From d643ea9701490efc244ca8ba86e5b5aaff68717e Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 13:54:20 +0000 Subject: [PATCH] Added detection testing service results inDetect LinEnum execution --- .../endpoint/detect_linenum_execution.yml | 30 ++++++++++++------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index acc6d20ce2..88344869e8 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,11 +6,18 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. -search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory - | `detect_linenum_execution_filter` ' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. +description: LinEnum is a bash script that performs discovery commands for accounts, + processes, kernel version, applications, services, and uses the information from + these commands to present operator with ways of escalating privileges or further + exploitation of targeted host. +search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" + | stats count by Computer CommandLine user process_exec process_current_directory + | `detect_linenum_execution_filter` ' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Very rare to perform such an extensive grep on a system, however + certain monitoring tools can produce similar results. It is important if monitoring + tools are in place to verify what is the actual process directory of execution. references: - https://github.com/rebootuser/LinEnum - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist @@ -19,8 +26,8 @@ tags: - Linux Post-Exploitation confidence: 90 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt impact: 50 @@ -37,10 +44,10 @@ tags: - T1016 - T1033 observable: - - name: Computer - type: Endpoint - role: - - Victim + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,3 +60,4 @@ tags: - process_current_directory risk_score: 45 security_domain: endpoint + automated_detection_testing: passed