name: Linux Data Destruction Command
id: b11d3979-b2f7-411b-bb1a-bd00e642173b
version: 1
date: '2023-04-14'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies a unix shell command that can wipe
  root folders of a linux host. This commandline is being abused by Awfulshred malware
  that wipes or corrupts files in a targeted Linux host. The shell command uses the
  rm command with force recursive deletion even in the root folder. This TTP can be
  a good indicator that a user or a process wants to wipe roots directory files in
  Linux host.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "rm"  AND
  Processes.process IN ("* -rf*", "* -fr*") AND Processes.process = "* --no-preserve-root"
  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_data_destruction_command_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
  Splunkbase.
known_false_positives: unknown
references:
- https://cert.gov.ua/article/3718487
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
tags:
  analytic_story:
  - AwfulShred
  - Data Destruction
  asset_type: Endpoint
  confidence: 90
  impact: 100
  message: a $process_name$ execute rm command with --no-preserve-root parmeter that
    can wipe root files in $dest$
  mitre_attack_id:
  - T1485
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: user
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.user
  - Processes.parent_process_name
  - Processes.process_name
  - Processes.process
  - Processes.process_id
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log
    source: Syslog:Linux-Sysmon/Operational
    sourcetype: sysmon_linux
    update_timestamp: true