mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
45 lines
3.2 KiB
Markdown
45 lines
3.2 KiB
Markdown
---
|
|
title: "Linux Post-Exploitation"
|
|
last_modified_at: 2021-12-03
|
|
toc: true
|
|
toc_label: ""
|
|
tags:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
- Endpoint
|
|
---
|
|
|
|
[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
|
|
|
|
#### Description
|
|
|
|
This analytic story detects popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin
|
|
|
|
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
|
|
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
|
|
- **Last Updated**: 2021-12-03
|
|
- **Author**: Rod Soto
|
|
- **ID**: d310ccfe-5477-11ec-ad05-acde48001122
|
|
|
|
#### Narrative
|
|
|
|
These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.
|
|
|
|
#### Detections
|
|
|
|
| Name | Technique | Type |
|
|
| ----------- | ----------- |--------------|
|
|
| [Detect AutoSUID post exploitation tool](/endpoint/detect_autosuid_post_exploitation_tool/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
|
|
| [Detect LinEnum execution](/endpoint/detect_linenum_execution/) | [Account Discovery](/tags/#account-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Process Discovery](/tags/#process-discovery), [Software Discovery](/tags/#software-discovery), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [System Owner/User Discovery](/tags/#system-owner/user-discovery) | TTP |
|
|
| [Detect LinPeas Execution](/endpoint/detect_linpeas_execution/) | [System Information Discovery](/tags/#system-information-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Account Discovery](/tags/#account-discovery), [Network Service Scanning](/tags/#network-service-scanning), [Process Discovery](/tags/#process-discovery), [Software Discovery](/tags/#software-discovery), [System Owner/User Discovery](/tags/#system-owner/user-discovery) | TTP |
|
|
| [Detect Linux Exploit Suggester Execution](/endpoint/detect_linux_exploit_suggester_execution/) | [Account Discovery](/tags/#account-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Process Discovery](/tags/#process-discovery), [Software Discovery](/tags/#software-discovery), [System Information Discovery](/tags/#system-information-discovery) | TTP |
|
|
| [Detect MimiPenguin](/endpoint/detect_mimipenguin/) | [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |
|
|
|
|
#### Reference
|
|
|
|
* [https://attack.mitre.org/matrices/enterprise/linux/](https://attack.mitre.org/matrices/enterprise/linux/)
|
|
|
|
|
|
|
|
[*source*](https://github.com/splunk/security_content/tree/develop/stories/linux_post-exploitation.yml) \| *version*: **1** |