admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

text and yml updates

Browse Source
This commit is contained in:
patel-bhavin
2022-01-10 16:59:08 -08:00
parent c508820126
commit b44fe4b8d8
7 changed files with 43 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_add_files_in_known_crontab_directories.yml
+6 -5
View File
@@ -20,9 +20,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_add_files_in_known_crontab_directories_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the file name, file path, and process_guid executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: administrator or network operator can create file in crontab
folders for automation purposes. filter is needed
If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can create file in crontab
folders for automation purposes. Please update the filter macros to remove false positives.
references:
- https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/
- https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/
@@ -53,8 +53,9 @@ tags:
confidence: 50
risk_score: 25
context:
- source:endpoint
- stage:Privilege Escalation Persistence
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
message: a file $file_name$ is created in $file_path$ on $dest$
observable:
- name: dest
detections/endpoint/linux_at_allow_config_file_creation.yml
+7 -6
View File
@@ -21,9 +21,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the file name, file path, and process_guid executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: administrator or network operator can create this file for
automation purposes. filter is needed
If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can create this file for
automation purposes. Please update the filter macros to remove false positives.
references:
- https://linuxize.com/post/at-command-in-linux/
tags:
@@ -53,9 +53,10 @@ tags:
confidence: 50
risk_score: 25
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: a file $file_name$ is created in $file_path$ on $dest$
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
message: A file $file_name$ is created in $file_path$ on $dest$
observable:
- name: dest
type: Hostname
detections/endpoint/linux_at_application_execution.yml
+6 -6
View File
@@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can use this application
for automation purposes. filter is needed
for automation purposes. Please update the filter macros to remove false positives.
references:
- https://attack.mitre.org/techniques/T1053/001/
- https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/
@@ -55,9 +54,10 @@ tags:
confidence: 30
risk_score: 9
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: at application was executed in $dest$
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
message: At application was executed in $dest$
observable:
- name: dest
type: Hostname
detections/endpoint/linux_edit_cron_table_parameter.yml
+6 -6
View File
@@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can use this application
for automation purposes. filter is needed
for automation purposes. Please update the filter macros to remove false positives.
references:
- https://attack.mitre.org/techniques/T1053/003/
tags:
@@ -54,9 +53,10 @@ tags:
confidence: 30
risk_score: 9
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: a possible crontab edit command $process$ executed on $dest$
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
message: A possible crontab edit command $process$ executed on $dest$
observable:
- name: dest
type: Hostname
detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
+6 -6
View File
@@ -20,9 +20,8 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
| `linux_possible_append_command_to_at_allow_config_file_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
- https://linuxize.com/post/at-command-in-linux/
- https://attack.mitre.org/techniques/T1053/001/
@@ -56,9 +55,10 @@ tags:
# (impact * confidence)/100
risk_score: 9
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: a commandline $process$ that may modify at allow config file in $dest$
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
message: A commandline $process$ that may modify at allow config file in $dest$
observable:
- name: dest
type: Hostname
detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
+6 -6
View File
@@ -18,9 +18,8 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
| `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
- https://attack.mitre.org/techniques/T1053/003/
- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
@@ -55,9 +54,10 @@ tags:
# (impact * confidence)/100
risk_score: 49
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: a commandline $process$ that may modify cronjob file in $dest$
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
message: A commandline $process$ that may modify cronjob file in $dest$
observable:
- name: dest
type: Hostname
detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
+6 -6
View File
@@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| `linux_possible_cronjob_modification_with_editor_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can use this commandline
for automation purposes. filter is needed
for automation purposes. Please update the filter macros to remove false positives.
references:
- https://attack.mitre.org/techniques/T1053/003/
tags:
@@ -54,9 +53,10 @@ tags:
confidence: 30
risk_score: 6
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: a commandline $process$ that may modify cronjob file using editor in $dest$
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
message: A commandline $process$ that may modify cronjob file using editor in $dest$
observable:
- name: dest
type: Hostname