From d80df15dbc01ca5ffda5ca0859bf8b42ada18985 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 6 Sep 2024 00:34:46 +0530 Subject: [PATCH] fixing integration test --- detections/endpoint/linux_auditd_add_user_account_type.yml | 2 +- detections/endpoint/linux_auditd_doas_conf_file_creation.yml | 2 +- .../endpoint/linux_auditd_possible_access_to_sudoers_file.yml | 2 +- .../endpoint/linux_auditd_preload_hijack_via_preload_file.yml | 2 +- .../linux_auditd_unix_shell_configuration_modification.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 1b7d6b8f9f..2f009f742f 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -39,7 +39,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: New [$type$] event on host - [$dest$] to add a user account type. + message: New PATH event on host - [$dest$] to add a user account type. mitre_attack_id: - T1136 - T1136.001 diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 563cd85b6c..6c4cfcf489 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -15,7 +15,7 @@ description: The following analytic detects the creation of the doas.conf file o data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest | - stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID + stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_doas_conf_file_creation_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 7c5b6fc127..8c2c0e4081 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -14,7 +14,7 @@ description: The following analytic detects potential access or modification of data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats - count min(_time) as firstTime max(_time) as lastTime by name nametype OGID dest + count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_sudoers_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 109ef8c438..34b3113eb5 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -9,7 +9,7 @@ description: "The following analytic detects suspicious preload hijacking via th data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID + | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_via_preload_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index e1af798091..1655497758 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -22,7 +22,7 @@ search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/ "/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login", "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype - OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unix_shell_configuration_modification_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line