mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
87 lines
4.0 KiB
YAML
87 lines
4.0 KiB
YAML
name: Linux Decode Base64 to Shell
|
|
id: 637b603e-1799-40fd-bf87-47ecbd551b66
|
|
version: 4
|
|
date: '2024-08-14'
|
|
author: Michael Haag, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. Additionally, it mitigates the potential damage and protects the organization's systems and data.The detection is made by searching for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", within the Endpoint.Processes data model. The analytic also includes a filter for Linux shells. The detection is important because it indicates the presence of malicious activity since Base64 encoding is commonly used to obfuscate malicious commands or payloads, and decoding it can be a step in running those commands. It suggests that an attacker is attempting to run malicious commands on a Linux system to gain unauthorized access, for data exfiltration, or perform other malicious actions.
|
|
data_source:
|
|
- Sysmon for Linux EventID 1
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*|*" `linux_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
|
|
| `drop_dm_object_name(Processes)`
|
|
| rex field=process "base64\s+(?<decode_flag>-{1,2}d\w*)"
|
|
| where isnotnull(decode_flag)
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `linux_decode_base64_to_shell_filter`'
|
|
how_to_implement: The detection is based on data that originates from Endpoint Detection
|
|
and Response (EDR) agents. These agents are designed to provide security-related
|
|
telemetry from the endpoints where the agent is installed. To implement this search,
|
|
you must ingest logs that contain the process GUID, process name, and parent process.
|
|
Additionally, you must ingest complete command-line executions. These logs must
|
|
be processed using the appropriate Splunk Technology Add-ons that are specific to
|
|
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
|
|
data model. Use the Splunk Common Information Model (CIM) to normalize the field
|
|
names and speed up the data modeling process.
|
|
known_false_positives: False positives may be present based on legitimate software
|
|
being utilized. Filter as needed.
|
|
references:
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script
|
|
- https://redcanary.com/blog/lateral-movement-with-secure-shell/
|
|
- https://linux.die.net/man/1/base64
|
|
tags:
|
|
analytic_story:
|
|
- Linux Living Off The Land
|
|
asset_type: Endpoint
|
|
confidence: 50
|
|
impact: 50
|
|
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
|
on endpoint $dest$ by user $user$ decoding base64 and passing it to a shell.
|
|
mitre_attack_id:
|
|
- T1027
|
|
- T1059.004
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: parent_process_name
|
|
type: Process
|
|
role:
|
|
- Attacker
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name
|
|
- Processes.parent_process
|
|
- Processes.original_file_name
|
|
- Processes.process_name
|
|
- Processes.process
|
|
- Processes.process_id
|
|
- Processes.parent_process_path
|
|
- Processes.process_path
|
|
- Processes.parent_process_id
|
|
risk_score: 25
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log
|
|
source: Syslog:Linux-Sysmon/Operational
|
|
sourcetype: sysmon:linux
|
|
update_timestamp: true
|