
deleted file mode 100644
index a2fff212b5..0000000000
--- a/tests/endpoint/detect_mimipenguin.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect MimiPenguin Unit Test
-tests:
-- name: Detect MimiPenguin
-  file: endpoint/detect_mimipenguin.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: mimipenguin.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"

From ac9c46cffa1c31335d43e3aec98f770af8b685fa Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 17 Feb 2022 16:44:09 -0800
Subject: [PATCH 13/17] updating search conditions

---
 .../endpoint/suspcious_linux_discovery_commands.yml       | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
index 0e44085aa0..35e130287f 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -6,12 +6,14 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search, detects execution of high number of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of vulnerable directories, executables and file permissions on a Linux host. The search logic specifically looks for high number of distinct commands run in a short period of time. 
-search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as dc min(_time) as firstTime max(_time)
+description: This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\
+  
+  The search logic specifically looks for high number of distinct commands run in a short period of time. 
+search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time) as firstTime max(_time)
     as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`| where dc>40| `suspcious_linux_discovery_commands_filter`'
+| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspcious_linux_discovery_commands_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
   Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
 known_false_positives: Unless an administrator is using these commands to troubleshoot

From 2c3f316756f32bba1cec621d219a65ef052f5e97 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 24 Feb 2022 12:10:55 -0800
Subject: [PATCH 14/17] Update suspcious_linux_discovery_commands.test.yml

---
 tests/endpoint/suspcious_linux_discovery_commands.test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/suspcious_linux_discovery_commands.test.yml b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
index c9de874729..0031680c1a 100644
--- a/tests/endpoint/suspcious_linux_discovery_commands.test.yml
+++ b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
@@ -3,10 +3,10 @@ tests:
 - name: Linux Possible Access To Sudoers File
   file: endpoint/suspcious_linux_discovery_commands.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-30d'
+  earliest_time: '-60d'
   latest_time: 'now'
   attack_data:
   - file_name: sysmon_linux.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
-    sourcetype: sysmon_linux
\ No newline at end of file
+    sourcetype: sysmon_linux

From 73752624a8282ec65afed63719e23942b902f54c Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 24 Feb 2022 14:54:46 -0700
Subject: [PATCH 15/17] updated story words

---
 stories/linux_post_exploitation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml
index c6050f86f4..0561684590 100644
--- a/stories/linux_post_exploitation.yml
+++ b/stories/linux_post_exploitation.yml
@@ -3,7 +3,7 @@ id: d310ccfe-5477-11ec-ad05-acde48001122
 version: 1
 date: '2021-12-03'
 author: Rod Soto
-description: This analytic story detects popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin
+description: This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.
 narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.
 references:
 - https://attack.mitre.org/matrices/enterprise/linux/

From 68dde34dc8fa01ae5fac18199985c15688978d4a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 24 Feb 2022 14:14:13 -0800
Subject: [PATCH 16/17] rename typo

---
 ...commands.yml => suspicious_linux_discovery_commands.yml} | 6 +++---
 lookups/linux_tool_discovery_process.yml                    | 2 +-
 ...est.yml => suspicious_linux_discovery_commands.test.yml} | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)
 rename detections/endpoint/{suspcious_linux_discovery_commands.yml => suspicious_linux_discovery_commands.yml} (93%)
 rename tests/endpoint/{suspcious_linux_discovery_commands.test.yml => suspicious_linux_discovery_commands.test.yml} (72%)

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml
similarity index 93%
rename from detections/endpoint/suspcious_linux_discovery_commands.yml
rename to detections/endpoint/suspicious_linux_discovery_commands.yml
index 35e130287f..1a03a880dc 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspicious_linux_discovery_commands.yml
@@ -1,4 +1,4 @@
-name: Suspcious Linux Discovery Commands
+name: Suspicious Linux Discovery Commands
 id: 0edd5112-56c9-11ec-b990-acde48001122
 version: 1
 date: '2021-12-06'
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
     as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspcious_linux_discovery_commands_filter`'
+| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
   Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
 known_false_positives: Unless an administrator is using these commands to troubleshoot
@@ -37,7 +37,7 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: Suspcious Linux Discovery Commands detected on $dest$
+  message: Suspicious Linux Discovery Commands detected on $dest$
   mitre_attack_id:
   - T1059.004
   observable:
diff --git a/lookups/linux_tool_discovery_process.yml b/lookups/linux_tool_discovery_process.yml
index 51eee3b99a..645544a521 100644
--- a/lookups/linux_tool_discovery_process.yml
+++ b/lookups/linux_tool_discovery_process.yml
@@ -1,4 +1,4 @@
-description: A list of suspcious bash commonly used by attackers via scripts
+description: A list of suspicious bash commonly used by attackers via scripts
 filename: linux_tool_discovery_process.csv
 name: linux_tool_discovery_process
 default_match: 'false'
diff --git a/tests/endpoint/suspcious_linux_discovery_commands.test.yml b/tests/endpoint/suspicious_linux_discovery_commands.test.yml
similarity index 72%
rename from tests/endpoint/suspcious_linux_discovery_commands.test.yml
rename to tests/endpoint/suspicious_linux_discovery_commands.test.yml
index c9de874729..0dcb7dac11 100644
--- a/tests/endpoint/suspcious_linux_discovery_commands.test.yml
+++ b/tests/endpoint/suspicious_linux_discovery_commands.test.yml
@@ -1,7 +1,7 @@
-name: Suspcious Linux Discovery Commands
+name: Suspicious Linux Discovery Commands
 tests:
-- name: Linux Possible Access To Sudoers File
-  file: endpoint/suspcious_linux_discovery_commands.yml
+- name: Suspicious Linux Discovery Commands
+  file: endpoint/suspicious_linux_discovery_commands.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-30d'
   latest_time: 'now'

From 55ffc28ae70a66967176996581e7b2db9900ff11 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 24 Feb 2022 14:37:20 -0800
Subject: [PATCH 17/17] Update linux_post_exploitation.yml

---
 stories/linux_post_exploitation.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml
index 0561684590..f6214e87de 100644
--- a/stories/linux_post_exploitation.yml
+++ b/stories/linux_post_exploitation.yml
@@ -12,9 +12,8 @@ tags:
   - Linux Post-Exploitation
   category:
   - Adversary Tactics
-  - Privilege Escalation
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  usecase: Security Monitoring
\ No newline at end of file
+  usecase: Security Monitoring