mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
65 lines
3.6 KiB
YAML
65 lines
3.6 KiB
YAML
name: Linux Possible Ssh Key File Creation
|
|
id: c04ef40c-72da-11ec-8eac-acde48001122
|
|
version: 12
|
|
creation_date: '2022-01-12'
|
|
modification_date: '2026-05-13'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: Anomaly
|
|
description: The following analytic detects the creation of SSH key files in the ~/.ssh/ directory. It leverages filesystem data to identify new files in this specific path. This activity is significant because threat actors often create SSH keys to gain persistent access and escalate privileges on a compromised host. If confirmed malicious, this could allow attackers to remotely access the machine using the OpenSSH daemon service, leading to potential unauthorized control and data exfiltration.
|
|
data_source:
|
|
- Sysmon for Linux EventID 11
|
|
search: |-
|
|
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
|
|
WHERE Filesystem.file_path IN ("*/.ssh*")
|
|
BY Filesystem.action Filesystem.dest Filesystem.file_access_time
|
|
Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
|
|
Filesystem.file_name Filesystem.file_path Filesystem.file_acl
|
|
Filesystem.file_size Filesystem.process_guid Filesystem.process_id
|
|
Filesystem.user Filesystem.vendor_product
|
|
| `drop_dm_object_name(Filesystem)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `security_content_ctime(firstTime)`
|
|
| `linux_possible_ssh_key_file_creation_filter`
|
|
how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
|
|
known_false_positives: Administrator or network operator can create file in ~/.ssh folders for automation purposes. Please update the filter macros to remove false positives.
|
|
references:
|
|
- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
|
|
- https://attack.mitre.org/techniques/T1098/004/
|
|
drilldown_searches:
|
|
- name: View the detection results for - "$dest$"
|
|
search: '%original_detection_search% | search dest = "$dest$"'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
- name: View risk events for the last 7 days for - "$dest$"
|
|
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
|
earliest_offset: 7d
|
|
latest_offset: "0"
|
|
intermediate_findings:
|
|
entities:
|
|
- field: dest
|
|
type: system
|
|
score: 20
|
|
message: A file $file_name$ is created in $file_path$ on $dest$
|
|
analytic_story:
|
|
- Linux Privilege Escalation
|
|
- Linux Persistence Techniques
|
|
- Linux Living Off The Land
|
|
- Hellcat Ransomware
|
|
asset_type: Endpoint
|
|
mitre_attack_id:
|
|
- T1098.004
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
category: endpoint
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log
|
|
source: Syslog:Linux-Sysmon/Operational
|
|
sourcetype: sysmon:linux
|
|
test_type: unit
|