diff --git a/detections/endpoint/linux_deletion_of_ssh_key.yml b/detections/endpoint/linux_deletion_of_ssh_key.yml new file mode 100644 index 0000000000..341594bb17 --- /dev/null +++ b/detections/endpoint/linux_deletion_of_ssh_key.yml @@ -0,0 +1,86 @@ +name: Linux deletion Of SSH Key +id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a deletion of ssh key in a linux machine. + attacker may delete or modify ssh key to impair some security features or act as defense evasion in compromised linux machine. + This Anomaly can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what + acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + tries to delete this type of files which is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" + by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + |join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user + | `linux_deletion_of_ssh_key_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: + - Acidrain + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a $process_name$ deleting a SSH key in $dest$ + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + - Filesystem.action + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_path + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml new file mode 100644 index 0000000000..fc3e016a42 --- /dev/null +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -0,0 +1,86 @@ +name: Linux Deletion of SSL Certificate +id: 839ab790-a60a-4f81-bfb3-02567063f615 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a deletion of ssl certificate in a linux machine. + attacker may delete or modify ssl certificate to impair some security features or act as defense evasion in compromised linux machine. + This Anomaly can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what + acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + tries to delete this type of files which is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") + by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + |join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user + | `linux_deletion_of_ssl_certificate_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: + - Acidrain + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a $process_name$ deleting a SSL certificate in $dest$ + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + - Filesystem.action + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_path + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/linux_deletion_of_ssh_key.test.yml b/tests/endpoint/linux_deletion_of_ssh_key.test.yml new file mode 100644 index 0000000000..87f7977249 --- /dev/null +++ b/tests/endpoint/linux_deletion_of_ssh_key.test.yml @@ -0,0 +1,12 @@ +name: Linux deletion Of SSH Key Unit Test +tests: +- name: Linux deletion Of SSH Key + file: endpoint/linux_deletion_of_ssh_key.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux diff --git a/tests/endpoint/linux_deletion_of_ssl_certificate.test.yml b/tests/endpoint/linux_deletion_of_ssl_certificate.test.yml new file mode 100644 index 0000000000..f590b6ea02 --- /dev/null +++ b/tests/endpoint/linux_deletion_of_ssl_certificate.test.yml @@ -0,0 +1,12 @@ +name: Linux Deletion of SSL Certificate Unit Test +tests: +- name: Linux Deletion of SSL Certificate + file: endpoint/linux_deletion_of_ssl_certificate.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux