mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
81 lines
2.9 KiB
YAML
81 lines
2.9 KiB
YAML
name: Linux Ingress Tool Transfer Hunting
|
|
id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf
|
|
version: 1
|
|
date: '2022-07-29'
|
|
author: Michael Haag, Splunk
|
|
type: Hunting
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following analytic hunts for curl and wget being utilized in the environment. This is meant to help with identifying normal usage and potentially malicious. Utilize this query to tune other curl and wget analytics.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=curl OR Processes.process_name=wget) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
|
|
Processes.process Processes.process_id Processes.parent_process_id
|
|
| `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `linux_ingress_tool_transfer_hunting_filter`'
|
|
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
known_false_positives: False positives will be present. This query is meant to help tune other curl and wget analytics.
|
|
references:
|
|
- https://gtfobins.github.io/gtfobins/curl/
|
|
- https://curl.se/docs/manpage.html#-I
|
|
- https://gtfobins.github.io/gtfobins/curl/
|
|
- https://github.com/rapid7/metasploit-framework/search?q=curl
|
|
tags:
|
|
analytic_story:
|
|
- Linux Living Off The Land
|
|
- Ingress Tool Transfer
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 10
|
|
context:
|
|
- Source:Endpoint
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
|
|
impact: 10
|
|
kill_chain_phases:
|
|
- Delivery
|
|
- Installation
|
|
- Actions on Objectives
|
|
message: An instance of $process_name$ was identified
|
|
on endpoint $dest$ by user $user$ utilizing curl or wget.
|
|
mitre_attack_id:
|
|
- T1105
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name #parent process name
|
|
- Processes.parent_process #parent cmdline
|
|
- Processes.original_file_name
|
|
- Processes.process_name #process name
|
|
- Processes.process #process cmdline
|
|
- Processes.process_id
|
|
- Processes.parent_process_path
|
|
- Processes.process_path
|
|
- Processes.parent_process_id
|
|
risk_score: 1
|
|
security_domain: endpoint
|