Branch was auto-updated.

detections/endpoint/linux_at_application_execution.yml

@@ -13,7 +13,7 @@ description: The following analytic identifies a suspicious process creation of
   and after this process execution, when it was executed and what schedule task it
   will execute.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
-  where  Processes.process_name = at OR Processes.parent_process_name = at by Processes.dest
+  where  Processes.process_name IN ("at", "atd") OR Processes.parent_process_name IN ("at", "atd") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`'

detections/endpoint/linux_common_process_for_elevation_control.yml

@@ -16,10 +16,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chmod",
   "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr",
   "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid",
-  "setregid") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat
+  "setregid", "chattr") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat
   *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *",
   "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid
-  *", "*setregid *", "*setcap *") by Processes.dest Processes.user Processes.parent_process_name
+  *", "*setregid *", "*setcap *", "*chattr *") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`'

detections/endpoint/linux_dd_file_overwrite.yml

@@ -0,0 +1,70 @@
+name: Linux DD File Overwrite
+id: 9b6aae5e-8d85-11ec-b2ae-acde48001122
+version: 1
+date: '2022-02-14'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for dd command to overwrite file. This technique was abused by adversaries or 
+  threat actor to destroy files or data on specific system or in a large number of host within network to interrupt host avilability,
+  services and many more. This is also used to destroy data where it make the file irrecoverable by forensic techniques through overwriting files,
+  data or local and remote drives.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name = "dd" AND Processes.process = "*of=*"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `linux_dd_file_overwrite_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+references:
+- https://gtfobins.github.io/gtfobins/dd/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
+tags:
+  analytic_story:
+  - Data Destruction
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1485
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 80 
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: A commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

detections/endpoint/linux_system_network_discovery.yml

@@ -0,0 +1,70 @@
+name: Linux System Network Discovery
+id: 535cb214-8b47-11ec-a2c7-acde48001122
+version: 1
+date: '2022-02-11'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for possible enumeration of local network configuration. 
+  This technique is commonly used as part of recon of adversaries or threat actor to know some network information for its next or further
+  attack. This anomaly detections may capture normal event made by administrator during auditing or testing network connection of specific 
+  host or network to network. 
+search: '| tstats `security_content_summariesonly` 
+  count values(Processes.process_name) as process_name_list values(Processes.process) as process_list 
+  values(Processes.process_id) as process_id_list values(Processes.parent_process_id) as parent_process_id_list 
+  values(Processes.process_guid) as process_guid_list dc(Processes.process_name) as process_name_count from datamodel=Endpoint.Processes 
+  where Processes.process_name IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route") 
+  by _time span=30m Processes.dest Processes.user 
+  | where process_name_count >=4
+  | `drop_dm_object_name(Processes)`| `linux_system_network_discovery_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+references:
+-  https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
+tags:
+  analytic_story:
+  - Network Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1016
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 30 
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconaissance
+  message: A commandline $process$ executed on $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

stories/data_destruction.yml

@@ -0,0 +1,22 @@
+name: Data Destruction
+id: 4ae5c0d1-cebd-47d1-bfce-71bf096e38aa
+version: 1
+date: '2022-02-14'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the data destruction, including deleting files, overwriting files, wiping disk and encrypting files.
+narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption
+  is the goal. 
+references:
+- https://attack.mitre.org/techniques/T1485/
+- https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
+- https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware
+tags:
+  analytic_story: Data Destruction
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/network_discovery.yml

@@ -0,0 +1,23 @@
+name: Network Discovery
+id: af228995-f182-49d7-90b3-2a732944f00f
+version: 1
+date: '2022-02-14'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, 
+  firewall settings and many more.
+narrative: Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, 
+  including determining certain access within the target network and what actions to do next.
+references:
+- https://attack.mitre.org/techniques/T1016/
+- https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf
+- https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
+tags:
+  analytic_story: Network Discovery
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/linux_dd_file_overwrite.test.yml

@@ -0,0 +1,12 @@
+name: Linux DD File Overwrite Unit Test
+tests:
+- name: Linux DD File Overwrite
+  file: endpoint/linux_dd_file_overwrite.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/linux_system_network_discovery.test.yml

@@ -0,0 +1,12 @@
+name: Linux System Network Discovery Unit Test
+tests:
+- name: Linux System Network Discovery
+  file: endpoint/linux_system_network_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux