name: Linux Ingress Tool Transfer Hunting
id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf
version: 1
date: '2022-07-29'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic hunts for curl and wget being utilized in the
  environment. This is meant to help with identifying normal usage and potentially
  malicious. Utilize this query to tune other curl and wget analytics.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    Image|endswith:
    - curl
    - wget
  condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: False positives will be present. This query is meant to help
  tune other curl and wget analytics.
references:
- https://gtfobins.github.io/gtfobins/curl/
- https://curl.se/docs/manpage.html#-I
- https://gtfobins.github.io/gtfobins/curl/
- https://github.com/rapid7/metasploit-framework/search?q=curl
tags:
  analytic_story:
  - Linux Living Off The Land
  - Ingress Tool Transfer
  asset_type: Endpoint
  confidence: 10
  impact: 10
  message: An instance of $process_name$ was identified on endpoint $dest$ by user
    $user$ utilizing curl or wget.
  mitre_attack_id:
  - T1105
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 1
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
    source: Syslog:Linux-Sysmon/Operational
    sourcetype: sysmon_linux
    update_timestamp: true