From 8401c3ace61fb122d0141745e46460e7abd86a34 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 3 Dec 2021 13:04:41 -0800 Subject: [PATCH 01/27] nixpostnewsearches --- .../endpoint/detect_linenum_execution.yml | 50 ++++++++++++++++++ .../endpoint/detect_linpeas_execution.yml | 51 +++++++++++++++++++ ...tect_linux_exploit_suggester_execution.yml | 49 ++++++++++++++++++ detections/endpoint/detect_mimipenguin.yml | 43 ++++++++++++++++ stories/linux_post_exploitation.yml | 20 ++++++++ .../detect_linenum_execution.test.yml | 12 +++++ .../detect_linpeas_execution.test.yml | 12 +++++ ...linux_exploit_suggester_execution.test.yml | 12 +++++ tests/endpoint/detect_mimipenguin.test.yml | 12 +++++ 9 files changed, 261 insertions(+) create mode 100644 detections/endpoint/detect_linenum_execution.yml create mode 100644 detections/endpoint/detect_linpeas_execution.yml create mode 100644 detections/endpoint/detect_linux_exploit_suggester_execution.yml create mode 100644 detections/endpoint/detect_mimipenguin.yml create mode 100644 stories/linux_post_exploitation.yml create mode 100644 tests/endpoint/detect_linenum_execution.test.yml create mode 100644 tests/endpoint/detect_linpeas_execution.test.yml create mode 100644 tests/endpoint/detect_linux_exploit_suggester_execution.test.yml create mode 100644 tests/endpoint/detect_mimipenguin.test.yml diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml new file mode 100644 index 0000000000..b79fde84f3 --- /dev/null +++ b/detections/endpoint/detect_linenum_execution.yml @@ -0,0 +1,50 @@ +name: Detect LinEnum execution +id: 570e5278-5479-11ec-89c8-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| sourcetype="sysmon_linux" wget CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory + | `detect_linenum_execution_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1087 + - T1069 + - T1083 + - T1057 + - T1518 + - T1082 + - T1016 + - T1033 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml new file mode 100644 index 0000000000..4623458867 --- /dev/null +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -0,0 +1,51 @@ +name: Detect LinPeas Execution +id: 4ea6fa10-547c-11ec-a4f9-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| sourcetype=sysmon_linux CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path + | `detect_linpeas_execution_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1082 + - T1083 + - T1033 + - T1087 + - T1046 + - T1057 + - T1518 + - T1033 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml new file mode 100644 index 0000000000..d6e9f9fca3 --- /dev/null +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -0,0 +1,49 @@ +name: Detect Linux Exploit Suggester Execution +id: a4f34d5c-547b-11ec-ba88-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| sourcetype="sysmon_linux" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name + | `detect_linux_exploit_suggester_execution_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1087 + - T1083 + - T1069 + - T1057 + - T1518 + - T1082 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml new file mode 100644 index 0000000000..73f2c64552 --- /dev/null +++ b/detections/endpoint/detect_mimipenguin.yml @@ -0,0 +1,43 @@ +name: Detect MimiPenguin +id: 1ad20afa-547b-11ec-b4e7-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| sourcetype=sysmon_linux CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user + | `detect_mimipenguin_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1552 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml new file mode 100644 index 0000000000..69e1260f73 --- /dev/null +++ b/stories/linux_post_exploitation.yml @@ -0,0 +1,20 @@ +name: Linux Post-Exploitation +id: d310ccfe-5477-11ec-ad05-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: +- https://www.destroyallsoftware.com/talks/wat +tags: + analytic_story: + - Linux Post-Exploitation + category: + - Adversary Tactics + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring \ No newline at end of file diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml new file mode 100644 index 0000000000..b63e1783f5 --- /dev/null +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect LinEnum execution Unit Test +tests: +- name: Detect LinEnum execution + file: endpoint/detect_linenum_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml new file mode 100644 index 0000000000..d015b088ff --- /dev/null +++ b/tests/endpoint/detect_linpeas_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect LinPeas Execution Unit Test +tests: +- name: Detect LinPeas Execution + file: endpoint/detect_linpeas_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml new file mode 100644 index 0000000000..d472d2ba8c --- /dev/null +++ b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect Linux Exploit Suggester Execution Unit Test +tests: +- name: Detect Linux Exploit Suggester Execution + file: endpoint/detect_linux_exploit_suggester_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml new file mode 100644 index 0000000000..65e9e05c9f --- /dev/null +++ b/tests/endpoint/detect_mimipenguin.test.yml @@ -0,0 +1,12 @@ +name: Detect MimiPenguin Unit Test +tests: +- name: Detect MimiPenguin + file: endpoint/detect_mimipenguin.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 3f377be712ca72e936ed9855412c849a62164bde Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Mon, 6 Dec 2021 11:35:47 -0800 Subject: [PATCH 02/27] autosuidsearch --- ...detect_autosuid_post_exploitation_tool.yml | 55 +++++++++++++++++++ .../endpoint/detect_linenum_execution.yml | 36 +++++++----- .../endpoint/detect_linpeas_execution.yml | 36 +++++++----- ...tect_linux_exploit_suggester_execution.yml | 27 +++++---- detections/endpoint/detect_mimipenguin.yml | 36 +++++++----- ...t_autosuid_post_exploitation_tool.test.yml | 12 ++++ 6 files changed, 147 insertions(+), 55 deletions(-) create mode 100644 detections/endpoint/detect_autosuid_post_exploitation_tool.yml create mode 100644 tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml new file mode 100644 index 0000000000..337434a9db --- /dev/null +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -0,0 +1,55 @@ +name: Detect AutoSUID post exploitation tool +id: 0edd5862-56c9-11ec-b990-acde48001122 +version: 1 +date: '2021-12-06' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path + | `detect_autosuid_post_exploitation_tool_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored. +references: +- https://attack.mitre.org/matrices/enterprise/linux/ +- https://github.com/IvanGlinkin/AutoSUID +tags: + analytic_story: + - Linux Post Exploitation + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1069 + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - process + - process_current_directory + - process_path + security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source: endpoint + - Stage: discovery + message: AutoSUID post exploitation tool detected + observable: + observable: + - name: Computer + - Type: Hostname + - role: Victim diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index b79fde84f3..09caa0dd33 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,20 +6,18 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| sourcetype="sysmon_linux" wget CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory +description: + LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory | `detect_linenum_execution_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. references: -- +- https://github.com/rebootuser/LinEnum +- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist tags: analytic_story: - - UPDATE_STORY_NAME + - Linux Post Exploitation dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -39,12 +37,20 @@ tags: - Splunk Cloud required_fields: - _time + - CommandLine + - user + - process_exec + - process_current_directory security_domain: endpoint - impact: - confidence: + impact: 50 + confidence: 90 # (impact * confidence)/100 - risk_score: + risk_score: 90 context: - message: + - Source: endpoint + - Stage: discovery + message: LinEnum post exploitation tool detected observable: - \ No newline at end of file + - name: Computer + - Type: Hostname + - role: Victim diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 4623458867..081fe1bfa4 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -6,20 +6,19 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| sourcetype=sysmon_linux CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path +description: + Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: -- +- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist +- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS +- https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - UPDATE_STORY_NAME + - Linux Post Exploitation dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -40,12 +39,21 @@ tags: - Splunk Cloud required_fields: - _time + - Computer + - CommandLine + - user + - parent_process_exec + - process_path security_domain: endpoint - impact: - confidence: + impact: 90 + confidence: 100 # (impact * confidence)/100 - risk_score: + risk_score: 90 context: - message: + - Source: endpoint + - Stage: discovery + message: LinPEAS post exploitation tool detected observable: - \ No newline at end of file + - name: Computer + - Type: Hostname + - role: Victim diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index d6e9f9fca3..cfbc774903 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,20 +6,21 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: +description: UPDATE_DESCRIPTION WHAT IS THIS? WHAT DOES IT LOOK LIKE? HOW DO YOU TRIAGE IT? -search: '| sourcetype="sysmon_linux" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. references: -- +- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist +- https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - UPDATE_STORY_NAME + - Linux Post Exploitation dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -39,11 +40,15 @@ tags: required_fields: - _time security_domain: endpoint - impact: - confidence: + impact: 90 + confidence: 100 # (impact * confidence)/100 - risk_score: + risk_score: 90 context: - message: + - Source: endpoint + - Stage: discovery + message: Linux Exploit Suggester post exploitation tool detected. observable: - \ No newline at end of file + - name: Computer + - Type: Hostname + - role: Victim diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 73f2c64552..a590ef3ddf 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -6,20 +6,18 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| sourcetype=sysmon_linux CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user +description: + MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. references: -- +- https://github.com/huntergregal/mimipenguin +- https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - UPDATE_STORY_NAME + - Linux Post Exploitation dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -32,12 +30,20 @@ tags: - Splunk Cloud required_fields: - _time + - Computer + - parent_process + - process_current_directory + - user security_domain: endpoint - impact: - confidence: + impact: 50 + confidence: 70 # (impact * confidence)/100 - risk_score: + risk_score: 60 context: - message: + - Source: endpoint + - Stage: discovery + message: MimiPenguin post exploitation tool detected observable: - \ No newline at end of file + - name: Computer + - Type: Hostname + - role: Victim diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml new file mode 100644 index 0000000000..faa9b8ea4b --- /dev/null +++ b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml @@ -0,0 +1,12 @@ +name: Detect AutoSUID post exploitation tool Unit Test +tests: +- name: Detect AutoSUID post exploitation tool + file: endpoint/detect_autosuid_post_exploitation_tool.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From b2cc42aa108305e6cc497c719d56867c62b4c5ff Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 7 Dec 2021 13:31:15 -0800 Subject: [PATCH 03/27] fixdatasetsinyml --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 7 ++----- detections/endpoint/detect_linenum_execution.yml | 2 +- detections/endpoint/detect_linpeas_execution.yml | 2 +- .../endpoint/detect_linux_exploit_suggester_execution.yml | 2 +- detections/endpoint/detect_mimipenguin.yml | 2 +- .../detect_autosuid_post_exploitation_tool.test.yml | 8 ++++---- tests/endpoint/detect_linenum_execution.test.yml | 8 ++++---- tests/endpoint/detect_linpeas_execution.test.yml | 8 ++++---- .../detect_linux_exploit_suggester_execution.test.yml | 8 ++++---- tests/endpoint/detect_mimipenguin.test.yml | 8 ++++---- 10 files changed, 26 insertions(+), 29 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 337434a9db..11546f770a 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -7,10 +7,7 @@ type: TTP datamodel: - Endpoint description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? + This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. @@ -22,7 +19,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt kill_chain_phases: - Exploitation - Privilege Escalation diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 09caa0dd33..ebfd8bc5b3 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -19,7 +19,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt kill_chain_phases: - Privilege Escalation mitre_attack_id: diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 081fe1bfa4..413f200375 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -20,7 +20,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt kill_chain_phases: - Exploitation - Privilege Escalation diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index cfbc774903..c77a5e5158 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -22,7 +22,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt kill_chain_phases: - Exploitation - Privilege Escalation diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index a590ef3ddf..98a57d0d47 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -19,7 +19,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt kill_chain_phases: - Privilege Escalation mitre_attack_id: diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml index faa9b8ea4b..29c16b458d 100644 --- a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml +++ b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: autoSUID.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index b63e1783f5..825656a7dd 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: LinuxEnumd.tx + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml index d015b088ff..1e7397a056 100644 --- a/tests/endpoint/detect_linpeas_execution.test.yml +++ b/tests/endpoint/detect_linpeas_execution.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: linpeasdataset.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml index d472d2ba8c..1efcd32d23 100644 --- a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml +++ b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: linuxexploitsuggesterdatasets.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml index 65e9e05c9f..a2fff212b5 100644 --- a/tests/endpoint/detect_mimipenguin.test.yml +++ b/tests/endpoint/detect_mimipenguin.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: mimipenguin.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" From f0ad0eeccb378aca7f376b5e5e8c20401e4ac0d2 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 7 Dec 2021 13:39:21 -0800 Subject: [PATCH 04/27] fixautosuid --- detections/endpoint/detect_autosuid_post_exploitation_tool.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 11546f770a..be0d981f97 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: - This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. +This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. From ae3cfa6bc80f2efe5a47ddf67a7ca8b3f8d2aa92 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 7 Dec 2021 13:49:34 -0800 Subject: [PATCH 05/27] fixedspaces --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 3 +-- detections/endpoint/detect_linenum_execution.yml | 3 +-- detections/endpoint/detect_linpeas_execution.yml | 3 +-- .../endpoint/detect_linux_exploit_suggester_execution.yml | 6 +----- detections/endpoint/detect_mimipenguin.yml | 3 +-- 5 files changed, 5 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index be0d981f97..dfc0e737a6 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: -This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. +description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index ebfd8bc5b3..50368e4c36 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. +description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory | `detect_linenum_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 413f200375..1478c4a07a 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. +description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index c77a5e5158..7eb4815876 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,11 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? +description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 98a57d0d47..061ca181fe 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. +description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. From 7fc627e2a72a096025833a3365786a84b3225004 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 7 Dec 2021 14:48:09 -0800 Subject: [PATCH 06/27] fixesnixpost --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 2 +- detections/endpoint/detect_linenum_execution.yml | 2 +- detections/endpoint/detect_linpeas_execution.yml | 2 +- .../endpoint/detect_linux_exploit_suggester_execution.yml | 4 ++-- detections/endpoint/detect_mimipenguin.yml | 2 +- stories/linux_post_exploitation.yml | 8 ++++---- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index dfc0e737a6..bc44d314c9 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -16,7 +16,7 @@ references: - https://github.com/IvanGlinkin/AutoSUID tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt kill_chain_phases: diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 50368e4c36..d4b4750c0d 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -16,7 +16,7 @@ references: - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt kill_chain_phases: diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 1478c4a07a..ff375941c7 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -17,7 +17,7 @@ references: - https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt kill_chain_phases: diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 7eb4815876..2c08705cad 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,7 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. +description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. @@ -16,7 +16,7 @@ references: - https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt kill_chain_phases: diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 061ca181fe..a4c6635f8f 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -16,7 +16,7 @@ references: - https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt kill_chain_phases: diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml index 69e1260f73..9ca9a638bb 100644 --- a/stories/linux_post_exploitation.yml +++ b/stories/linux_post_exploitation.yml @@ -3,10 +3,10 @@ id: d310ccfe-5477-11ec-ad05-acde48001122 version: 1 date: '2021-12-03' author: Rod Soto -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE +description: This analytic story detects popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin +narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version. references: -- https://www.destroyallsoftware.com/talks/wat +- https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - Linux Post-Exploitation @@ -17,4 +17,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Security Monitoring \ No newline at end of file + usecase: Security Monitoring From 5f71b501f2f7c1382e0d8ef2a0bc1b04ec60fc06 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 07:47:14 -0800 Subject: [PATCH 07/27] addedmacros --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 2 +- detections/endpoint/detect_linenum_execution.yml | 2 +- detections/endpoint/detect_linpeas_execution.yml | 2 +- .../endpoint/detect_linux_exploit_suggester_execution.yml | 2 +- detections/endpoint/detect_mimipenguin.yml | 2 +- macros/sysmon_linux.yml | 4 ++++ 6 files changed, 9 insertions(+), 5 deletions(-) create mode 100644 macros/sysmon_linux.yml diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index bc44d314c9..d852a68b8e 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path +search: '| `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored. diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index d4b4750c0d..f04e91a58d 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory +search: '| `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory | `detect_linenum_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index ff375941c7..18aab33a48 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path +search: '| `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 2c08705cad..18cc2d0889 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name +search: '| `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index a4c6635f8f..52c0d50d33 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user +search: '| `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. diff --git a/macros/sysmon_linux.yml b/macros/sysmon_linux.yml new file mode 100644 index 0000000000..7482f5a592 --- /dev/null +++ b/macros/sysmon_linux.yml @@ -0,0 +1,4 @@ +definition: source=Syslog:Linux-Sysmon/Operational +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: sysmon_linux From f4bcc6b1c487c0270d34f13019584a6d98f8da58 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 07:59:08 -0800 Subject: [PATCH 08/27] fixedrisk --- detections/endpoint/detect_linenum_execution.yml | 2 +- detections/endpoint/detect_mimipenguin.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index f04e91a58d..6d23996689 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -44,7 +44,7 @@ tags: impact: 50 confidence: 90 # (impact * confidence)/100 - risk_score: 90 + risk_score: 45 context: - Source: endpoint - Stage: discovery diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 52c0d50d33..e401eaf759 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -37,7 +37,7 @@ tags: impact: 50 confidence: 70 # (impact * confidence)/100 - risk_score: 60 + risk_score: 35 context: - Source: endpoint - Stage: discovery From 7d8e5e3973bb602c18edc4bc15a6260b30c84dff Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 08:03:39 -0800 Subject: [PATCH 09/27] fixrs --- detections/endpoint/detect_autosuid_post_exploitation_tool.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index d852a68b8e..0119717ec5 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -39,7 +39,7 @@ tags: impact: 90 confidence: 90 # (impact * confidence)/100 - risk_score: 90 + risk_score: 81 context: - Source: endpoint - Stage: discovery From c9f12163a87e1b292e07ff84d3422787cf7ff976 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 09:46:50 -0800 Subject: [PATCH 10/27] fixedformatt --- ...detect_autosuid_post_exploitation_tool.yml | 29 +++++++++---------- .../endpoint/detect_linenum_execution.yml | 26 ++++++++--------- ...tect_linux_exploit_suggester_execution.yml | 25 ++++++++-------- detections/endpoint/detect_mimipenguin.yml | 28 +++++++++--------- 4 files changed, 54 insertions(+), 54 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 0119717ec5..0208783ffd 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -5,7 +5,7 @@ date: '2021-12-06' author: Rod Soto type: TTP datamodel: -- Endpoint +- Endpoint description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' @@ -17,14 +17,25 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 90 + context: + - Source: Endpoint + - Stage: Discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt + impact: 90 kill_chain_phases: - Exploitation - Privilege Escalation + message: AutoSUID post exploitation tool detected mitre_attack_id: - T1069 - T1222 + observable: + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -33,19 +44,7 @@ tags: - _time - Computer - process - - process_current_directory - process_path - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 + - process_current_directory risk_score: 81 - context: - - Source: endpoint - - Stage: discovery - message: AutoSUID post exploitation tool detected - observable: - observable: - - name: Computer - - Type: Hostname - - role: Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 6d23996689..2ac72a50cd 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -17,10 +17,16 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 90 + context: + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt + impact: 50 kill_chain_phases: - Privilege Escalation + message: LinEnum post exploitation tool detected mitre_attack_id: - T1087 - T1069 @@ -30,6 +36,11 @@ tags: - T1082 - T1016 - T1033 + observable: + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -39,17 +50,6 @@ tags: - CommandLine - user - process_exec - - process_current_directory - security_domain: endpoint - impact: 50 - confidence: 90 - # (impact * confidence)/100 + - process_current_directory risk_score: 45 - context: - - Source: endpoint - - Stage: discovery - message: LinEnum post exploitation tool detected - observable: - - name: Computer - - Type: Hostname - - role: Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 18cc2d0889..699b59b2fa 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -17,8 +17,14 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 100 + context: + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt + impact: 90 + message: Linux Exploit Suggester post exploitation tool detected. kill_chain_phases: - Exploitation - Privilege Escalation @@ -29,22 +35,17 @@ tags: - T1057 - T1518 - T1082 + observable: + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 + - CommandLine risk_score: 90 - context: - - Source: endpoint - - Stage: discovery - message: Linux Exploit Suggester post exploitation tool detected. - observable: - - name: Computer - - Type: Hostname - - role: Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index e401eaf759..2df037ae16 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -17,32 +17,32 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 70 + context: + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt + impact: 50 kill_chain_phases: - Privilege Escalation + message: MimiPenguin post exploitation tool detected mitre_attack_id: - T1552 + observable: + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time + - user - Computer - parent_process - - process_current_directory - - user - security_domain: endpoint - impact: 50 - confidence: 70 - # (impact * confidence)/100 + - process_current_directory risk_score: 35 - context: - - Source: endpoint - - Stage: discovery - message: MimiPenguin post exploitation tool detected - observable: - - name: Computer - - Type: Hostname - - role: Victim + security_domain: endpoint From 020e9d5f580855fe7565a79504b1f7ff0f7eae9a Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 09:56:26 -0800 Subject: [PATCH 11/27] endpfx --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 4 ++-- detections/endpoint/detect_linenum_execution.yml | 4 ++-- detections/endpoint/detect_linpeas_execution.yml | 2 +- .../endpoint/detect_linux_exploit_suggester_execution.yml | 2 +- detections/endpoint/detect_mimipenguin.yml | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 0208783ffd..329dab4f62 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -5,7 +5,7 @@ date: '2021-12-06' author: Rod Soto type: TTP datamodel: -- Endpoint +- Endpoint description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' @@ -33,7 +33,7 @@ tags: - T1222 observable: - name: Computer - type: Hostname + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 2ac72a50cd..0cd16c5e66 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -38,7 +38,7 @@ tags: - T1033 observable: - name: Computer - type: Hostname + type: Endpoint role: - Victim product: @@ -50,6 +50,6 @@ tags: - CommandLine - user - process_exec - - process_current_directory + - process_current_directory risk_score: 45 security_domain: endpoint diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 18aab33a48..00f20b90ab 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -54,5 +54,5 @@ tags: message: LinPEAS post exploitation tool detected observable: - name: Computer - - Type: Hostname + - Type: Endpoint - role: Victim diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 699b59b2fa..861b5211fe 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -37,7 +37,7 @@ tags: - T1082 observable: - name: Computer - type: Hostname + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 2df037ae16..3972d419c4 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -31,7 +31,7 @@ tags: - T1552 observable: - name: Computer - type: Hostname + type: Endpoint role: - Victim product: @@ -43,6 +43,6 @@ tags: - user - Computer - parent_process - - process_current_directory + - process_current_directory risk_score: 35 security_domain: endpoint From 86328655ec694270ef14c293eb7f8a843094e5cf Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 10:21:50 -0800 Subject: [PATCH 12/27] fixlinpe --- .../endpoint/detect_linpeas_execution.yml | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 00f20b90ab..ad21c5fd7c 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -18,11 +18,17 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 100 + context: + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt + impact: 90 kill_chain_phases: - Exploitation - Privilege Escalation + message: LinPEAS post exploitation tool detected mitre_attack_id: - T1082 - T1083 @@ -32,6 +38,11 @@ tags: - T1057 - T1518 - T1033 + observable: + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -42,17 +53,6 @@ tags: - CommandLine - user - parent_process_exec - - process_path - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 + - process_path risk_score: 90 - context: - - Source: endpoint - - Stage: discovery - message: LinPEAS post exploitation tool detected - observable: - - name: Computer - - Type: Endpoint - - role: Victim + security_domain: endpoint From b8820575151a0aefca6b56a765f5b9aded3ca578 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 13 Jan 2022 14:57:24 -0800 Subject: [PATCH 13/27] erictests --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 4 ++-- detections/endpoint/detect_linenum_execution.yml | 6 +++--- detections/endpoint/detect_linpeas_execution.yml | 4 ++-- .../endpoint/detect_linux_exploit_suggester_execution.yml | 4 ++-- detections/endpoint/detect_mimipenguin.yml | 4 ++-- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 329dab4f62..b8013a397e 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. -search: '| `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path +search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored. @@ -33,7 +33,7 @@ tags: - T1222 observable: - name: Computer - type: Endpoint + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 0cd16c5e66..acc6d20ce2 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -7,8 +7,8 @@ type: TTP datamodel: - Endpoint description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. -search: '| `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory - | `detect_linenum_execution_filter`' +search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory + | `detect_linenum_execution_filter` ' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. references: @@ -38,7 +38,7 @@ tags: - T1033 observable: - name: Computer - type: Endpoint + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index ad21c5fd7c..f342b9b874 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. -search: '| `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path +search: ' `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES @@ -53,6 +53,6 @@ tags: - CommandLine - user - parent_process_exec - - process_path + - process_path risk_score: 90 security_domain: endpoint diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 861b5211fe..50389d0d4d 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. -search: '| `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name +search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. @@ -37,7 +37,7 @@ tags: - T1082 observable: - name: Computer - type: Endpoint + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 3972d419c4..b56685e78a 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. -search: '| `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user +search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. @@ -31,7 +31,7 @@ tags: - T1552 observable: - name: Computer - type: Endpoint + type: Endpoint role: - Victim product: From 4a4b309b051a4cb9be33ec8c8a0a98d74518af83 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 13 Jan 2022 17:32:42 -0800 Subject: [PATCH 14/27] addfieldtommpgn --- detections/endpoint/detect_mimipenguin.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index b56685e78a..e639c8522a 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user - | `detect_mimipenguin_filter`' + CommandLine | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. references: From db4732f94a84704359a1c177beea8ba128ab29ba Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 02:16:54 +0000 Subject: [PATCH 15/27] Added detection testing service results inDetect AutoSUID post exploitation tool --- ...detect_autosuid_post_exploitation_tool.yml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index b8013a397e..6ef5248982 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -6,11 +6,15 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. -search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path - | `detect_autosuid_post_exploitation_tool_filter`' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored. +description: This search, detects Linux post exploitation tool AutoSUID, which is + an a tool that searches for SUID executables files in order to escalate privileges. +search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm + -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory + process_path | `detect_autosuid_post_exploitation_tool_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Unless an administrator is using these commands to troubleshoot + or audit a system, the execution of these commands should be monitored. references: - https://attack.mitre.org/matrices/enterprise/linux/ - https://github.com/IvanGlinkin/AutoSUID @@ -19,8 +23,8 @@ tags: - Linux Post-Exploitation confidence: 90 context: - - Source: Endpoint - - Stage: Discovery + - Source: Endpoint + - Stage: Discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt impact: 90 @@ -48,3 +52,4 @@ tags: - process_current_directory risk_score: 81 security_domain: endpoint + automated_detection_testing: passed From 67f02ac50aee718a48732631f60fc2f966a19b3e Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 05:07:31 -0800 Subject: [PATCH 16/27] fplp --- detections/endpoint/detect_linpeas_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index f342b9b874..873814f318 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -10,7 +10,7 @@ description: Linux local Privilege Escalation Awesome Script (linPEAS) is a scri search: ' `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: This search may produce false positives as it will display many sudo executed processess however, the cve-list within the command line it is a clear indicator, operator is searching for local vulnerabilites. references: - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS From d643ea9701490efc244ca8ba86e5b5aaff68717e Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 13:54:20 +0000 Subject: [PATCH 17/27] Added detection testing service results inDetect LinEnum execution --- .../endpoint/detect_linenum_execution.yml | 30 ++++++++++++------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index acc6d20ce2..88344869e8 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,11 +6,18 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. -search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory - | `detect_linenum_execution_filter` ' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. +description: LinEnum is a bash script that performs discovery commands for accounts, + processes, kernel version, applications, services, and uses the information from + these commands to present operator with ways of escalating privileges or further + exploitation of targeted host. +search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" + | stats count by Computer CommandLine user process_exec process_current_directory + | `detect_linenum_execution_filter` ' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Very rare to perform such an extensive grep on a system, however + certain monitoring tools can produce similar results. It is important if monitoring + tools are in place to verify what is the actual process directory of execution. references: - https://github.com/rebootuser/LinEnum - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist @@ -19,8 +26,8 @@ tags: - Linux Post-Exploitation confidence: 90 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt impact: 50 @@ -37,10 +44,10 @@ tags: - T1016 - T1033 observable: - - name: Computer - type: Endpoint - role: - - Victim + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,3 +60,4 @@ tags: - process_current_directory risk_score: 45 security_domain: endpoint + automated_detection_testing: passed From 9c987e42220b05a92747699521a7b29f9ffdbd99 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:47:41 +0000 Subject: [PATCH 18/27] Added detection testing service results inDetect AutoSUID post exploitation tool From 16302611bee45ab05e38b0e64a82134e3cff25aa Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:48:21 +0000 Subject: [PATCH 19/27] Added detection testing service results inDetect Linux Exploit Suggester Execution --- ...tect_linux_exploit_suggester_execution.yml | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 50389d0d4d..4bec3353fa 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,11 +6,16 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. -search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name - | `detect_linux_exploit_suggester_execution_filter`' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. +description: This search detects Linux Exploit Suggester tool execution. This is a + tool that searches for vulnerabilities based on Kernel and Distribution versions + then queries public exploit databases. +search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR + CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, + process_name | `detect_linux_exploit_suggester_execution_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Monitoring tools may produce similar commands although the + presence of "exploit-db" is very unusual. references: - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist - https://attack.mitre.org/matrices/enterprise/linux/ @@ -19,8 +24,8 @@ tags: - Linux Post-Exploitation confidence: 100 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt impact: 90 @@ -49,3 +54,4 @@ tags: - CommandLine risk_score: 90 security_domain: endpoint + automated_detection_testing: passed From 95be1b79b067e955bd8144cb4bd75595c3ea870f Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:48:40 +0000 Subject: [PATCH 20/27] Added detection testing service results inDetect MimiPenguin --- detections/endpoint/detect_mimipenguin.yml | 28 +++++++++++++--------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index e639c8522a..00544506b3 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -6,11 +6,16 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. -search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user - CommandLine | `detect_mimipenguin_filter`' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. +description: MimiPenguin is a tool that dumps login passwords from current linux destop + users. This search detects execution of this tool. +search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings + -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count + by Computer parent_process process_current_directory user CommandLine | `detect_mimipenguin_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Some of these commands may be executed by sysadmin however + not in the proximity and frequency, specially if querying for tools are that knonwn + not to be installed at target system. references: - https://github.com/huntergregal/mimipenguin - https://attack.mitre.org/matrices/enterprise/linux/ @@ -19,8 +24,8 @@ tags: - Linux Post-Exploitation confidence: 70 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt impact: 50 @@ -30,10 +35,10 @@ tags: mitre_attack_id: - T1552 observable: - - name: Computer - type: Endpoint - role: - - Victim + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,3 +51,4 @@ tags: - process_current_directory risk_score: 35 security_domain: endpoint + automated_detection_testing: passed From 82e32f0db635b5bf9dc9d07ccddd87c060f1c9a9 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 06:53:23 -0800 Subject: [PATCH 21/27] fixedtestfile --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 825656a7dd..4f0f44d620 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,7 +1,7 @@ name: Detect LinEnum execution Unit Test tests: - name: Detect LinEnum execution - file: endpoint/detect_linenum_execution.yml + file: endpoint/detect_linenum_execution.test.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 09f07639137323dd13fac5ff51c7404b8d3c358e Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Fri, 14 Jan 2022 07:00:45 -0800 Subject: [PATCH 22/27] Update detect_linenum_execution.test.yml --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 825656a7dd..4f0f44d620 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,7 +1,7 @@ name: Detect LinEnum execution Unit Test tests: - name: Detect LinEnum execution - file: endpoint/detect_linenum_execution.yml + file: endpoint/detect_linenum_execution.test.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 17513786165816290d187182edfb189c587f1574 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 07:14:38 -0800 Subject: [PATCH 23/27] fixedtestfileag --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 4f0f44d620..06b16b374c 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,4 +1,4 @@ -name: Detect LinEnum execution Unit Test +name: Detect LinEnum execution unit test tests: - name: Detect LinEnum execution file: endpoint/detect_linenum_execution.test.yml From d4155c8030272b0e413313814caa2256f84e64a9 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 07:20:45 -0800 Subject: [PATCH 24/27] tftest --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 06b16b374c..3c4b0b164c 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,4 +1,4 @@ -name: Detect LinEnum execution unit test +name: Detect LinEnum execution unit Test tests: - name: Detect LinEnum execution file: endpoint/detect_linenum_execution.test.yml From 329d1433abd7fe78a5ea921f7abd9ec29472500b Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 07:28:06 -0800 Subject: [PATCH 25/27] allabouttheT --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 3c4b0b164c..85cf4dde13 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: LinuxEnumd.tx + - file_name: LinuxEnumd.txt data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt source: "Syslog:Linux-Sysmon/Operational" sourcetype: "sysmon_linux" From 774feed60928de57c0047daa2c9a42953c752f7f Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 07:32:16 -0800 Subject: [PATCH 26/27] fix1k --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 85cf4dde13..85d7de99da 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,7 +1,7 @@ name: Detect LinEnum execution unit Test tests: - name: Detect LinEnum execution - file: endpoint/detect_linenum_execution.test.yml + file: endpoint/detect_linenum_execution.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From e5403b97c6238d27179db6a4ca6ac70592f16d4c Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 17:24:17 +0000 Subject: [PATCH 27/27] Added detection testing service results inDetect LinEnum execution