From fb087ea8b3ab3562bcd7fda90cf6946d7e404b07 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 21 Dec 2021 11:02:15 +0100 Subject: [PATCH 01/14] linux_persist_priv_batch_1 --- ...add_files_in_known_crontab_directories.yml | 69 ++++++++++++++++++ .../linux_at_allow_config_file_creation.yml | 69 ++++++++++++++++++ .../linux_at_application_execution.yml | 70 ++++++++++++++++++ .../linux_edit_cron_table_parameter.yml | 70 ++++++++++++++++++ ...append_command_to_at_allow_config_file.yml | 73 +++++++++++++++++++ ...cronjob_entry_on_existing_cronjob_file.yml | 72 ++++++++++++++++++ ...sible_cronjob_modification_with_editor.yml | 70 ++++++++++++++++++ stories/linux_persistence_techniques.yml | 27 +++++++ stories/linux_privilege_escalation.yml | 27 +++++++ ...iles_in_known_crontab_directories.test.yml | 12 +++ ...nux_at_allow_config_file_creation.test.yml | 12 +++ .../linux_at_application_execution.test.yml | 12 +++ .../linux_edit_cron_table_parameter.test.yml | 12 +++ ...d_command_to_at_allow_config_file.test.yml | 12 +++ ...ob_entry_on_existing_cronjob_file.test.yml | 12 +++ ..._cronjob_modification_with_editor.test.yml | 12 +++ 16 files changed, 631 insertions(+) create mode 100644 detections/endpoint/linux_add_files_in_known_crontab_directories.yml create mode 100644 detections/endpoint/linux_at_allow_config_file_creation.yml create mode 100644 detections/endpoint/linux_at_application_execution.yml create mode 100644 detections/endpoint/linux_edit_cron_table_parameter.yml create mode 100644 detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml create mode 100644 detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml create mode 100644 detections/endpoint/linux_possible_cronjob_modification_with_editor.yml create mode 100644 stories/linux_persistence_techniques.yml create mode 100644 stories/linux_privilege_escalation.yml create mode 100644 tests/endpoint/linux_add_files_in_known_crontab_directories.test.yml create mode 100644 tests/endpoint/linux_at_allow_config_file_creation.test.yml create mode 100644 tests/endpoint/linux_at_application_execution.test.yml create mode 100644 tests/endpoint/linux_edit_cron_table_parameter.test.yml create mode 100644 tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml create mode 100644 tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml create mode 100644 tests/endpoint/linux_possible_cronjob_modification_with_editor.test.yml diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml new file mode 100644 index 0000000000..4ad54b00a0 --- /dev/null +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -0,0 +1,69 @@ +name: Linux Add Files In Known Crontab Directories +id: 023f3452-5f27-11ec-bf00-acde48001122 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a suspicious file creation in known cron table directories. + This event is commonly abuse by malware, adversaries and red teamers to persist on the target or compromised host. + crontab or cronjob is like a schedule task in windows environment where you can create an executable or script on the known crontab directories to + run it base on its schedule. This Anomaly query is a good indicator to look further what file is added and who added the file if to consider it legitimate file. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path IN ("*/etc/cron*", "*/var/spool/cron/*") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `linux_add_files_in_known_crontab_directories_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can create file in crontab folders for automation purposes. filter is needed +references: +- https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/ +- https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.003 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml new file mode 100644 index 0000000000..fe911eb592 --- /dev/null +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -0,0 +1,69 @@ +name: Linux At Allow Config File Creation +id: 977b3082-5f3d-11ec-b954-acde48001122 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a suspicious file creation of /etc/at.allow or /etc/at.deny. + These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. + These config file can restrict user that can only execute at application (another schedule task application in linux). attacker can + create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection + can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path IN ("*/etc/at.allow", "*/etc/at.deny") + by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `linux_at_allow_config_file_creation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator can create this file for automation purposes. filter is needed +references: +- https://linuxize.com/post/at-command-in-linux/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.003 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml new file mode 100644 index 0000000000..3a737e133c --- /dev/null +++ b/detections/endpoint/linux_at_application_execution.yml @@ -0,0 +1,70 @@ +name: Linux At Application Execution +id: bf0a378e-5f3c-11ec-a6de-acde48001122 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a suspicious process creation of At application. + This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their + malicious code. This anomaly detection can be a good indicator to investigate the event before and after this process execution, when it was executed and what + schedule task it will execute. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name = at OR Processes.parent_process_name = at + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_at_application_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrator or network operator can use this application for automation purposes. filter is needed +references: +- https://attack.mitre.org/techniques/T1053/001/ +- https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.001 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: at application was executed in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml new file mode 100644 index 0000000000..b27fd3c0da --- /dev/null +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -0,0 +1,70 @@ +name: Linux Edit Cron Table Parameter +id: 0d370304-5f26-11ec-a4bb-acde48001122 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies a suspicious edit cronjobs parameter. + This commandline parameter can be abuse by malware author, adversaries, and red red teamers to add cronjob entry to their malicious code to execute + to the schedule they want. This event can also be executed by administrator or normal user for automation purposes so filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = crontab Processes.process = "*crontab *" Processes.process = "* -e*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_edit_cron_table_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrator or network operator can use this application for automation purposes. filter is needed +references: +- https://attack.mitre.org/techniques/T1053/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.003 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a possible crontab edit command $process$ executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml new file mode 100644 index 0000000000..53759c627d --- /dev/null +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -0,0 +1,73 @@ +name: Linux Possible Append Command To At Allow Config File +id: 7bc20606-5f40-11ec-a586-acde48001122 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious commandline that may use to append user entry to /etc/at.allow or /etc/at.deny. + These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. + These config file can restrict user that can only execute at application (another schedule task application in linux). attacker can + create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection + can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes + where Processes.process = "*echo*" Processes.process = "*>>*" + AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_append_command_to_at_allow_config_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed +references: +- https://linuxize.com/post/at-command-in-linux/ +- https://attack.mitre.org/techniques/T1053/001/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.001 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that may modify at allow config file in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml new file mode 100644 index 0000000000..b405d05a6a --- /dev/null +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -0,0 +1,72 @@ +name: Linux Possible Append Cronjob Entry on Existing Cronjob File +id: b5b91200-5f27-11ec-bb4e-acde48001122 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic looks for possible suspicious commandline that may use to append a code to any existing cronjob files + for persistence or privilege escalation. This technique is commonly abused by malware, adversaries and red teamers to automatically execute their code + within a existing or sometimes in normal cronjob script file. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes + where Processes.process = "*echo*" Processes.process = "*>>*" + AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed +references: +- https://attack.mitre.org/techniques/T1053/003/ +- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability +- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.003 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that may modify cronjob file in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml new file mode 100644 index 0000000000..620cc73adc --- /dev/null +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -0,0 +1,70 @@ +name: Linux Possible Cronjob Modification With Editor +id: dcc89bde-5f24-11ec-87ca-acde48001122 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic looks for possible modification of cronjobs file using editor. + This event is can be seen in normal user but can also be a good hunting indicator for unwanted user modifying cronjobs for possible persistence or + privilege escalation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN("nano","vim.basic") OR Processes.process IN ("*nano *", "*vi *", "*vim *")) + AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_cronjob_modification_with_editor_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed +references: +- https://attack.mitre.org/techniques/T1053/003/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.003 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 20 + confidence: 30 + # (impact * confidence)/100 + risk_score: 6 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: a commandline $process$ that may modify cronjob file using editor in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/stories/linux_persistence_techniques.yml b/stories/linux_persistence_techniques.yml new file mode 100644 index 0000000000..a1cbdfea75 --- /dev/null +++ b/stories/linux_persistence_techniques.yml @@ -0,0 +1,27 @@ +name: Linux Persistence Techniques +id: e40d13e5-d38b-457e-af2a-e8e6a2f2b516 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +description: Monitor for activities and techniques associated with maintaining persistence + on a Linux system--a sign that an adversary may have compromised your environment. +narrative: Maintaining persistence is one of the first steps taken by attackers after + the initial compromise. Attackers leverage various custom and built-in tools to + ensure survivability and persistent access within a compromised enterprise. This + Analytic Story provides searches to help you identify various behaviors used by + attackers to maintain persistent access to a Linux environment. +references: +- https://attack.mitre.org/techniques/T1053/ +- https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/ +- https://gtfobins.github.io/gtfobins/at/ +- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf + +tags: + analytic_story: Linux Persistence Techniques + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/linux_privilege_escalation.yml b/stories/linux_privilege_escalation.yml new file mode 100644 index 0000000000..006f5c2ca6 --- /dev/null +++ b/stories/linux_privilege_escalation.yml @@ -0,0 +1,27 @@ +name: Linux Privilege Escalation +id: b9879c24-670a-44c0-895e-98cdb7d0e848 +version: 1 +date: '2021-12-17' +author: Teoderick Contreras, Splunk +description: Monitor for and investigate activities that may be associated with a + Linux privilege-escalation attack, including unusual processes running on endpoints, + schedule task, services, setuid, root execution and more. +narrative: 'Privilege escalation is a "land-and-expand" technique, wherein an adversary + gains an initial foothold on a host and then exploits its weaknesses to increase + his privileges. The motivation is simple: certain actions on a Linux machine--such + as installing software--may require higher-level privileges than those the attacker + initially acquired. By increasing his privilege level, the attacker can gain the + control required to carry out his malicious ends. This Analytic Story provides searches + to detect and investigate behaviors that attackers may use to elevate their privileges + in your environment.' +references: +- https://attack.mitre.org/tactics/TA0004/ +tags: + analytic_story: Linux Privilege Escalation + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/linux_add_files_in_known_crontab_directories.test.yml b/tests/endpoint/linux_add_files_in_known_crontab_directories.test.yml new file mode 100644 index 0000000000..e0d0767e9b --- /dev/null +++ b/tests/endpoint/linux_add_files_in_known_crontab_directories.test.yml @@ -0,0 +1,12 @@ +name: Linux Add Files In Known Crontab Directories Unit Test +tests: +- name: Linux Add Files In Known Crontab Directories + file: endpoint/linux_add_files_in_known_crontab_directories.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_at_allow_config_file_creation.test.yml b/tests/endpoint/linux_at_allow_config_file_creation.test.yml new file mode 100644 index 0000000000..d2f3ba2a95 --- /dev/null +++ b/tests/endpoint/linux_at_allow_config_file_creation.test.yml @@ -0,0 +1,12 @@ +name: Linux At Allow Config File Creation Unit Test +tests: +- name: Linux At Allow Config File Creation + file: endpoint/linux_at_allow_config_file_creation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_at_application_execution.test.yml b/tests/endpoint/linux_at_application_execution.test.yml new file mode 100644 index 0000000000..ea3b48dbd0 --- /dev/null +++ b/tests/endpoint/linux_at_application_execution.test.yml @@ -0,0 +1,12 @@ +name: Linux At Application Execution Unit Test +tests: +- name: Linux At Application Execution + file: endpoint/linux_at_application_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_edit_cron_table_parameter.test.yml b/tests/endpoint/linux_edit_cron_table_parameter.test.yml new file mode 100644 index 0000000000..2dd65af9e5 --- /dev/null +++ b/tests/endpoint/linux_edit_cron_table_parameter.test.yml @@ -0,0 +1,12 @@ +name: Linux Edit Cron Table Parameter Unit Test +tests: +- name: Linux Edit Cron Table Parameter + file: endpoint/linux_edit_cron_table_parameter.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml b/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml new file mode 100644 index 0000000000..92331f683e --- /dev/null +++ b/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml @@ -0,0 +1,12 @@ +name: Linux Possible Append Command To At Allow Config File Unit Test +tests: +- name: Linux Possible Append Command To At Allow Config File + file: endpoint/linux_possible_append_command_to_at_allow_config_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml b/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml new file mode 100644 index 0000000000..e1ee69373c --- /dev/null +++ b/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml @@ -0,0 +1,12 @@ +name: Linux Possible Append Cronjob Entry on Existing Cronjob File Unit Test +tests: +- name: Linux Possible Append Cronjob Entry on Existing Cronjob File + file: endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_possible_cronjob_modification_with_editor.test.yml b/tests/endpoint/linux_possible_cronjob_modification_with_editor.test.yml new file mode 100644 index 0000000000..83dca42143 --- /dev/null +++ b/tests/endpoint/linux_possible_cronjob_modification_with_editor.test.yml @@ -0,0 +1,12 @@ +name: Linux Possible Cronjob Modification With Editor Unit Test +tests: +- name: Linux Possible Cronjob Modification With Editor + file: endpoint/linux_possible_cronjob_modification_with_editor.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file From d1c95a44addd605be7ea22b35d2979f899cba92c Mon Sep 17 00:00:00 2001 From: root Date: Wed, 22 Dec 2021 09:02:46 +0000 Subject: [PATCH 02/14] Added detection testing service results inLinux Possible Cronjob Modification With Editor --- ...sible_cronjob_modification_with_editor.yml | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml index 620cc73adc..6fb5f3563c 100644 --- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -6,24 +6,25 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic looks for possible modification of cronjobs file using editor. - This event is can be seen in normal user but can also be a good hunting indicator for unwanted user modifying cronjobs for possible persistence or - privilege escalation. +description: This analytic looks for possible modification of cronjobs file using + editor. This event is can be seen in normal user but can also be a good hunting + indicator for unwanted user modifying cronjobs for possible persistence or privilege + escalation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN("nano","vim.basic") OR Processes.process IN ("*nano *", "*vi *", "*vim *")) - AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN("nano","vim.basic") + OR Processes.process IN ("*nano *", "*vi *", "*vim *")) AND Processes.process IN("*/etc/cron*", + "*/var/spool/cron/*", "*/etc/anacrontab*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_cronjob_modification_with_editor_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed + Sysmon TA. +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. filter is needed references: -- https://attack.mitre.org/techniques/T1053/003/ +- https://attack.mitre.org/techniques/T1053/003/ tags: analytic_story: - Linux Privilege Escalation @@ -41,17 +42,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 20 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 6 context: - source:endpoint @@ -67,4 +67,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From 3a68d044ef448bc06ded970cbdeab78016541ef4 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 22 Dec 2021 10:46:27 +0100 Subject: [PATCH 03/14] Update linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml --- ...ble_append_cronjob_entry_on_existing_cronjob_file.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml b/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml index e1ee69373c..ef57ab1fea 100644 --- a/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml +++ b/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml @@ -3,10 +3,10 @@ tests: - name: Linux Possible Append Cronjob Entry on Existing Cronjob File file: endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: sysmon_linux.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux \ No newline at end of file + sourcetype: sysmon_linux From b38beadde2f23008a47385703e0575d30092e308 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 22 Dec 2021 10:03:26 +0000 Subject: [PATCH 04/14] Added detection testing service results inLinux Edit Cron Table Parameter --- .../linux_edit_cron_table_parameter.yml | 45 ++++++++++--------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index b27fd3c0da..b20897b8aa 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -6,24 +6,25 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: The following analytic identifies a suspicious edit cronjobs parameter. - This commandline parameter can be abuse by malware author, adversaries, and red red teamers to add cronjob entry to their malicious code to execute - to the schedule they want. This event can also be executed by administrator or normal user for automation purposes so filter is needed. +description: The following analytic identifies a suspicious edit cronjobs parameter. + This commandline parameter can be abuse by malware author, adversaries, and red + red teamers to add cronjob entry to their malicious code to execute to the schedule + they want. This event can also be executed by administrator or normal user for automation + purposes so filter is needed. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = crontab Processes.process = "*crontab *" Processes.process = "* -e*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_edit_cron_table_parameter_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = crontab + Processes.process = "*crontab *" Processes.process = "* -e*" by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this application for automation purposes. filter is needed + Sysmon TA. +known_false_positives: Administrator or network operator can use this application + for automation purposes. filter is needed references: -- https://attack.mitre.org/techniques/T1053/003/ +- https://attack.mitre.org/techniques/T1053/003/ tags: analytic_story: - Linux Privilege Escalation @@ -41,17 +42,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 context: - source:endpoint @@ -67,4 +67,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From 9a6806ce75f3e75e0a7fc7300a2ea6b78ab500ff Mon Sep 17 00:00:00 2001 From: root Date: Wed, 22 Dec 2021 10:22:07 +0000 Subject: [PATCH 05/14] Added detection testing service results inLinux At Application Execution --- .../linux_at_application_execution.yml | 46 ++++++++++--------- 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 3a737e133c..7aa146299e 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -6,21 +6,23 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies a suspicious process creation of At application. - This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their - malicious code. This anomaly detection can be a good indicator to investigate the event before and after this process execution, when it was executed and what - schedule task it will execute. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name = at OR Processes.parent_process_name = at - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_at_application_execution_filter`' +description: The following analytic identifies a suspicious process creation of At + application. This process can be used by malware, adversaries and red teamers to + create persistence entry to the targeted or compromised host with their malicious + code. This anomaly detection can be a good indicator to investigate the event before + and after this process execution, when it was executed and what schedule task it + will execute. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes + where Processes.process_name = at OR Processes.parent_process_name = at by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this application for automation purposes. filter is needed + Sysmon TA. +known_false_positives: Administrator or network operator can use this application + for automation purposes. filter is needed references: - https://attack.mitre.org/techniques/T1053/001/ - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ @@ -29,7 +31,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/sysmon_linux.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log kill_chain_phases: - Privilege Escalation mitre_attack_id: @@ -41,17 +43,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 context: - source:endpoint @@ -67,4 +68,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From d708418dd8a95228eed35e610c0852df7062a60c Mon Sep 17 00:00:00 2001 From: root Date: Wed, 22 Dec 2021 10:25:23 +0000 Subject: [PATCH 06/14] Added detection testing service results inLinux At Allow Config File Creation --- .../linux_at_allow_config_file_creation.yml | 51 ++++++++++--------- 1 file changed, 26 insertions(+), 25 deletions(-) diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index fe911eb592..75849e9477 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -6,31 +6,32 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies a suspicious file creation of /etc/at.allow or /etc/at.deny. - These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. - These config file can restrict user that can only execute at application (another schedule task application in linux). attacker can - create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection - can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path IN ("*/etc/at.allow", "*/etc/at.deny") - by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `linux_at_allow_config_file_creation_filter`' +description: The following analytic identifies a suspicious file creation of /etc/at.allow + or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red + teamers to persist on the targeted or compromised host. These config file can restrict + user that can only execute at application (another schedule task application in + linux). attacker can create a user or add the compromised username to that config + file to execute at to schedule it malicious code. This anomaly detection can be + a good indicator to investigate further the entry in created config file and who + created it to verify if it is a false positive. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/at.allow", + "*/etc/at.deny") by Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can create this file for automation purposes. filter is needed + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: administrator or network operator can create this file for + automation purposes. filter is needed references: -- https://linuxize.com/post/at-command-in-linux/ +- https://linuxize.com/post/at-command-in-linux/ tags: analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log kill_chain_phases: - Privilege Escalation mitre_attack_id: @@ -42,15 +43,14 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid - Filesystem.file_path security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - source:endpoint @@ -66,4 +66,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From 9b3ecff01851bbd986b49cf3e659dca1c85d4909 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 22 Dec 2021 11:51:16 +0100 Subject: [PATCH 07/14] Update linux_possible_append_command_to_at_allow_config_file.test.yml --- ...x_possible_append_command_to_at_allow_config_file.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml b/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml index 92331f683e..a3ff049444 100644 --- a/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml +++ b/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml @@ -3,10 +3,10 @@ tests: - name: Linux Possible Append Command To At Allow Config File file: endpoint/linux_possible_append_command_to_at_allow_config_file.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: sysmon_linux.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux \ No newline at end of file + sourcetype: sysmon_linux From ae6cca1cf4a9b293f29afdab2528b59672ac34a8 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 22 Dec 2021 10:54:26 +0000 Subject: [PATCH 08/14] Added detection testing service results inLinux Add Files In Known Crontab Directories --- ...add_files_in_known_crontab_directories.yml | 49 ++++++++++--------- 1 file changed, 25 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml index 4ad54b00a0..0eb2178788 100644 --- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -6,25 +6,26 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies a suspicious file creation in known cron table directories. - This event is commonly abuse by malware, adversaries and red teamers to persist on the target or compromised host. - crontab or cronjob is like a schedule task in windows environment where you can create an executable or script on the known crontab directories to - run it base on its schedule. This Anomaly query is a good indicator to look further what file is added and who added the file if to consider it legitimate file. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path IN ("*/etc/cron*", "*/var/spool/cron/*") - by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `linux_add_files_in_known_crontab_directories_filter`' +description: The following analytic identifies a suspicious file creation in known + cron table directories. This event is commonly abuse by malware, adversaries and + red teamers to persist on the target or compromised host. crontab or cronjob is + like a schedule task in windows environment where you can create an executable or + script on the known crontab directories to run it base on its schedule. This Anomaly + query is a good indicator to look further what file is added and who added the file + if to consider it legitimate file. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/cron*", + "*/var/spool/cron/*") by Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_add_files_in_known_crontab_directories_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator can create file in crontab folders for automation purposes. filter is needed + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: administrator or network operator can create file in crontab + folders for automation purposes. filter is needed references: -- https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/ -- https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/ +- https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/ +- https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/ tags: analytic_story: - Linux Privilege Escalation @@ -42,15 +43,14 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid - Filesystem.file_path security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - source:endpoint @@ -66,4 +66,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From 204670cbe1d023e7c770a77fe9eda424fd212431 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 5 Jan 2022 16:33:43 +0100 Subject: [PATCH 09/14] Update linux_at_allow_config_file_creation.yml --- detections/endpoint/linux_at_allow_config_file_creation.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 75849e9477..59f5500f96 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -8,10 +8,10 @@ datamodel: - Endpoint description: The following analytic identifies a suspicious file creation of /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red - teamers to persist on the targeted or compromised host. These config file can restrict - user that can only execute at application (another schedule task application in + teamers to persist on the targeted or compromised host. These config files can restrict or allow + user to execute "at" application (another schedule task application in linux). attacker can create a user or add the compromised username to that config - file to execute at to schedule it malicious code. This anomaly detection can be + file to execute "at" to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) From cebc5ac4fd1aba5873eed1aad608c41a72f5feca Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 5 Jan 2022 16:38:48 +0100 Subject: [PATCH 10/14] Update linux_edit_cron_table_parameter.yml --- detections/endpoint/linux_edit_cron_table_parameter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index b20897b8aa..a2e4695ee0 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: The following analytic identifies a suspicious edit cronjobs parameter. +description: The following analytic identifies a suspicious cronjobs modification using crontab edit parameter. This commandline parameter can be abuse by malware author, adversaries, and red red teamers to add cronjob entry to their malicious code to execute to the schedule they want. This event can also be executed by administrator or normal user for automation From 72859e63e832ef0cd03a4e119574330020a5d448 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 10 Jan 2022 09:43:33 +0100 Subject: [PATCH 11/14] Update linux_possible_append_command_to_at_allow_config_file.yml --- ...linux_possible_append_command_to_at_allow_config_file.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 53759c627d..516207b4a6 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -12,8 +12,7 @@ description: This analytic looks for suspicious commandline that may use to appe create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes - where Processes.process = "*echo*" Processes.process = "*>>*" - AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny") + where Processes.process = "*echo*" AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -70,4 +69,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 From 265a1f049490bab3a22f0ae391ae97f5c4931d52 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 10 Jan 2022 09:44:05 +0100 Subject: [PATCH 12/14] Update linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml --- ...ossible_append_cronjob_entry_on_existing_cronjob_file.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml index b405d05a6a..a368528567 100644 --- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -10,8 +10,7 @@ description: This analytic looks for possible suspicious commandline that may us for persistence or privilege escalation. This technique is commonly abused by malware, adversaries and red teamers to automatically execute their code within a existing or sometimes in normal cronjob script file. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes - where Processes.process = "*echo*" Processes.process = "*>>*" - AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") + where Processes.process = "*echo*" AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -69,4 +68,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 From f48713b301a6723cbbeb45153457587d21619f4a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 10 Jan 2022 09:46:50 +0100 Subject: [PATCH 13/14] Update linux_possible_append_command_to_at_allow_config_file.yml --- .../linux_possible_append_command_to_at_allow_config_file.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 516207b4a6..3b674b0369 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -31,7 +31,7 @@ tags: - Linux Privilege Escalation - Linux Persistence Techniques dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/sysmon_linux.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log kill_chain_phases: - Privilege Escalation mitre_attack_id: From b44fe4b8d85f31a5aefe2c8f0cd2f8b8660388bb Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 10 Jan 2022 16:59:08 -0800 Subject: [PATCH 14/14] text and yml updates --- ...linux_add_files_in_known_crontab_directories.yml | 11 ++++++----- .../linux_at_allow_config_file_creation.yml | 13 +++++++------ .../endpoint/linux_at_application_execution.yml | 12 ++++++------ .../endpoint/linux_edit_cron_table_parameter.yml | 12 ++++++------ ...sible_append_command_to_at_allow_config_file.yml | 12 ++++++------ ...ppend_cronjob_entry_on_existing_cronjob_file.yml | 12 ++++++------ ...ux_possible_cronjob_modification_with_editor.yml | 12 ++++++------ 7 files changed, 43 insertions(+), 41 deletions(-) diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml index 0eb2178788..406df926d4 100644 --- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -20,9 +20,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_add_files_in_known_crontab_directories_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrator or network operator can create file in crontab - folders for automation purposes. filter is needed + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create file in crontab + folders for automation purposes. Please update the filter macros to remove false positives. references: - https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/ - https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/ @@ -53,8 +53,9 @@ tags: confidence: 50 risk_score: 25 context: - - source:endpoint - - stage:Privilege Escalation Persistence + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence message: a file $file_name$ is created in $file_path$ on $dest$ observable: - name: dest diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 59f5500f96..bed66afb4c 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -21,9 +21,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrator or network operator can create this file for - automation purposes. filter is needed + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create this file for + automation purposes. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/at-command-in-linux/ tags: @@ -53,9 +53,10 @@ tags: confidence: 50 risk_score: 25 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a file $file_name$ is created in $file_path$ on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 7aa146299e..9f5560bcf5 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this application - for automation purposes. filter is needed + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/001/ - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ @@ -55,9 +54,10 @@ tags: confidence: 30 risk_score: 9 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: at application was executed in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: At application was executed in $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index a2e4695ee0..65a0b12b9a 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this application - for automation purposes. filter is needed + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/003/ tags: @@ -54,9 +53,10 @@ tags: confidence: 30 risk_score: 9 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a possible crontab edit command $process$ executed on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A possible crontab edit command $process$ executed on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 3b674b0369..0afcfd2950 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -20,9 +20,8 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `linux_possible_append_command_to_at_allow_config_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/at-command-in-linux/ - https://attack.mitre.org/techniques/T1053/001/ @@ -56,9 +55,10 @@ tags: # (impact * confidence)/100 risk_score: 9 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that may modify at allow config file in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may modify at allow config file in $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml index a368528567..d13faae1b5 100644 --- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -18,9 +18,8 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/003/ - https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability @@ -55,9 +54,10 @@ tags: # (impact * confidence)/100 risk_score: 49 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that may modify cronjob file in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may modify cronjob file in $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml index 6fb5f3563c..dc9603aca2 100644 --- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `linux_possible_cronjob_modification_with_editor_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this commandline - for automation purposes. filter is needed + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/003/ tags: @@ -54,9 +53,10 @@ tags: confidence: 30 risk_score: 6 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that may modify cronjob file using editor in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may modify cronjob file using editor in $dest$ observable: - name: dest type: Hostname