fixedspaces

detections/endpoint/detect_autosuid_post_exploitation_tool.yml

@@ -6,8 +6,7 @@ author: Rod Soto
 type: TTP
 datamodel:
 - Endpoint
-description:
-This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges.
+description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges.
 search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path
  | `detect_autosuid_post_exploitation_tool_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.

detections/endpoint/detect_linenum_execution.yml

@@ -6,8 +6,7 @@ author: Rod Soto
 type: TTP
 datamodel:
 - Endpoint
-description:
-	LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
+description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
 search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory
  | `detect_linenum_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.

detections/endpoint/detect_linpeas_execution.yml

@@ -6,8 +6,7 @@ author: Rod Soto
 type: TTP
 datamodel:
 - Endpoint
-description:
-	Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges.
+description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges.
 search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path
  | `detect_linpeas_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.

detections/endpoint/detect_linux_exploit_suggester_execution.yml

@@ -6,11 +6,7 @@ author: Rod Soto
 type: TTP
 datamodel:
 - Endpoint
-description:
-	UPDATE_DESCRIPTION
-	WHAT IS THIS?
-	WHAT DOES IT LOOK LIKE?
-	HOW DO YOU TRIAGE IT?
+description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. 
 search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*"  | stats count by CommandLine,user,Computer,action,signature, process_name
  | `detect_linux_exploit_suggester_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.

detections/endpoint/detect_mimipenguin.yml

@@ -6,8 +6,7 @@ author: Rod Soto
 type: TTP
 datamodel:
 - Endpoint
-description:
-	MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool.
+description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool.
 search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow"  | stats count by Computer parent_process process_current_directory user
  | `detect_mimipenguin_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.