splunk-security_content/docs/_posts/2021-12-20-linux_service_restarted.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Linux Service Restarted	Systemd Timers , Scheduled Task/Job	Endpoint	2021-12-20	true		Systemd Timers Scheduled Task/Job Execution Persistence Privilege Escalation Execution Persistence Privilege Escalation Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This analytic looks for restarted or re-enable services in linux platform. This technique can be executed or performed using systemctl or service tool application. Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Administrator may also create a legitimated service for a specific tool or normal application as part of task or automation, in this scenario it is suggested to look for the service path of the actual script or executable that register as service and who created the service for further verification.

• Type: Anomaly
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-12-20
• Author: Teoderick Contreras, Splunk
• ID: 084275ba-61b8-11ec-8d64-acde48001122

ATT&CK

ID	Technique	Tactic
T1053.006	Systemd Timers	Execution, Persistence, Privilege Escalation

| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process IN ("*restart*", "*reload*", "*reenable*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `linux_service_restarted_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime
• security_content_summariesonly

Note that linux_service_restarted_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required field

• _time
• Processes.dest
• Processes.user
• Processes.parent_process_name
• Processes.process_name
• Processes.process
• Processes.process_id
• Processes.parent_process_id

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and commandline executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.

Known False Positives

Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.

Associated Analytic story

• Linux Privilege Escalation
• Linux Persistence Techniques

Kill Chain Phase

• Exploitation

RBA

Risk Score	Impact	Confidence	Message
25.0	50	50	A commandline process that may create or start a service on dest

Reference

• https://attack.mitre.org/techniques/T1543/003/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log

source | version: 1