Branch was auto-updated.

detections/endpoint/curl_download_and_bash_execution.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Ingress Tool Transfer
   - Log4Shell CVE-2021-44228
+  - Linux Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/linux_add_files_in_known_crontab_directories.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_adding_crontab_using_list_parameter.yml

@@ -31,6 +31,7 @@ tags:
   - Industroyer2
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/linux_at_allow_config_file_creation.yml

@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_at_application_execution.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_change_file_owner_to_root.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_clipboard_data_copy.yml

@@ -0,0 +1,76 @@
+name: Linux Clipboard Data Copy
+id: 7173b2ad-6146-418f-85ae-c3479e4515fc
+version: 1
+date: '2022-07-28'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of Linux Xclip copying data out of the clipboard. Adversaries have utilized this technique to capture passwords, IP addresses, or store payloads.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=xclip Processes.process IN ("*-o *", "*-sel *", "*-selection *", "*clip *","*clipboard*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `linux_clipboard_data_copy_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed. 
+references:
+  - https://attack.mitre.org/techniques/T1115/
+  - https://linux.die.net/man/1/xclip
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 40
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon.log
+  impact: 40
+  kill_chain_phases:
+  - Reconnaissance
+  message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ adding or removing content from the clipboard.
+  mitre_attack_id:
+  - T1115
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 16
+  security_domain: endpoint

detections/endpoint/linux_common_process_for_elevation_control.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_decode_base64_to_shell.yml

@@ -0,0 +1,83 @@
+name: Linux Decode Base64 to Shell
+id: 637b603e-1799-40fd-bf87-47ecbd551b66
+version: 1
+date: '2022-07-27'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies base64 being decoded and passed to a Linux shell.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*base64 -d*","*base64 --decode*") AND Processes.process="*|*" `linux_shells`
+   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `linux_decode_base64_to_shell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present based on legitimate software being utilized. Filter as needed.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script
+  - https://redcanary.com/blog/lateral-movement-with-secure-shell/ 
+  - https://linux.die.net/man/1/base64
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Delivery
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64 and passing it to a shell.
+  mitre_attack_id:
+  - T1027
+  - T1059.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/linux_edit_cron_table_parameter.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_file_created_in_kernel_driver_directory.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Rootkit
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Rootkit
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Rootkit
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_kernel_module_enumeration.yml

@@ -0,0 +1,80 @@
+name: Linux Kernel Module Enumeration
+id: 6df99886-0e04-4c11-8b88-325747419278
+version: 1
+date: '2022-07-27'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the process kmod being utilized to list kernel modules in use.
+  Typically, this is not seen as malicious, however it may be a precurser to the use of insmod to install a module.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=kmod Processes.process IN ("*lsmod*", "*list*")
+   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_kernel_module_enumeration_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
+references:
+- https://man7.org/linux/man-pages/man8/kmod.8.html
+tags:
+  analytic_story:
+  - Linux Rootkit
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Reconnaissance
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumeration kernel modules.
+  mitre_attack_id:
+  - T1082
+  - T1014
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 15
+  security_domain: endpoint

detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml

@@ -0,0 +1,82 @@
+name: Linux Obfuscated Files or Information Base64 Decode
+id: 303b38b2-c03f-44e2-8f41-4594606fcfc7
+version: 1
+date: '2022-07-27'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of base64 decode on Linux being utilized to deobfuscate a file. Identify the source of the file and determine if legitimate. Review parallel processes for further behavior before and after.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*base64 -d*","*base64 --decode*")
+   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `linux_obfuscated_files_or_information_base64_decode_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and will require some tuning based on processes. Filter as needed.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script
+  - https://redcanary.com/blog/lateral-movement-with-secure-shell/ 
+  - https://linux.die.net/man/1/base64
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Delivery
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64.
+  mitre_attack_id:
+  - T1027
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 15
+  security_domain: endpoint

detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml

@@ -0,0 +1,63 @@
+name: Linux Persistence and Privilege Escalation Risk Behavior
+id: ad5ac21b-3b1e-492c-8e19-ea5d5e8e5cf1
+version: 1
+date: '2022-07-20'
+author: Michael Haag, Splunk
+type: Correlation
+datamodel:
+- Risk
+description: The following correlation is specific to Linux persistence and privilege escalation tactics and is tied to two analytic stories and any Linux analytic tied to persistence and privilege escalation.
+  These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where (All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques") OR source = "*Linux*") All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source All_Risk.description
+  | `drop_dm_object_name(All_Risk)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | stats values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object 
+  | where distinct_detection_name >= 4
+  | `linux_persistence_and_privilege_escalation_risk_behavior_filter`'
+how_to_implement: Ensure Linux anomaly and TTP analytics are enabled. TTP may be set to Notables for point detections, anomaly should not be notables but risk generators. The correlation relies on more than x amount of distict detection names generated before generating a notable. Modify the value as needed. Default value is set to 4. This value may need to be increased based on activity in your environment.
+known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers. 
+references:
+  - https://attack.mitre.org/tactics/TA0004/
+tags:
+  analytic_story:
+  - Linux Privilege Escalation
+  - Linux Persistence Techniques
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/linux_risk/linuxrisk.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Privilege escalation and persistence behaviors have been identified on $risk_object$.
+  mitre_attack_id:
+  - T1548
+  nist:
+  - DE.CM
+  observable:
+  - name: risk_object
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Risk.analyticstories
+  - All_Risk.risk_object_type
+  - All_Risk.risk_object
+  - All_Risk.annotations.mitre_attack.mitre_tactic
+  - source
+  risk_score: 56
+  security_domain: audit

detections/endpoint/linux_pkexec_privilege_escalation.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Linux Privilege Escalation
+  - Linux Living Off The Land
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml

@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/linux_possible_cronjob_modification_with_editor.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_possible_ssh_key_file_creation.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_service_file_created_in_systemd_directory.yml

@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_service_restarted.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_service_started_or_enabled.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_setuid_using_chmod_utility.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
+  - Linux Living Off The Land
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/linux_ssh_authorized_keys_modification.yml

@@ -0,0 +1,81 @@
+name: Linux SSH Authorized Keys Modification
+id: f5ab595e-28e5-4327-8077-5008ba97c850
+version: 1
+date: '2022-07-27'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies based on process execution the modification of SSH Authorized Keys. Adversaries perform this behavior to persist on endpoints.
+  During triage, review parallel processes and capture any additional file modifications for review. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name IN ("bash","cat") Processes.process IN ("*/authorized_keys*")
+   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `linux_ssh_authorized_keys_modification_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: Filtering will be required as system administrators will add and remove. One way to filter query is to add "echo".
+references:
+  - https://redcanary.com/blog/lateral-movement-with-secure-shell/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.004/T1098.004.md
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Installation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ modifying SSH Authorized Keys.
+  mitre_attack_id:
+  - T1098.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 15
+  security_domain: endpoint

detections/endpoint/linux_ssh_remote_services_script_execute.yml

@@ -0,0 +1,73 @@
+name: Linux SSH Remote Services Script Execute
+id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3
+version: 1
+date: '2022-07-27'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies SSH being utilized to move laterally and execute a script or file on the remote host.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND CommandLine IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `linux_ssh_remote_services_script_execute_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: This is not a common command to be executed. Filter as needed.
+references:
+  - https://redcanary.com/blog/lateral-movement-with-secure-shell/
+tags:
+  analytic_story:
+  - Linux Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally and download a file.
+  mitre_attack_id:
+  - T1021.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/experimental/endpoint/suspicious_curl_network_connection.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - Silver Sparrow
   - Ingress Tool Transfer
+  - Linux Living Off The Land
   asset_type: Endpoint
   dataset: []
   kill_chain_phases:

stories/linux_living_off_the_land.yml

@@ -0,0 +1,20 @@
+name: Linux Living Off The Land
+id: e405a2d7-dc8e-4227-8e9d-f60267b8c0cd
+version: 1
+date: '2022-07-27'
+author: Michael Haag, Splunk
+description: Linux Living Off The Land consists of binaries that may be used to bypass local security restrictions within misconfigured systems.
+narrative: Similar to Windows LOLBAS project, the GTFOBins project focuses solely on Unix binaries that may be abused in multiple categories including Reverse Shell, File Upload, File Download and much more. 
+  These binaries are native to the operating system and the functionality is typically native. The behaviors are typically not malicious by default or vulnerable, but these are built in functionality of the applications.
+  When reviewing any notables or hunting through mountains of events of interest, it's important to identify the binary, review command-line arguments, path of file, and capture any network and file modifications. Linux analysis may be a bit cumbersome due to volume and how process behavior is seen in EDR products. Piecing it together will require some effort. 
+references:
+  - https://gtfobins.github.io/
+tags:
+  analytic_story: Linux Living Off The Land
+  category:
+    - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/linux_rootkit.yml

@@ -0,0 +1,21 @@
+name: Linux Rootkit
+id: e30f4054-ac08-4999-b8bc-5cc46886c18d
+version: 1
+date: '2022-07-27'
+author: Michael Haag, Splunk
+description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
+narrative: Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems.
+  Linux rootkits may not standout as much as a Windows rootkit, therefore understanding what kernel modules are installed today and monitoring for new is important. As with any rootkit, it may blend in using a common kernel name or variation of legitimate names. 
+references:
+  - https://attack.mitre.org/techniques/T1014/
+  - https://content.fireeye.com/apt-41/rpt-apt41
+  - https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a
+tags:
+  analytic_story: Linux Rootkit
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/linux_clipboard_data_copy.test.yml

@@ -0,0 +1,13 @@
+name: Linux Clipboard Data Copy Unit Test
+tests:
+- name: Linux Clipboard Data Copy
+  file: endpoint/linux_clipboard_data_copy.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true

tests/endpoint/linux_decode_base64_to_shell.test.yml

@@ -0,0 +1,13 @@
+name: Linux Decode Base64 to Shell Unit Test
+tests:
+- name: Linux Decode Base64 to Shell
+  file: endpoint/linux_decode_base64_to_shell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true

tests/endpoint/linux_kernel_module_enumeration.test.yml

@@ -0,0 +1,13 @@
+name: Linux Kernel Module Enumeration Unit Test
+tests:
+- name: 'Linux Kernel Module Enumeration'
+  file: endpoint/linux_kernel_module_enumeration.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: linux_sysmon
+    update_timestamp: true

tests/endpoint/linux_obfuscated_files_or_information_base64_decode.test.yml

@@ -0,0 +1,13 @@
+name: Linux Obfuscated Files or Information Base64 Decode Unit Test
+tests:
+- name: Linux Obfuscated Files or Information Base64 Decode
+  file: endpoint/linux_obfuscated_files_or_information_base64_decode.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true

tests/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.test.yml

@@ -0,0 +1,13 @@
+name: Linux Persistence and Privilege Escalation Risk Behavior Unit Test
+tests:
+- name: Linux Persistence and Privilege Escalation Risk Behavior
+  file: endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: linuxrisk.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/linux_risk/linuxrisk.log
+    source: linuxrisk
+    sourcetype: stash
+    update_timestamp: true

tests/endpoint/linux_ssh_authorized_keys_modification.test.yml

@@ -0,0 +1,13 @@
+name: Linux SSH Authorized Keys Modification Unit Test
+tests:
+- name: Linux SSH Authorized Keys Modification
+  file: endpoint/linux_ssh_authorized_keys_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: authkey_linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true

tests/endpoint/linux_ssh_remote_services_script_execute.test.yml

@@ -0,0 +1,13 @@
+name: Linux SSH Remote Services Script Execute Unit Test
+tests:
+- name: Linux SSH Remote Services Script Execute
+  file: endpoint/linux_ssh_remote_services_script_execute.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: linux-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
+    update_timestamp: true