diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index be0d981f97..dfc0e737a6 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: -This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. +description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index ebfd8bc5b3..50368e4c36 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. +description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory | `detect_linenum_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 413f200375..1478c4a07a 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. +description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index c77a5e5158..7eb4815876 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,11 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? +description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 98a57d0d47..061ca181fe 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. +description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.