diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml index 0eb2178788..406df926d4 100644 --- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -20,9 +20,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_add_files_in_known_crontab_directories_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrator or network operator can create file in crontab - folders for automation purposes. filter is needed + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create file in crontab + folders for automation purposes. Please update the filter macros to remove false positives. references: - https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/ - https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/ @@ -53,8 +53,9 @@ tags: confidence: 50 risk_score: 25 context: - - source:endpoint - - stage:Privilege Escalation Persistence + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence message: a file $file_name$ is created in $file_path$ on $dest$ observable: - name: dest diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 59f5500f96..bed66afb4c 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -21,9 +21,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrator or network operator can create this file for - automation purposes. filter is needed + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create this file for + automation purposes. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/at-command-in-linux/ tags: @@ -53,9 +53,10 @@ tags: confidence: 50 risk_score: 25 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a file $file_name$ is created in $file_path$ on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 7aa146299e..9f5560bcf5 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this application - for automation purposes. filter is needed + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/001/ - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ @@ -55,9 +54,10 @@ tags: confidence: 30 risk_score: 9 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: at application was executed in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: At application was executed in $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index a2e4695ee0..65a0b12b9a 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this application - for automation purposes. filter is needed + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/003/ tags: @@ -54,9 +53,10 @@ tags: confidence: 30 risk_score: 9 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a possible crontab edit command $process$ executed on $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A possible crontab edit command $process$ executed on $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 3b674b0369..0afcfd2950 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -20,9 +20,8 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `linux_possible_append_command_to_at_allow_config_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/at-command-in-linux/ - https://attack.mitre.org/techniques/T1053/001/ @@ -56,9 +55,10 @@ tags: # (impact * confidence)/100 risk_score: 9 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that may modify at allow config file in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may modify at allow config file in $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml index a368528567..d13faae1b5 100644 --- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -18,9 +18,8 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/003/ - https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability @@ -55,9 +54,10 @@ tags: # (impact * confidence)/100 risk_score: 49 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that may modify cronjob file in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may modify cronjob file in $dest$ observable: - name: dest type: Hostname diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml index 6fb5f3563c..dc9603aca2 100644 --- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -19,10 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `linux_possible_cronjob_modification_with_editor_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. known_false_positives: Administrator or network operator can use this commandline - for automation purposes. filter is needed + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/003/ tags: @@ -54,9 +53,10 @@ tags: confidence: 30 risk_score: 6 context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: a commandline $process$ that may modify cronjob file using editor in $dest$ + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may modify cronjob file using editor in $dest$ observable: - name: dest type: Hostname