---
title: "Linux Post-Exploitation"
last_modified_at: 2021-12-03
toc: true
toc_label: ""
tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  - Endpoint
---

[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

#### Description

This analytic story detects popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin

- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2021-12-03
- **Author**: Rod Soto
- **ID**: d310ccfe-5477-11ec-ad05-acde48001122

#### Narrative

These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.

#### Detections

| Name        | Technique   | Type         |
| ----------- | ----------- |--------------|
| [Detect AutoSUID post exploitation tool](/endpoint/detect_autosuid_post_exploitation_tool/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
| [Detect LinEnum execution](/endpoint/detect_linenum_execution/) | [Account Discovery](/tags/#account-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Process Discovery](/tags/#process-discovery), [Software Discovery](/tags/#software-discovery), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [System Owner/User Discovery](/tags/#system-owner/user-discovery) | TTP |
| [Detect LinPeas Execution](/endpoint/detect_linpeas_execution/) | [System Information Discovery](/tags/#system-information-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Account Discovery](/tags/#account-discovery), [Network Service Scanning](/tags/#network-service-scanning), [Process Discovery](/tags/#process-discovery), [Software Discovery](/tags/#software-discovery), [System Owner/User Discovery](/tags/#system-owner/user-discovery) | TTP |
| [Detect Linux Exploit Suggester Execution](/endpoint/detect_linux_exploit_suggester_execution/) | [Account Discovery](/tags/#account-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Process Discovery](/tags/#process-discovery), [Software Discovery](/tags/#software-discovery), [System Information Discovery](/tags/#system-information-discovery) | TTP |
| [Detect MimiPenguin](/endpoint/detect_mimipenguin/) | [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |

#### Reference

* [https://attack.mitre.org/matrices/enterprise/linux/](https://attack.mitre.org/matrices/enterprise/linux/)



[*source*](https://github.com/splunk/security_content/tree/develop/stories/linux_post-exploitation.yml) \| *version*: **1**