From 8a3b86d5c2d2a25399599953b45eceb675c48bee Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Tue, 11 Jan 2022 11:57:38 +0100
Subject: [PATCH 01/16] linux_persist_priv_batch_5

---
 .../linux_nopasswd_entry_in_sudoers_file.yml  | 71 +++++++++++++++++++
 ..._append_command_to_profile_config_file.yml | 71 +++++++++++++++++++
 ...ux_nopasswd_entry_in_sudoers_file.test.yml | 12 ++++
 ...nd_command_to_profile_config_file.test.yml | 12 ++++
 4 files changed, 166 insertions(+)
 create mode 100644 detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
 create mode 100644 detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
 create mode 100644 tests/endpoint/linux_nopasswd_entry_in_sudoers_file.test.yml
 create mode 100644 tests/endpoint/linux_possible_append_command_to_profile_config_file.test.yml

diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
new file mode 100644
index 0000000000..ec7f15cc5c
--- /dev/null
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -0,0 +1,71 @@
+name: Linux NOPASSWD Entry In Sudoers File
+id: ab1e0d52-624a-11ec-8e0b-acde48001122
+version: 1
+date: '2021-12-21'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious command lines that may add entry to /etc/sudoers with NOPASSWD attribute in linux platform.
+  This technique is commonly abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. 
+  /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. 
+  The file is composed of aliases (basically variables) and user specifications (which control who can run what).
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process = "*NOPASSWD:*" 
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `linux_nopasswd_entry_in_sudoers_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: administrator or network operator can execute this command. filter is needed 
+references:
+- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
+- https://help.ubuntu.com/community/Sudoers
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.003
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 80 
+  # (impact * confidence)/100
+  risk_score: 64 
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
new file mode 100644
index 0000000000..97067aadd9
--- /dev/null
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -0,0 +1,71 @@
+name: Linux Possible Append Command To Profile Config File
+id: 9c94732a-61af-11ec-91e3-acde48001122
+version: 1
+date: '2021-12-20'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic looks for suspicious command lines that are possibly used to modify profile files to automatically execute scripts/files by shell upon boot of the machine. 
+  This technique is commonly abused by adversaries, malware and red teamers as persistence mechanism to the targeted or compromised host.
+  This Anomaly detection is a good indicator that someone wants to run code after boot up which can be done also by the administrator or network operator for 
+  automation purposes.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process = "*echo*" AND Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", "*~/.profile", "~/.bash_logout")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `linux_possible_append_command_to_profile_config_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed 
+references:
+- https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work
+- https://attack.mitre.org/techniques/T1546/004/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1546.004
+  - T1546
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: a commandline $process$ that may modify profile files in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/tests/endpoint/linux_nopasswd_entry_in_sudoers_file.test.yml b/tests/endpoint/linux_nopasswd_entry_in_sudoers_file.test.yml
new file mode 100644
index 0000000000..44dd725363
--- /dev/null
+++ b/tests/endpoint/linux_nopasswd_entry_in_sudoers_file.test.yml
@@ -0,0 +1,12 @@
+name: Linux NOPASSWD Entry In Sudoers File Unit Test
+tests:
+- name: Linux NOPASSWD Entry In Sudoers File
+  file: endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file
diff --git a/tests/endpoint/linux_possible_append_command_to_profile_config_file.test.yml b/tests/endpoint/linux_possible_append_command_to_profile_config_file.test.yml
new file mode 100644
index 0000000000..361f8e5683
--- /dev/null
+++ b/tests/endpoint/linux_possible_append_command_to_profile_config_file.test.yml
@@ -0,0 +1,12 @@
+name: Linux Possible Append Command To Profile Config File Unit Test
+tests:
+- name: Linux Possible Append Command To Profile Config File
+  file: endpoint/linux_possible_append_command_to_profile_config_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file

From 95be27a041d6a6e0701c38cbc2c5bd8fecfb4307 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 11 Jan 2022 12:01:47 +0100
Subject: [PATCH 02/16] Update linux_nopasswd_entry_in_sudoers_file.yml

---
 .../endpoint/linux_nopasswd_entry_in_sudoers_file.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index ec7f15cc5c..e8db981a4c 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -7,9 +7,9 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: This analytic is to look for suspicious command lines that may add entry to /etc/sudoers with NOPASSWD attribute in linux platform.
-  This technique is commonly abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. 
-  /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. 
-  The file is composed of aliases (basically variables) and user specifications (which control who can run what).
+  This technique is commonly abuse by adversaries, malware author and red teamers to gain elevated privilege to the targeted or compromised host. 
+  /etc/sudoers file controls who can run what commands users can execute on the machines and can also control whether user need a password to execute particular commands. 
+  This file is composed of aliases (basically variables) and user specifications.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
   where Processes.process = "*NOPASSWD:*" 
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
@@ -56,7 +56,8 @@ tags:
   risk_score: 64 
   context:
   - source:endpoint
-  - stage:Privilege Escalation Persistence
+  - stage:Privilege Escalation
+  - Stage:Persistence
   message: a commandline $process$ executed on $dest$
   observable:
   - name: dest
@@ -68,4 +69,4 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16

From 1bffb74009d5a040224d21f74729227ee47c8beb Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 11 Jan 2022 12:03:24 +0100
Subject: [PATCH 03/16] Update
 linux_possible_append_command_to_profile_config_file.yml

---
 ...inux_possible_append_command_to_profile_config_file.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index 97067aadd9..bad838f9b5 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for suspicious command lines that are possibly used to modify profile files to automatically execute scripts/files by shell upon boot of the machine. 
+description: This analytic looks for suspicious command-lines that can be possibly used to modify user profile files to automatically execute scripts/executables by shell upon reboot of the machine. 
   This technique is commonly abused by adversaries, malware and red teamers as persistence mechanism to the targeted or compromised host.
-  This Anomaly detection is a good indicator that someone wants to run code after boot up which can be done also by the administrator or network operator for 
+  This Anomaly detection is a good indicator that someone wants to run code after reboot which can be done also by the administrator or network operator for 
   automation purposes.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
   where Processes.process = "*echo*" AND Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", "*~/.profile", "~/.bash_logout")
@@ -57,6 +57,7 @@ tags:
   context:
   - source:endpoint
   - stage:Privilege Escalation Persistence
+  - stage:Persistence
   message: a commandline $process$ that may modify profile files in $dest$
   observable:
   - name: dest
@@ -68,4 +69,4 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16

From b9f44d9b2dd50ff1b8bb9dee679cae2cc7e9b298 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 12 Jan 2022 09:12:43 +0100
Subject: [PATCH 04/16] linux_persist_priv_batch_5

---
 ...ss_or_modification_of_sshd_config_file.yml | 72 +++++++++++++++++++
 .../linux_possible_ssh_key_file_creation.yml  | 68 ++++++++++++++++++
 ..._modification_of_sshd_config_file.test.yml | 12 ++++
 ...ux_possible_ssh_key_file_creation.test.yml | 12 ++++
 4 files changed, 164 insertions(+)
 create mode 100644 detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
 create mode 100644 detections/endpoint/linux_possible_ssh_key_file_creation.yml
 create mode 100644 tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml
 create mode 100644 tests/endpoint/linux_possible_ssh_key_file_creation.test.yml

diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
new file mode 100644
index 0000000000..4fb36867c1
--- /dev/null
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -0,0 +1,72 @@
+name: Linux Possible Access Or Modification Of sshd_config File
+id: 7a85eb24-72da-11ec-ac76-acde48001122
+version: 1
+date: '2022-01-11'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious process command-line that might be accessing or modifying sshd_config. 
+  This file is the ssh configuration file that might be modify by threat actors or adversaries to redirect port connection, allow user 
+  using authorized key generated during attack. This anomaly detection might catch noise from administrator auditing or modifying ssh configuration 
+  file. In this scenario filter is needed
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name
+  IN("cat", "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/ssh/sshd_config")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `linux_possible_access_or_modification_of_sshd_config_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
+references:
+- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
+- https://attack.mitre.org/techniques/T1098/004/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1098.004
+  - T1098
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50 
+  # (impact * confidence)/100
+  risk_score: 25 
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation
+  - Stage:Persistence
+  message: a commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
new file mode 100644
index 0000000000..5692ddf1a9
--- /dev/null
+++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
@@ -0,0 +1,68 @@
+name: Linux Possible Ssh Key File Creation
+id: c04ef40c-72da-11ec-8eac-acde48001122
+version: 1
+date: '2022-01-11'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. This technique is commonly abused by 
+  threat actors and adversaries to gain persistence and privilege escalation to the targeted host. by creating ssh private and public key and 
+  passing the public key to the attacker server. threat actor can access remotely the machine using openssh daemon service.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/.ssh*")
+  by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `linux_possible_ssh_key_file_creation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+known_false_positives: Administrator or network operator can create file in ~/.ssh
+  folders for automation purposes. Please update the filter macros to remove false positives.
+references:
+- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
+- https://attack.mitre.org/techniques/T1098/004/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1098.004
+  - T1098
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
+  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: A file $file_name$ is created in $file_path$ on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
\ No newline at end of file
diff --git a/tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml b/tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml
new file mode 100644
index 0000000000..1127c4e2ab
--- /dev/null
+++ b/tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml
@@ -0,0 +1,12 @@
+name: Linux Possible Access Or Modification Of sshd_config File Unit Test
+tests:
+- name: Linux Possible Access Or Modification Of sshd_config File
+  file: endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file
diff --git a/tests/endpoint/linux_possible_ssh_key_file_creation.test.yml b/tests/endpoint/linux_possible_ssh_key_file_creation.test.yml
new file mode 100644
index 0000000000..5141b7c3d9
--- /dev/null
+++ b/tests/endpoint/linux_possible_ssh_key_file_creation.test.yml
@@ -0,0 +1,12 @@
+name: Linux Possible Ssh Key File Creation Unit Test
+tests:
+- name: Linux Possible Ssh Key File Creation
+  file: endpoint/linux_possible_ssh_key_file_creation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file

From fc0719eda4dcf7176c9767f5028e8f3cc527d2f6 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-46-131>
Date: Wed, 12 Jan 2022 08:52:58 +0000
Subject: [PATCH 05/16] Added detection testing service results inLinux
 Possible Ssh Key File Creation

---
 .../linux_possible_ssh_key_file_creation.yml   | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
index 5692ddf1a9..1cfacb10ba 100644
--- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml
+++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
@@ -6,21 +6,22 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. This technique is commonly abused by 
-  threat actors and adversaries to gain persistence and privilege escalation to the targeted host. by creating ssh private and public key and 
-  passing the public key to the attacker server. threat actor can access remotely the machine using openssh daemon service.
+description: This analytic is to look for possible ssh key file creation on ~/.ssh/
+  folder. This technique is commonly abused by threat actors and adversaries to gain
+  persistence and privilege escalation to the targeted host. by creating ssh private
+  and public key and passing the public key to the attacker server. threat actor can
+  access remotely the machine using openssh daemon service.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/.ssh*")
   by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
-  | `drop_dm_object_name(Filesystem)` 
-  | `security_content_ctime(lastTime)` 
-  | `security_content_ctime(firstTime)` 
+  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `linux_possible_ssh_key_file_creation_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the file name, file path, and process_guid executions from your endpoints.
   If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can create file in ~/.ssh
-  folders for automation purposes. Please update the filter macros to remove false positives.
+  folders for automation purposes. Please update the filter macros to remove false
+  positives.
 references:
 - https://www.hackingarticles.in/ssh-penetration-testing-port-22/
 - https://attack.mitre.org/techniques/T1098/004/
@@ -65,4 +66,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16
+  automated_detection_testing: passed

From 0ac29166d04eb1af46d48da8f1d5592b65acee9e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-60-45>
Date: Wed, 12 Jan 2022 08:55:52 +0000
Subject: [PATCH 06/16] Added detection testing service results inLinux
 Possible Access Or Modification Of sshd_config File

---
 ...ss_or_modification_of_sshd_config_file.yml | 34 ++++++++++---------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index 4fb36867c1..bda1992328 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -6,22 +6,24 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to look for suspicious process command-line that might be accessing or modifying sshd_config. 
-  This file is the ssh configuration file that might be modify by threat actors or adversaries to redirect port connection, allow user 
-  using authorized key generated during attack. This anomaly detection might catch noise from administrator auditing or modifying ssh configuration 
-  file. In this scenario filter is needed
+description: This analytic is to look for suspicious process command-line that might
+  be accessing or modifying sshd_config. This file is the ssh configuration file that
+  might be modify by threat actors or adversaries to redirect port connection, allow
+  user using authorized key generated during attack. This anomaly detection might
+  catch noise from administrator auditing or modifying ssh configuration file. In
+  this scenario filter is needed
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name
-  IN("cat", "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/ssh/sshd_config")
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `linux_possible_access_or_modification_of_sshd_config_file_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat",
+  "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/ssh/sshd_config") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_or_modification_of_sshd_config_file_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
-known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
 references:
 - https://www.hackingarticles.in/ssh-penetration-testing-port-22/
 - https://attack.mitre.org/techniques/T1098/004/
@@ -51,9 +53,8 @@ tags:
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 50
-  confidence: 50 
-  # (impact * confidence)/100
-  risk_score: 25 
+  confidence: 50
+  risk_score: 25
   context:
   - source:endpoint
   - stage:Privilege Escalation
@@ -70,3 +71,4 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
+  automated_detection_testing: passed

From 3d75e6df5215f343c03eee61ced10aceead55c60 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-43-64>
Date: Wed, 12 Jan 2022 09:22:22 +0000
Subject: [PATCH 07/16] Added detection testing service results inLinux
 NOPASSWD Entry In Sudoers File

---
 .../linux_nopasswd_entry_in_sudoers_file.yml  | 45 ++++++++++---------
 1 file changed, 24 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index e8db981a4c..3521fc6afb 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -6,22 +6,25 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to look for suspicious command lines that may add entry to /etc/sudoers with NOPASSWD attribute in linux platform.
-  This technique is commonly abuse by adversaries, malware author and red teamers to gain elevated privilege to the targeted or compromised host. 
-  /etc/sudoers file controls who can run what commands users can execute on the machines and can also control whether user need a password to execute particular commands. 
-  This file is composed of aliases (basically variables) and user specifications.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process = "*NOPASSWD:*" 
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+description: This analytic is to look for suspicious command lines that may add entry
+  to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly
+  abuse by adversaries, malware author and red teamers to gain elevated privilege
+  to the targeted or compromised host. /etc/sudoers file controls who can run what
+  commands users can execute on the machines and can also control whether user need
+  a password to execute particular commands. This file is composed of aliases (basically
+  variables) and user specifications.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*NOPASSWD:*"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_nopasswd_entry_in_sudoers_file_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: administrator or network operator can execute this command. filter is needed 
+  Sysmon TA.
+known_false_positives: administrator or network operator can execute this command.
+  filter is needed
 references:
 - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
 - https://help.ubuntu.com/community/Sudoers
@@ -42,18 +45,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 80
-  confidence: 80 
-  # (impact * confidence)/100
-  risk_score: 64 
+  confidence: 80
+  risk_score: 64
   context:
   - source:endpoint
   - stage:Privilege Escalation
@@ -70,3 +72,4 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
+  automated_detection_testing: passed

From 8d4d33bf5a3bd9c6846ae1c5838b82407a50edde Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 13 Jan 2022 17:54:09 +0100
Subject: [PATCH 08/16] Update linux_nopasswd_entry_in_sudoers_file.yml

---
 detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index 3521fc6afb..d512dacf6f 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -57,7 +57,7 @@ tags:
   confidence: 80
   risk_score: 64
   context:
-  - source:endpoint
+  - Source:Endpoint
   - stage:Privilege Escalation
   - Stage:Persistence
   message: a commandline $process$ executed on $dest$

From edd652e7239ba4fd4a61f34199f43fa6fafbbd2f Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 13 Jan 2022 17:54:25 +0100
Subject: [PATCH 09/16] Update
 linux_possible_access_or_modification_of_sshd_config_file.yml

---
 ...inux_possible_access_or_modification_of_sshd_config_file.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index bda1992328..1cc521b9a8 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -56,7 +56,7 @@ tags:
   confidence: 50
   risk_score: 25
   context:
-  - source:endpoint
+  - Source:Endpoint
   - stage:Privilege Escalation
   - Stage:Persistence
   message: a commandline $process$ executed on $dest$

From 5d630fcbbab19dd5c674f2973fdb8884a4f8e0f5 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 13 Jan 2022 17:54:39 +0100
Subject: [PATCH 10/16] Update
 linux_possible_append_command_to_profile_config_file.yml

---
 .../linux_possible_append_command_to_profile_config_file.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index bad838f9b5..9038d4f07b 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -55,7 +55,7 @@ tags:
   # (impact * confidence)/100
   risk_score: 49
   context:
-  - source:endpoint
+  - Source:Endpoint
   - stage:Privilege Escalation Persistence
   - stage:Persistence
   message: a commandline $process$ that may modify profile files in $dest$

From 3356f45dab00c8dc2eb056ae5233f042f30590ed Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 13 Jan 2022 17:56:48 +0100
Subject: [PATCH 11/16] Update linux_nopasswd_entry_in_sudoers_file.yml

---
 detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index d512dacf6f..6f95d7fb27 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -23,8 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: administrator or network operator can execute this command.
-  filter is needed
+known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
 - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
 - https://help.ubuntu.com/community/Sudoers

From f808a4eb4a444f7cfc99f8e665b2aeb39db4bc36 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 13 Jan 2022 17:57:34 +0100
Subject: [PATCH 12/16] Update
 linux_possible_append_command_to_profile_config_file.yml

---
 .../linux_possible_append_command_to_profile_config_file.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index 9038d4f07b..71b0a912e0 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -21,7 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. 
-known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed 
+known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
 - https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work
 - https://attack.mitre.org/techniques/T1546/004/

From 7935b368bc4724cb587997e1b5fb4ce9bbf3cf12 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 13 Jan 2022 18:11:17 +0100
Subject: [PATCH 13/16] linux_persist_priv_batch_5

---
 ...ux_possible_access_or_modification_of_sshd_config_file.yml | 2 +-
 ...ssible_access_or_modification_of_sshd_config_file.test.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index 1cc521b9a8..e7acbdecc6 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -1,4 +1,4 @@
-name: Linux Possible Access Or Modification Of sshd_config File
+name: Linux Possible Access Or Modification Of sshd Config File
 id: 7a85eb24-72da-11ec-ac76-acde48001122
 version: 1
 date: '2022-01-11'
diff --git a/tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml b/tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml
index 1127c4e2ab..af91e9b10c 100644
--- a/tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml
+++ b/tests/endpoint/linux_possible_access_or_modification_of_sshd_config_file.test.yml
@@ -1,6 +1,6 @@
-name: Linux Possible Access Or Modification Of sshd_config File Unit Test
+name: Linux Possible Access Or Modification Of sshd Config File Unit Test
 tests:
-- name: Linux Possible Access Or Modification Of sshd_config File
+- name: Linux Possible Access Or Modification Of sshd Config File
   file: endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'

From d087ca53eb3a75520f43a4072f5fdb60f83983b1 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 13 Jan 2022 09:33:38 -0800
Subject: [PATCH 14/16] Update linux_nopasswd_entry_in_sudoers_file.yml

---
 .../endpoint/linux_nopasswd_entry_in_sudoers_file.yml       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index 6f95d7fb27..27e9a32aa0 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -21,9 +21,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `linux_nopasswd_entry_in_sudoers_file_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives.
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
 - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
 - https://help.ubuntu.com/community/Sudoers

From 06d9aee13ec9171272c06463116bf067368a0fb5 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 13 Jan 2022 09:34:01 -0800
Subject: [PATCH 15/16] Update
 linux_possible_access_or_modification_of_sshd_config_file.yml

---
 ...inux_possible_access_or_modification_of_sshd_config_file.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index e7acbdecc6..df9abdb9a6 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -57,7 +57,7 @@ tags:
   risk_score: 25
   context:
   - Source:Endpoint
-  - stage:Privilege Escalation
+  - Stage:Privilege Escalation
   - Stage:Persistence
   message: a commandline $process$ executed on $dest$
   observable:

From 62fea066a900ea918c3517652a29ef0e1b14b71d Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 13 Jan 2022 09:34:59 -0800
Subject: [PATCH 16/16] Update
 linux_possible_append_command_to_profile_config_file.yml

---
 ...nux_possible_append_command_to_profile_config_file.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index 71b0a912e0..aaf0e4f3f4 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -19,8 +19,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `linux_possible_append_command_to_profile_config_file_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
 known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
 - https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work
@@ -56,8 +56,8 @@ tags:
   risk_score: 49
   context:
   - Source:Endpoint
-  - stage:Privilege Escalation Persistence
-  - stage:Persistence
+  - Stage:Privilege Escalation Persistence
+  - Stage:Persistence
   message: a commandline $process$ that may modify profile files in $dest$
   observable:
   - name: dest