admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixing integration test

Browse Source
This commit is contained in:
Bhavin Patel
2024-09-06 00:34:46 +05:30
parent 4bc3d0fc03
commit d80df15dbc
5 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_auditd_add_user_account_type.yml
+1 -1
View File
@@ -39,7 +39,7 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 50
message: New [$type$] event on host - [$dest$] to add a user account type.
message: New PATH event on host - [$dest$] to add a user account type.
mitre_attack_id:
- T1136
- T1136.001
detections/endpoint/linux_auditd_doas_conf_file_creation.yml
+1 -1
View File
@@ -15,7 +15,7 @@ description: The following analytic detects the creation of the doas.conf file o
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest |
stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID
stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type
dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_doas_conf_file_creation_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
+1 -1
View File
@@ -14,7 +14,7 @@ description: The following analytic detects potential access or modification of
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats
count min(_time) as firstTime max(_time) as lastTime by name nametype OGID dest
count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_sudoers_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml
+1 -1
View File
@@ -9,7 +9,7 @@ description: "The following analytic detects suspicious preload hijacking via th
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID
| stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type
dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_preload_hijack_via_preload_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml
+1 -1
View File
@@ -22,7 +22,7 @@ search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/
"/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login",
"/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as
dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype
OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_unix_shell_configuration_modification_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line