Branch was auto-updated.

detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml

@@ -0,0 +1,74 @@
+name: Linux NOPASSWD Entry In Sudoers File
+id: ab1e0d52-624a-11ec-8e0b-acde48001122
+version: 1
+date: '2021-12-21'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious command lines that may add entry
+  to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly
+  abuse by adversaries, malware author and red teamers to gain elevated privilege
+  to the targeted or compromised host. /etc/sudoers file controls who can run what
+  commands users can execute on the machines and can also control whether user need
+  a password to execute particular commands. This file is composed of aliases (basically
+  variables) and user specifications.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*NOPASSWD:*"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `linux_nopasswd_entry_in_sudoers_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
+references:
+- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
+- https://help.ubuntu.com/community/Sudoers
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 80
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - stage:Privilege Escalation
+  - Stage:Persistence
+  message: a commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml

@@ -0,0 +1,74 @@
+name: Linux Possible Access Or Modification Of sshd Config File
+id: 7a85eb24-72da-11ec-ac76-acde48001122
+version: 1
+date: '2022-01-11'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious process command-line that might
+  be accessing or modifying sshd_config. This file is the ssh configuration file that
+  might be modify by threat actors or adversaries to redirect port connection, allow
+  user using authorized key generated during attack. This anomaly detection might
+  catch noise from administrator auditing or modifying ssh configuration file. In
+  this scenario filter is needed
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat",
+  "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/ssh/sshd_config") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_or_modification_of_sshd_config_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+references:
+- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
+- https://attack.mitre.org/techniques/T1098/004/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1098.004
+  - T1098
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: a commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/linux_possible_append_command_to_profile_config_file.yml

@@ -0,0 +1,72 @@
+name: Linux Possible Append Command To Profile Config File
+id: 9c94732a-61af-11ec-91e3-acde48001122
+version: 1
+date: '2021-12-20'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic looks for suspicious command-lines that can be possibly used to modify user profile files to automatically execute scripts/executables by shell upon reboot of the machine. 
+  This technique is commonly abused by adversaries, malware and red teamers as persistence mechanism to the targeted or compromised host.
+  This Anomaly detection is a good indicator that someone wants to run code after reboot which can be done also by the administrator or network operator for 
+  automation purposes.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process = "*echo*" AND Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", "*~/.profile", "~/.bash_logout")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `linux_possible_append_command_to_profile_config_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
+references:
+- https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work
+- https://attack.mitre.org/techniques/T1546/004/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1546.004
+  - T1546
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation Persistence
+  - Stage:Persistence
+  message: a commandline $process$ that may modify profile files in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

detections/endpoint/linux_possible_ssh_key_file_creation.yml

@@ -0,0 +1,70 @@
+name: Linux Possible Ssh Key File Creation
+id: c04ef40c-72da-11ec-8eac-acde48001122
+version: 1
+date: '2022-01-11'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for possible ssh key file creation on ~/.ssh/
+  folder. This technique is commonly abused by threat actors and adversaries to gain
+  persistence and privilege escalation to the targeted host. by creating ssh private
+  and public key and passing the public key to the attacker server. threat actor can
+  access remotely the machine using openssh daemon service.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/.ssh*")
+  by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
+  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  | `linux_possible_ssh_key_file_creation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can create file in ~/.ssh
+  folders for automation purposes. Please update the filter macros to remove false
+  positives.
+references:
+- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
+- https://attack.mitre.org/techniques/T1098/004/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1098.004
+  - T1098
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
+  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A file $file_name$ is created in $file_path$ on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

tests/endpoint/linux_nopasswd_entry_in_sudoers_file.test.yml

@@ -0,0 +1,12 @@
+name: Linux NOPASSWD Entry In Sudoers File Unit Test
+tests:
+- name: Linux NOPASSWD Entry In Sudoers File
+  file: endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml

@@ -0,0 +1,12 @@
+name: Linux Possible Access Or Modification Of sshd Config File Unit Test
+tests:
+- name: Linux Possible Access Or Modification Of sshd Config File
+  file: endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_possible_append_command_to_profile_config_file.test.yml

@@ -0,0 +1,12 @@
+name: Linux Possible Append Command To Profile Config File Unit Test
+tests:
+- name: Linux Possible Append Command To Profile Config File
+  file: endpoint/linux_possible_append_command_to_profile_config_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_possible_ssh_key_file_creation.test.yml

@@ -0,0 +1,12 @@
+name: Linux Possible Ssh Key File Creation Unit Test
+tests:
+- name: Linux Possible Ssh Key File Creation
+  file: endpoint/linux_possible_ssh_key_file_creation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux