admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into nvm-batch1

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2025-07-04 00:33:26 +02:00
committed by GitHub
parent 6b72dcb76f 287b0d8d60
commit e151b4e1ae
18 changed files with 389 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data_sources/linux_auditd_daemon_abort.yml
+35
View File
@@ -0,0 +1,35 @@
name: Linux Auditd Daemon Abort
id: cc8b3bb0-0fae-4236-9c61-fe2d7138bd63
version: 2
date: '2025-06-06'
author: Teoderick Contreras, Splunk
description: Logs the execution of processes on a Linux system, including details
about the auditd daemon status.
source: auditd
sourcetype: auditd
mitre_components:
- Command Execution
- Process Creation
- Process Metadata
- OS API Execution
- Application Log Content
separator: type
separator_value: DAEMON_ABORT
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 10.1.0
fields:
- type
- op
- res
- pid
- uid
example_log: 'type=DAEMON_ABORT msg=audit(06/05/2025 11:03:38.453:6845) : op=set-pid auid=unset pid=61314 uid=root ses=unset subj=unconfined res=failed'
output_fields:
- op
- res
- pid
- uid
- dest
data_sources/linux_auditd_daemon_end.yml
+35
View File
@@ -0,0 +1,35 @@
name: Linux Auditd Daemon End
id: 15135c45-e302-4d5a-a38a-3e8279f2ebd8
version: 2
date: '2025-06-06'
author: Teoderick Contreras, Splunk
description: Logs the execution of processes on a Linux system, including details
about the auditd daemon status.
source: auditd
sourcetype: auditd
mitre_components:
- Command Execution
- Process Creation
- Process Metadata
- OS API Execution
- Application Log Content
separator: type
separator_value: DAEMON_END
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 10.1.0
fields:
- type
- op
- res
- auid
- pid
example_log: 'type=DAEMON_END msg=audit(06/05/2025 11:01:46.838:9436) : op=terminate auid=root pid=1 subj=unconfined res=success'
output_fields:
- op
- res
- pid
- uid
- dest
data_sources/linux_auditd_daemon_start.yml
+36
View File
@@ -0,0 +1,36 @@
name: Linux Auditd Daemon Start
id: f1b97407-ddf0-41a5-8685-ada05aae3555
version: 2
date: '2025-06-06'
author: Teoderick Contreras, Splunk
description: Logs the execution of processes on a Linux system, including details
about the auditd daemon status.
source: auditd
sourcetype: auditd
mitre_components:
- Command Execution
- Process Creation
- Process Metadata
- OS API Execution
- Application Log Content
separator: type
separator_value: DAEMON_START
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
supported_TA:
- name: Splunk Add-on for Unix and Linux
url: https://splunkbase.splunk.com/app/833
version: 10.1.0
fields:
- type
- op
- res
- auid
- pid
example_log: 'type=DAEMON_START msg=audit(06/05/2025 11:03:38.949:6844) : op=start ver=3.0.7 format=enriched kernel=6.8.0-1029-aws auid=unset pid=61323 uid=root ses=unset subj=unconfined res=success'
output_fields:
- op
- res
- pid
- uid
- dest
detections/endpoint/linux_auditd_add_user_account_type.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Add User Account Type
id: f8c325ea-506e-4105-8ccf-da1492e90115
version: 7
date: '2025-05-02'
version: 8
date: '2025-06-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -14,8 +14,8 @@ description: The following analytic detects the suspicious add user account type
early is essential to prevent potential security incidents.
data_source:
- Linux Auditd Add User
search: '`linux_auditd` type=ADD_USER | rename hostname as dest| stats count min(_time)
as firstTime max(_time) as lastTime by exe pid dest res UID type | `security_content_ctime(firstTime)`
search: '`linux_auditd` type=ADD_USER | rename host as dest| stats count min(_time)
as firstTime max(_time) as lastTime by exe pid dest res type | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_type_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
detections/endpoint/linux_auditd_auditd_daemon_abort.yml
+68
View File
@@ -0,0 +1,68 @@
name: Linux Auditd Auditd Daemon Abort
id: 76d6573f-c4ab-4fa1-8390-c036416d4add
version: 1
date: '2025-06-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the abnormal termination of the Linux audit daemon (auditd) by identifying DAEMON_ABORT events in audit logs. These terminations suggest a serious failure of the auditing subsystem, potentially due to resource exhaustion, corruption, or malicious interference. Unlike a clean shutdown, DAEMON_ABORT implies that audit logging may have been disabled without system administrator intent. Alerts should be generated on detection and correlated with DAEMON_START, DAEMON_END, and system logs to determine root cause. If no DAEMON_START follows soon after, or this pattern repeats, it indicates a high-severity issue that impacts log integrity and should be immediately investigated.
data_source:
- Linux Auditd Daemon Abort
search: '`linux_auditd` type=DAEMON_ABORT
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by type op res uid dest pid
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_auditd_daemon_abort_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application
for automation purposes. Please update the filter macros to remove false positives.
references:
- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Auditd service event - [$type$] event occurred on host - [$dest$].
risk_objects:
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
- T1562.012
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.012/auditd_daemon_type/linux_auditd_daemon.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_auditd_daemon_shutdown.yml
+68
View File
@@ -0,0 +1,68 @@
name: Linux Auditd Auditd Daemon Shutdown
id: 6e2574b3-e24b-4321-ae3c-ba83a75bb714
version: 1
date: '2025-06-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the unexpected termination of the Linux Audit daemon (auditd) by monitoring for log entries of type DAEMON_END. This event signifies that the audit logging service has stopped, either due to a legitimate system shutdown, manual administrative action, or potentially malicious tampering. Since auditd is responsible for recording critical security events, its sudden stoppage may indicate an attempt to disable security monitoring or evade detection during an attack. This detection should be correlated with system logs to determine whether the shutdown was part of routine maintenance or an anomaly. If confirmed as malicious, this could lead to a compromised system where security events are no longer being logged, allowing attackers to operate undetected. Therefore, monitoring and alerting on auditd shutdown events is crucial for maintaining the integrity of system security monitoring.
data_source:
- Linux Auditd Daemon End
search: '`linux_auditd` type=DAEMON_END
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by type op res auid dest pid
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_auditd_daemon_shutdown_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application
for automation purposes. Please update the filter macros to remove false positives.
references:
- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Auditd service event - [$type$] event occurred on host - [$dest$].
risk_objects:
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
- T1562.012
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.012/auditd_daemon_end/linux_daemon_end.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_auditd_daemon_start.yml
+68
View File
@@ -0,0 +1,68 @@
name: Linux Auditd Auditd Daemon Start
id: 6b0cb0ff-9a7e-4475-a687-43827fdb31d6
version: 1
date: '2025-06-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the (re)initialization of the Linux audit daemon (auditd) by identifying log entries of type DAEMON_START. This event indicates that the audit subsystem has resumed logging after being stopped or has started during system boot. While DAEMON_START may be expected during reboots or legitimate configuration changes, it can also signal attempts to re-enable audit logging after evasion, or restarts with modified or reduced rule sets. Monitoring this event in correlation with DAEMON_END, DAEMON_ABORT, and auditctl activity provides visibility into the continuity and integrity of audit logs. Frequent or unexplained DAEMON_START events should be investigated, especially if they are not accompanied by valid administrative or system activity.
data_source:
- Linux Auditd Daemon Start
search: '`linux_auditd` type=DAEMON_START
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by type op res auid dest pid
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_auditd_daemon_start_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
which is essential for correctly parsing and categorizing the data. The next step
involves normalizing the field names to match the field names set by the Splunk
Common Information Model (CIM) to ensure consistency across different data sources
and enhance the efficiency of data modeling. This approach enables effective monitoring
and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application
for automation purposes. Please update the filter macros to remove false positives.
references:
- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Auditd service event - [$type$] event occurred on host - [$dest$].
risk_objects:
- field: dest
type: system
score: 15
threat_objects: []
tags:
analytic_story:
- Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
- T1562.012
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.012/auditd_daemon_type/linux_auditd_daemon.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_auditd_service_stop.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Auditd Service Stop
id: 6cb9d0e1-eabe-41de-a11a-5efade354e9d
version: 5
date: '2025-05-02'
version: 6
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -15,7 +15,7 @@ description: The following analytic detects the suspicious auditd service stop.
data_source:
- Linux Auditd Service Stop
search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm
| stats count min(_time) as firstTime max(_time) as lastTime by type pid comm
exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`linux_auditd_auditd_service_stop_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Disable Or Modify System Firewall
id: 07052556-d4b5-4bae-89aa-cbdc1bb11250
version: 6
date: '2025-05-02'
version: 7
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -15,8 +15,8 @@ description: The following analytic detects the suspicious disable or modify sys
data_source:
- Linux Auditd Service Stop
search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | rename host
as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid
UID comm exe unit dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid comm exe unit dest
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_disable_or_modify_system_firewall_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
detections/endpoint/linux_auditd_doas_conf_file_creation.yml
+10 -7
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Doas Conf File Creation
id: 61059783-574b-40d2-ac2f-69b898afd6b4
version: 6
date: '2025-05-02'
version: 7
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -14,10 +14,13 @@ description: The following analytic detects the creation of the doas.conf file o
commands with root privileges, leading to full system compromise.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest |
stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID
type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_doas_conf_file_creation_filter`'
search: '`linux_auditd` type=PATH name ="/etc/doas.conf*"
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_doas_conf_file_creation_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
@@ -70,6 +73,6 @@ tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_audited_doas_conf.log
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_path_doas_config.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_osquery_service_stop.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Osquery Service Stop
id: 0c320fea-6e87-4b99-a884-74d09d4b655d
version: 5
date: '2025-05-02'
version: 6
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -16,7 +16,7 @@ description: The following analytic detects suspicious stopping of the `osquery`
data_source:
- Linux Auditd Service Stop
search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm
| stats count min(_time) as firstTime max(_time) as lastTime by type pid comm
exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`linux_auditd_osquery_service_stop_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml
+10 -7
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Possible Access Or Modification Of Sshd Config File
id: acb3ea33-70f7-47aa-b335-643b3aebcb2f
version: 6
date: '2025-05-02'
version: 7
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -15,10 +15,13 @@ description: The following analytic detects suspicious access or modification of
access, posing a severe security risk.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID
type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`'
search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*"
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
@@ -73,6 +76,6 @@ tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_auditd_ssh_config.log
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_path_ssh_config.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
+10 -7
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Possible Access To Sudoers File
id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834
version: 9
date: '2025-05-02'
version: 10
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -14,10 +14,13 @@ description: The following analytic detects potential access or modification of
targeted host.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats
count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type
dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_possible_access_to_sudoers_file_filter`'
search: '`linux_auditd` type=PATH name="/etc/sudoers*"
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_possible_access_to_sudoers_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
@@ -72,6 +75,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_path_sudoers.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml
+9 -6
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File
id: fea71cf0-fa10-4ef6-9202-9682b2e0c477
version: 7
date: '2025-05-02'
version: 8
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
@@ -15,9 +15,12 @@ description: The following analytic detects potential tampering with cronjob fil
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*")
| rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime
by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`'
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures
command-line executions and process details on Unix/Linux systems. These logs should
@@ -54,6 +57,6 @@ tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_auditd_cron_file_audited2.log
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_path_cron.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml
+10 -7
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Preload Hijack Via Preload File
id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f
version: 6
date: '2025-05-02'
version: 7
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -15,10 +15,13 @@ description: The following analytic detects suspicious preload hijacking via the
and security.
data_source:
- Linux Auditd Path
search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID
type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_preload_hijack_via_preload_file_filter`'
search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*"
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_preload_hijack_via_preload_file_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
@@ -72,6 +75,6 @@ tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_preload_file/linux_auditd_preload_file.log
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_preload_file/linux_path_preload.log
source: auditd
sourcetype: auditd
detections/endpoint/linux_auditd_stop_services.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Stop Services
id: 43bc9281-753b-4743-b4b7-60af84f085f3
version: 5
date: '2025-05-02'
version: 6
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
@@ -15,7 +15,7 @@ description: The following analytic detects attempts to stop a service on Linux
data_source:
- Linux Auditd Service Stop
search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time)
as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`|
as firstTime max(_time) as lastTime by type pid comm exe dest | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures
detections/endpoint/linux_auditd_sysmon_service_stop.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Sysmon Service Stop
id: 20901256-633a-40de-8753-7b88811a460f
version: 5
date: '2025-05-02'
version: 6
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -15,7 +15,7 @@ description: The following analytic detects the suspicious sysmon service stop.
data_source:
- Linux Auditd Service Stop
search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm
| stats count min(_time) as firstTime max(_time) as lastTime by type pid comm
exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`linux_auditd_sysmon_service_stop_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml
+10 -7
View File
@@ -1,7 +1,7 @@
name: Linux Auditd Unix Shell Configuration Modification
id: 66f737c6-3f7f-46ed-8e9b-cc0e5bf01f04
version: 6
date: '2025-05-02'
version: 7
date: '2025-06-10'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -20,10 +20,13 @@ search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/
"/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile",
"root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc",
"/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login",
"/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as
dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype
OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`linux_auditd_unix_shell_configuration_modification_filter`'
"/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout")
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
by name nametype ogid type dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_unix_shell_configuration_modification_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
executions and process details on Unix/Linux systems. These logs should be ingested
@@ -78,6 +81,6 @@ tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_auditd_unix_shell_mod_config.log
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config//linux_path_profile_d.log
source: auditd
sourcetype: auditd