diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 07a98f45d8..075783c9f9 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -13,7 +13,7 @@ description: The following analytic identifies a suspicious process creation of and after this process execution, when it was executed and what schedule task it will execute. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes - where Processes.process_name = at OR Processes.parent_process_name = at by Processes.dest + where Processes.process_name IN ("at", "atd") OR Processes.parent_process_name IN ("at", "atd") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`' diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index 28eacca381..e0f2c65939 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -16,10 +16,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chmod", "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr", "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid", - "setregid") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat + "setregid", "chattr") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid - *", "*setregid *", "*setcap *") by Processes.dest Processes.user Processes.parent_process_name + *", "*setregid *", "*setcap *", "*chattr *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`' diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml new file mode 100644 index 0000000000..5ec2767a4b --- /dev/null +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -0,0 +1,70 @@ +name: Linux DD File Overwrite +id: 9b6aae5e-8d85-11ec-b2ae-acde48001122 +version: 1 +date: '2022-02-14' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to look for dd command to overwrite file. This technique was abused by adversaries or + threat actor to destroy files or data on specific system or in a large number of host within network to interrupt host avilability, + services and many more. This is also used to destroy data where it make the file irrecoverable by forensic techniques through overwriting files, + data or local and remote drives. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "dd" AND Processes.process = "*of=*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_dd_file_overwrite_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://gtfobins.github.io/gtfobins/dd/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md +tags: + analytic_story: + - Data Destruction + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1485 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Impact + message: A commandline $process$ executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml new file mode 100644 index 0000000000..93f8d5c2f8 --- /dev/null +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -0,0 +1,70 @@ +name: Linux System Network Discovery +id: 535cb214-8b47-11ec-a2c7-acde48001122 +version: 1 +date: '2022-02-11' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to look for possible enumeration of local network configuration. + This technique is commonly used as part of recon of adversaries or threat actor to know some network information for its next or further + attack. This anomaly detections may capture normal event made by administrator during auditing or testing network connection of specific + host or network to network. +search: '| tstats `security_content_summariesonly` + count values(Processes.process_name) as process_name_list values(Processes.process) as process_list + values(Processes.process_id) as process_id_list values(Processes.parent_process_id) as parent_process_id_list + values(Processes.process_guid) as process_guid_list dc(Processes.process_name) as process_name_count from datamodel=Endpoint.Processes + where Processes.process_name IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route") + by _time span=30m Processes.dest Processes.user + | where process_name_count >=4 + | `drop_dm_object_name(Processes)`| `linux_system_network_discovery_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md +tags: + analytic_story: + - Network Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1016 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconaissance + message: A commandline $process$ executed on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/stories/data_destruction.yml b/stories/data_destruction.yml new file mode 100644 index 0000000000..45cd0ac30d --- /dev/null +++ b/stories/data_destruction.yml @@ -0,0 +1,22 @@ +name: Data Destruction +id: 4ae5c0d1-cebd-47d1-bfce-71bf096e38aa +version: 1 +date: '2022-02-14' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the data destruction, including deleting files, overwriting files, wiping disk and encrypting files. +narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption + is the goal. +references: +- https://attack.mitre.org/techniques/T1485/ +- https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/ +- https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware +tags: + analytic_story: Data Destruction + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/network_discovery.yml b/stories/network_discovery.yml new file mode 100644 index 0000000000..9949ce6952 --- /dev/null +++ b/stories/network_discovery.yml @@ -0,0 +1,23 @@ +name: Network Discovery +id: af228995-f182-49d7-90b3-2a732944f00f +version: 1 +date: '2022-02-14' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, + firewall settings and many more. +narrative: Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, + including determining certain access within the target network and what actions to do next. +references: +- https://attack.mitre.org/techniques/T1016/ +- https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf +- https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/ +tags: + analytic_story: Network Discovery + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/linux_dd_file_overwrite.test.yml b/tests/endpoint/linux_dd_file_overwrite.test.yml new file mode 100644 index 0000000000..719a157be4 --- /dev/null +++ b/tests/endpoint/linux_dd_file_overwrite.test.yml @@ -0,0 +1,12 @@ +name: Linux DD File Overwrite Unit Test +tests: +- name: Linux DD File Overwrite + file: endpoint/linux_dd_file_overwrite.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file diff --git a/tests/endpoint/linux_system_network_discovery.test.yml b/tests/endpoint/linux_system_network_discovery.test.yml new file mode 100644 index 0000000000..ed79995680 --- /dev/null +++ b/tests/endpoint/linux_system_network_discovery.test.yml @@ -0,0 +1,12 @@ +name: Linux System Network Discovery Unit Test +tests: +- name: Linux System Network Discovery + file: endpoint/linux_system_network_discovery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file