diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml new file mode 100644 index 0000000000..7e29c8d51a --- /dev/null +++ b/detections/endpoint/linux_change_file_owner_to_root.yml @@ -0,0 +1,73 @@ +name: Linux Change File Owner To Root +id: c1400ea2-6257-11ec-ad49-acde48001122 +version: 1 +date: '2021-12-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for a commandline that change the file owner to root + using chown utility tool. This technique is commonly abuse by adversaries, malware + author and red teamers to escalate privilege to the targeted or compromised host + by changing the owner of their malicious file to root. This event is not so common + in corporate network except from the administrator doing normal task that needs + high privilege. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = chown + OR Processes.process = "*chown *") AND Processes.process = "* root *" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_change_file_owner_to_root_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users +- https://askubuntu.com/questions/617850/changing-from-user-to-superuser +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1222.002 + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 80 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may change ownership to root on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml new file mode 100644 index 0000000000..e861f65251 --- /dev/null +++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml @@ -0,0 +1,73 @@ +name: Linux File Created In Kernel Driver Directory +id: b85bbeec-6326-11ec-9311-acde48001122 +version: 1 +date: '2021-12-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for suspicious file creation in kernel/driver directory + in linux platform. This directory is known folder for all linux kernel module available + within the system. so creation of file in this directory is a good indicator that + there is a possible rootkit installation in the host machine. This technique was + abuse by adversaries, malware author and red teamers to gain high privileges to + their malicious code such us in kernel level. Even this event is not so common administrator + or legitimate 3rd party tool may install driver or linux kernel module as part of + its installation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/kernel/drivers/*") + by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `linux_file_created_in_kernel_driver_directory_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the file name, file path, and process_guid executions from your endpoints. + If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can create file in this folders + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ +- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup +- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1547.006 + - T1547 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 80 + confidence: 90 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml new file mode 100644 index 0000000000..48a20e8fb0 --- /dev/null +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -0,0 +1,71 @@ +name: Linux Insert Kernel Module Using Insmod Utility +id: 18b5a1a0-6326-11ec-943a-acde48001122 +version: 1 +date: '2021-12-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for inserting of linux kernel module using insmod utility function. + This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. + This Anomaly detection is a good indicator that someone installing kernel module in a linux host either admin or adversaries. filter is needed in this scenario +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN("kmod", "sudo") AND Processes.process = *insmod* + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_insert_kernel_module_using_insmod_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +references: +- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ +- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup +- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1547.006 + - T1547 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may install kernel module on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml new file mode 100644 index 0000000000..1229cbeb3a --- /dev/null +++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml @@ -0,0 +1,73 @@ +name: Linux Install Kernel Module Using Modprobe Utility +id: 387b278a-6326-11ec-aa2c-acde48001122 +version: 1 +date: '2021-12-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic looks for possible installing a linux kernel module using + modprobe utility function. This event can detect a installation of rootkit or malicious + kernel module to gain elevated privileges to their malicious code and bypassed detections. + This Anomaly detection is a good indicator that someone installing kernel module + in a linux host either admin or adversaries. filter is needed in this scenario +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("kmod", + "sudo") AND Processes.process = *modprobe* by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_install_kernel_module_using_modprobe_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ +- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup +- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1547.006 + - T1547 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 80 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may install kernel module on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml new file mode 100644 index 0000000000..7c8b43146e --- /dev/null +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -0,0 +1,70 @@ +name: Linux Preload Hijack Library Calls +id: cbe2ca30-631e-11ec-8670-acde48001122 +version: 1 +date: '2021-12-22' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious command that may hijack a library function in linux platform. + This technique is commonly abuse by adversaries, malware author and red teamers to gain privileges and persist on the machine. + This detection pertains to loading a dll to hijack or hook a library function of specific program using LD_PRELOAD command. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process = "*LD_PRELOAD*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_preload_hijack_library_calls_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +references: +- https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5 +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1574.006 + - T1574 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ that may hijack library function on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed \ No newline at end of file diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml new file mode 100644 index 0000000000..5509b9e6b9 --- /dev/null +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -0,0 +1,70 @@ +name: Linux Sudoers Tmp File Creation +id: be254a5c-63e7-11ec-89da-acde48001122 +version: 1 +date: '2021-12-23' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to looks for file creation of sudoers.tmp file cause + by editing /etc/sudoers using visudo or editor in linux platform. This technique may abuse + by adversaries, malware author and red teamers to gain elevated privilege to targeted + or compromised host. /etc/sudoers file controls who can run what commands as what + users on what machines and can also control special things such as whether you need + a password for particular commands. The file is composed of aliases (basically variables) + and user specifications (which control who can run what). +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*sudoers.tmp*") + by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `linux_sudoers_tmp_file_creation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + security_domain: endpoint + impact: 80 + confidence: 90 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A file $file_name$ is created in $file_path$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml new file mode 100644 index 0000000000..956364e969 --- /dev/null +++ b/detections/endpoint/linux_visudo_utility_execution.yml @@ -0,0 +1,73 @@ +name: Linux Visudo Utility Execution +id: 08c41040-624c-11ec-a71f-acde48001122 +version: 1 +date: '2021-12-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to looks for suspicious commandline that add entry to + /etc/sudoers by using visudo utility tool in linux platform. This technique may + abuse by adversaries, malware author and red teamers to gain elevated privilege + to targeted or compromised host. /etc/sudoers file controls who can run what commands + as what users on what machines and can also control special things such as whether + you need a password for particular commands. The file is composed of aliases (basically + variables) and user specifications (which control who can run what). +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = visudo + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_visudo_utility_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.003 + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 40 + confidence: 40 + risk_score: 16 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: A commandline $process$ executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + automated_detection_testing: passed diff --git a/tests/endpoint/linux_change_file_owner_to_root.test.yml b/tests/endpoint/linux_change_file_owner_to_root.test.yml new file mode 100644 index 0000000000..9549f84393 --- /dev/null +++ b/tests/endpoint/linux_change_file_owner_to_root.test.yml @@ -0,0 +1,12 @@ +name: Linux Change File Owner To Root Unit Test +tests: +- name: Linux Change File Owner To Root + file: endpoint/linux_change_file_owner_to_root.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_file_created_in_kernel_driver_directory.test.yml b/tests/endpoint/linux_file_created_in_kernel_driver_directory.test.yml new file mode 100644 index 0000000000..8ef34feb59 --- /dev/null +++ b/tests/endpoint/linux_file_created_in_kernel_driver_directory.test.yml @@ -0,0 +1,12 @@ +name: Linux File Created In Kernel Driver Directory Unit Test +tests: +- name: Linux File Created In Kernel Driver Directory + file: endpoint/linux_file_created_in_kernel_driver_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_insert_kernel_module_using_insmod_utility.test.yml b/tests/endpoint/linux_insert_kernel_module_using_insmod_utility.test.yml new file mode 100644 index 0000000000..bbbfab5235 --- /dev/null +++ b/tests/endpoint/linux_insert_kernel_module_using_insmod_utility.test.yml @@ -0,0 +1,12 @@ +name: Linux Insert Kernel Module Using Insmod Utility Unit Test +tests: +- name: Linux Insert Kernel Module Using Insmod Utility + file: endpoint/linux_insert_kernel_module_using_insmod_utility.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_install_kernel_module_using_modprobe_utility.test.yml b/tests/endpoint/linux_install_kernel_module_using_modprobe_utility.test.yml new file mode 100644 index 0000000000..8b436cebc1 --- /dev/null +++ b/tests/endpoint/linux_install_kernel_module_using_modprobe_utility.test.yml @@ -0,0 +1,12 @@ +name: Linux Install Kernel Module Using Modprobe Utility Unit Test +tests: +- name: Linux Install Kernel Module Using Modprobe Utility + file: endpoint/linux_install_kernel_module_using_modprobe_utility.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_preload_hijack_library_calls.test.yml b/tests/endpoint/linux_preload_hijack_library_calls.test.yml new file mode 100644 index 0000000000..526971f77c --- /dev/null +++ b/tests/endpoint/linux_preload_hijack_library_calls.test.yml @@ -0,0 +1,12 @@ +name: Linux Preload Hijack Library Calls Unit Test +tests: +- name: Linux Preload Hijack Library Calls + file: endpoint/linux_preload_hijack_library_calls.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_sudoers_tmp_file_creation.test.yml b/tests/endpoint/linux_sudoers_tmp_file_creation.test.yml new file mode 100644 index 0000000000..8629fafa45 --- /dev/null +++ b/tests/endpoint/linux_sudoers_tmp_file_creation.test.yml @@ -0,0 +1,12 @@ +name: Linux Sudoers Tmp File Creation Unit Test +tests: +- name: Linux Sudoers Tmp File Creation + file: endpoint/linux_sudoers_tmp_file_creation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_visudo_utility_execution.test.yml b/tests/endpoint/linux_visudo_utility_execution.test.yml new file mode 100644 index 0000000000..acc41ead03 --- /dev/null +++ b/tests/endpoint/linux_visudo_utility_execution.test.yml @@ -0,0 +1,12 @@ +name: Linux Visudo Utility Execution Unit Test +tests: +- name: Linux Visudo Utility Execution + file: endpoint/linux_visudo_utility_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file