diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml new file mode 100644 index 0000000000..dddb1ebdfd --- /dev/null +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -0,0 +1,35 @@ +name: Linux Auditd Daemon Abort +id: cc8b3bb0-0fae-4236-9c61-fe2d7138bd63 +version: 2 +date: '2025-06-06' +author: Teoderick Contreras, Splunk +description: Logs the execution of processes on a Linux system, including details + about the auditd daemon status. +source: auditd +sourcetype: auditd +mitre_components: +- Command Execution +- Process Creation +- Process Metadata +- OS API Execution +- Application Log Content +separator: type +separator_value: DAEMON_ABORT +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules +supported_TA: +- name: Splunk Add-on for Unix and Linux + url: https://splunkbase.splunk.com/app/833 + version: 10.1.0 +fields: +- type +- op +- res +- pid +- uid +example_log: 'type=DAEMON_ABORT msg=audit(06/05/2025 11:03:38.453:6845) : op=set-pid auid=unset pid=61314 uid=root ses=unset subj=unconfined res=failed' +output_fields: +- op +- res +- pid +- uid +- dest \ No newline at end of file diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml new file mode 100644 index 0000000000..87bf79fac6 --- /dev/null +++ b/data_sources/linux_auditd_daemon_end.yml @@ -0,0 +1,35 @@ +name: Linux Auditd Daemon End +id: 15135c45-e302-4d5a-a38a-3e8279f2ebd8 +version: 2 +date: '2025-06-06' +author: Teoderick Contreras, Splunk +description: Logs the execution of processes on a Linux system, including details + about the auditd daemon status. +source: auditd +sourcetype: auditd +mitre_components: +- Command Execution +- Process Creation +- Process Metadata +- OS API Execution +- Application Log Content +separator: type +separator_value: DAEMON_END +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules +supported_TA: +- name: Splunk Add-on for Unix and Linux + url: https://splunkbase.splunk.com/app/833 + version: 10.1.0 +fields: +- type +- op +- res +- auid +- pid +example_log: 'type=DAEMON_END msg=audit(06/05/2025 11:01:46.838:9436) : op=terminate auid=root pid=1 subj=unconfined res=success' +output_fields: +- op +- res +- pid +- uid +- dest \ No newline at end of file diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml new file mode 100644 index 0000000000..d3490fbfa0 --- /dev/null +++ b/data_sources/linux_auditd_daemon_start.yml @@ -0,0 +1,36 @@ +name: Linux Auditd Daemon Start +id: f1b97407-ddf0-41a5-8685-ada05aae3555 +version: 2 +date: '2025-06-06' +author: Teoderick Contreras, Splunk +description: Logs the execution of processes on a Linux system, including details + about the auditd daemon status. +source: auditd +sourcetype: auditd +mitre_components: +- Command Execution +- Process Creation +- Process Metadata +- OS API Execution +- Application Log Content +separator: type +separator_value: DAEMON_START +configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules +supported_TA: +- name: Splunk Add-on for Unix and Linux + url: https://splunkbase.splunk.com/app/833 + version: 10.1.0 +fields: +- type +- op +- res +- auid +- pid +example_log: 'type=DAEMON_START msg=audit(06/05/2025 11:03:38.949:6844) : op=start ver=3.0.7 format=enriched kernel=6.8.0-1029-aws auid=unset pid=61323 uid=root ses=unset subj=unconfined res=success' +output_fields: +- op +- res +- pid +- uid +- dest + \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 6050e6cd7e..f1a4dbc5fc 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -1,7 +1,7 @@ name: Linux Auditd Add User Account Type id: f8c325ea-506e-4105-8ccf-da1492e90115 -version: 7 -date: '2025-05-02' +version: 8 +date: '2025-06-26' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,8 +14,8 @@ description: The following analytic detects the suspicious add user account type early is essential to prevent potential security incidents. data_source: - Linux Auditd Add User -search: '`linux_auditd` type=ADD_USER | rename hostname as dest| stats count min(_time) - as firstTime max(_time) as lastTime by exe pid dest res UID type | `security_content_ctime(firstTime)` +search: '`linux_auditd` type=ADD_USER | rename host as dest| stats count min(_time) + as firstTime max(_time) as lastTime by exe pid dest res type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_type_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line diff --git a/detections/endpoint/linux_auditd_auditd_daemon_abort.yml b/detections/endpoint/linux_auditd_auditd_daemon_abort.yml new file mode 100644 index 0000000000..0a4ee0eb82 --- /dev/null +++ b/detections/endpoint/linux_auditd_auditd_daemon_abort.yml @@ -0,0 +1,68 @@ +name: Linux Auditd Auditd Daemon Abort +id: 76d6573f-c4ab-4fa1-8390-c036416d4add +version: 1 +date: '2025-06-06' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the abnormal termination of the Linux audit daemon (auditd) by identifying DAEMON_ABORT events in audit logs. These terminations suggest a serious failure of the auditing subsystem, potentially due to resource exhaustion, corruption, or malicious interference. Unlike a clean shutdown, DAEMON_ABORT implies that audit logging may have been disabled without system administrator intent. Alerts should be generated on detection and correlated with DAEMON_START, DAEMON_END, and system logs to determine root cause. If no DAEMON_START follows soon after, or this pattern repeats, it indicates a high-severity issue that impacts log integrity and should be immediately investigated. +data_source: +- Linux Auditd Daemon Abort +search: '`linux_auditd` type=DAEMON_ABORT + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by type op res uid dest pid + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_auditd_daemon_abort_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Auditd service event - [$type$] event occurred on host - [$dest$]. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] +tags: + analytic_story: + - Compromised Linux Host + asset_type: Endpoint + mitre_attack_id: + - T1562.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.012/auditd_daemon_type/linux_auditd_daemon.log + source: auditd + sourcetype: auditd diff --git a/detections/endpoint/linux_auditd_auditd_daemon_shutdown.yml b/detections/endpoint/linux_auditd_auditd_daemon_shutdown.yml new file mode 100644 index 0000000000..b0e86cd4a9 --- /dev/null +++ b/detections/endpoint/linux_auditd_auditd_daemon_shutdown.yml @@ -0,0 +1,68 @@ +name: Linux Auditd Auditd Daemon Shutdown +id: 6e2574b3-e24b-4321-ae3c-ba83a75bb714 +version: 1 +date: '2025-06-06' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the unexpected termination of the Linux Audit daemon (auditd) by monitoring for log entries of type DAEMON_END. This event signifies that the audit logging service has stopped, either due to a legitimate system shutdown, manual administrative action, or potentially malicious tampering. Since auditd is responsible for recording critical security events, its sudden stoppage may indicate an attempt to disable security monitoring or evade detection during an attack. This detection should be correlated with system logs to determine whether the shutdown was part of routine maintenance or an anomaly. If confirmed as malicious, this could lead to a compromised system where security events are no longer being logged, allowing attackers to operate undetected. Therefore, monitoring and alerting on auditd shutdown events is crucial for maintaining the integrity of system security monitoring. +data_source: +- Linux Auditd Daemon End +search: '`linux_auditd` type=DAEMON_END + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by type op res auid dest pid + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_auditd_daemon_shutdown_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Auditd service event - [$type$] event occurred on host - [$dest$]. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] +tags: + analytic_story: + - Compromised Linux Host + asset_type: Endpoint + mitre_attack_id: + - T1562.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.012/auditd_daemon_end/linux_daemon_end.log + source: auditd + sourcetype: auditd diff --git a/detections/endpoint/linux_auditd_auditd_daemon_start.yml b/detections/endpoint/linux_auditd_auditd_daemon_start.yml new file mode 100644 index 0000000000..880b91a4c5 --- /dev/null +++ b/detections/endpoint/linux_auditd_auditd_daemon_start.yml @@ -0,0 +1,68 @@ +name: Linux Auditd Auditd Daemon Start +id: 6b0cb0ff-9a7e-4475-a687-43827fdb31d6 +version: 1 +date: '2025-06-06' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the (re)initialization of the Linux audit daemon (auditd) by identifying log entries of type DAEMON_START. This event indicates that the audit subsystem has resumed logging after being stopped or has started during system boot. While DAEMON_START may be expected during reboots or legitimate configuration changes, it can also signal attempts to re-enable audit logging after evasion, or restarts with modified or reduced rule sets. Monitoring this event in correlation with DAEMON_END, DAEMON_ABORT, and auditctl activity provides visibility into the continuity and integrity of audit logs. Frequent or unexplained DAEMON_START events should be investigated, especially if they are not accompanied by valid administrative or system activity. +data_source: +- Linux Auditd Daemon Start +search: '`linux_auditd` type=DAEMON_START + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by type op res auid dest pid + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_auditd_daemon_start_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Auditd service event - [$type$] event occurred on host - [$dest$]. + risk_objects: + - field: dest + type: system + score: 15 + threat_objects: [] +tags: + analytic_story: + - Compromised Linux Host + asset_type: Endpoint + mitre_attack_id: + - T1562.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.012/auditd_daemon_type/linux_auditd_daemon.log + source: auditd + sourcetype: auditd \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 627ae04936..2644e34cc2 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Auditd Service Stop id: 6cb9d0e1-eabe-41de-a11a-5efade354e9d -version: 5 -date: '2025-05-02' +version: 6 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ description: The following analytic detects the suspicious auditd service stop. data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + | stats count min(_time) as firstTime max(_time) as lastTime by type pid comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_auditd_service_stop_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index cca19e4988..422413bfad 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -1,7 +1,7 @@ name: Linux Auditd Disable Or Modify System Firewall id: 07052556-d4b5-4bae-89aa-cbdc1bb11250 -version: 6 -date: '2025-05-02' +version: 7 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,8 +15,8 @@ description: The following analytic detects the suspicious disable or modify sys data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | rename host - as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid - UID comm exe unit dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid comm exe unit dest + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_disable_or_modify_system_firewall_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 38767366dc..a6233db487 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Auditd Doas Conf File Creation id: 61059783-574b-40d2-ac2f-69b898afd6b4 -version: 6 -date: '2025-05-02' +version: 7 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,10 +14,13 @@ description: The following analytic detects the creation of the doas.conf file o commands with root privileges, leading to full system compromise. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest | - stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID - type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_doas_conf_file_creation_filter`' +search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by name nametype ogid type dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_doas_conf_file_creation_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested @@ -70,6 +73,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_audited_doas_conf.log + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_path_doas_config.log source: auditd sourcetype: auditd diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index f3736cfe6c..89beb358bc 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Osquery Service Stop id: 0c320fea-6e87-4b99-a884-74d09d4b655d -version: 5 -date: '2025-05-02' +version: 6 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ description: The following analytic detects suspicious stopping of the `osquery` data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + | stats count min(_time) as firstTime max(_time) as lastTime by type pid comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_osquery_service_stop_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index a434536311..fc2eff4edf 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access Or Modification Of Sshd Config File id: acb3ea33-70f7-47aa-b335-643b3aebcb2f -version: 6 -date: '2025-05-02' +version: 7 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,10 +15,13 @@ description: The following analytic detects suspicious access or modification of access, posing a severe security risk. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID - type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' +search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by name nametype ogid type dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested @@ -73,6 +76,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_auditd_ssh_config.log + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_path_ssh_config.log source: auditd sourcetype: auditd diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index fe99e6d623..f753867dfc 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 -version: 9 -date: '2025-05-02' +version: 10 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,10 +14,13 @@ description: The following analytic detects potential access or modification of targeted host. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats - count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type - dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_possible_access_to_sudoers_file_filter`' +search: '`linux_auditd` type=PATH name="/etc/sudoers*" + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by name nametype ogid type dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_possible_access_to_sudoers_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested @@ -72,6 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_path_sudoers.log source: auditd sourcetype: auditd diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index c8f68a7035..f5f6262c33 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File id: fea71cf0-fa10-4ef6-9202-9682b2e0c477 -version: 7 -date: '2025-05-02' +version: 8 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -15,9 +15,12 @@ description: The following analytic detects potential tampering with cronjob fil data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") - | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime - by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by name nametype ogid dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should @@ -54,6 +57,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_auditd_cron_file_audited2.log + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_path_cron.log source: auditd sourcetype: auditd diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 5cd9ad3220..bfbebd42d6 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Preload Hijack Via Preload File id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f -version: 6 -date: '2025-05-02' +version: 7 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,10 +15,13 @@ description: The following analytic detects suspicious preload hijacking via the and security. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID - type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_preload_hijack_via_preload_file_filter`' +search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by name nametype ogid type dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_preload_hijack_via_preload_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested @@ -72,6 +75,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_preload_file/linux_auditd_preload_file.log + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_preload_file/linux_path_preload.log source: auditd sourcetype: auditd diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 0c9c184109..f62e4f74a7 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -1,7 +1,7 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 -version: 5 -date: '2025-05-02' +version: 6 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -15,7 +15,7 @@ description: The following analytic detects attempts to stop a service on Linux data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| + as firstTime max(_time) as lastTime by type pid comm exe dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index 34c31aef9c..2c46b2fbb7 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Sysmon Service Stop id: 20901256-633a-40de-8753-7b88811a460f -version: 5 -date: '2025-05-02' +version: 6 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ description: The following analytic detects the suspicious sysmon service stop. data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + | stats count min(_time) as firstTime max(_time) as lastTime by type pid comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sysmon_service_stop_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index f336325d90..3213336f0e 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -1,7 +1,7 @@ name: Linux Auditd Unix Shell Configuration Modification id: 66f737c6-3f7f-46ed-8e9b-cc0e5bf01f04 -version: 6 -date: '2025-05-02' +version: 7 +date: '2025-06-10' author: Teoderick Contreras, Splunk status: production type: TTP @@ -20,10 +20,13 @@ search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/ "/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile", "root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc", "/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login", - "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as - dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype - OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_unix_shell_configuration_modification_filter`' + "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime + by name nametype ogid type dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_unix_shell_configuration_modification_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested @@ -78,6 +81,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_auditd_unix_shell_mod_config.log + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config//linux_path_profile_d.log source: auditd sourcetype: auditd