splunk-security_content/stories/linux_post_exploitation.yml

name: Linux Post-Exploitation
id: d310ccfe-5477-11ec-ad05-acde48001122
version: 1
date: '2021-12-03'
author: Rod Soto
description: This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.
narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.
references:
- https://attack.mitre.org/matrices/enterprise/linux/
tags:
  analytic_story:
  - Linux Post-Exploitation
  category:
  - Adversary Tactics
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Security Monitoring