name: Linux Deletion Of Init Daemon Script
id: 729aab57-d26f-4156-b97f-ab8dda8f44b1
version: 3
date: '2024-05-18'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the deletion of init daemon scripts on
  a Linux machine. It leverages filesystem event logs to identify when files within
  the /etc/init.d/ directory are deleted. This activity is significant because init
  daemon scripts control the start and stop of critical services, and their deletion
  can indicate an attempt to impair security features or evade defenses. If confirmed
  malicious, this behavior could allow an attacker to disrupt essential services,
  execute destructive payloads, or persist undetected in the environment.
data_source:
- Sysmon for Linux EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path
  IN ( "/etc/init.d/*") by _time span=1h Filesystem.file_name Filesystem.file_path
  Filesystem.dest Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_deletion_of_init_daemon_script_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
  Splunkbase.
known_false_positives: Administrator or network operator can execute this command.
  Please update the filter macros to remove false positives.
references:
- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
tags:
  analytic_story:
  - AcidRain
  - Data Destruction
  - AcidPour
  asset_type: Endpoint
  confidence: 70
  impact: 70
  message: Init daemon script deleted on host $dest$ by process GUID- $process_guid$
  mitre_attack_id:
  - T1485
  - T1070.004
  - T1070
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: file_name
    type: File Name
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Filesystem.dest
  - Filesystem.file_create_time
  - Filesystem.file_name
  - Filesystem.process_guid
  - Filesystem.file_path
  - Filesystem.action
  risk_score: 49
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log
    source: Syslog:Linux-Sysmon/Operational
    sourcetype: sysmon:linux