mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
8ad83a0b5f
Linux Curl Upload File Linux Ingress Tool Transfer Hunting Linux Ingress Tool Transfer with Curl Linux Proxy Socks Curl
83 lines
3.0 KiB
YAML
83 lines
3.0 KiB
YAML
name: Linux Ingress Tool Transfer with Curl
|
|
id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857
|
|
version: 1
|
|
date: '2022-07-29'
|
|
author: Michael Haag, Splunk
|
|
type: Anomaly
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following analytic identifies curl with the command-line switches that are commonly used to download, output, a remote script or binary.
|
|
MetaSploit Framework will combine the -sO switch with | chmod +x to enable a simple one liner to download and set the execute bit to run the file immediately.
|
|
During triage, review the remote domain and file being downloaded for legitimacy.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
|
|
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
|
|
Processes.process Processes.process_id Processes.parent_process_id
|
|
| `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| where match(process, "(?i)(-O|-sO|-ksO|--output)")
|
|
| `linux_ingress_tool_transfer_with_curl_filter`'
|
|
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
known_false_positives: False positives will be present. Tune and then change type to TTP.
|
|
references:
|
|
- https://gtfobins.github.io/gtfobins/curl/
|
|
- https://curl.se/docs/manpage.html#-I
|
|
- https://gtfobins.github.io/gtfobins/curl/
|
|
- https://github.com/rapid7/metasploit-framework/search?q=curl
|
|
tags:
|
|
analytic_story:
|
|
- Linux Living Off The Land
|
|
- Ingress Tool Transfer
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 30
|
|
context:
|
|
- Source:Endpoint
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
|
|
impact: 40
|
|
kill_chain_phases:
|
|
- Delivery
|
|
message: An instance of $process_name$ was identified
|
|
on endpoint $dest$ by user $user$ to download a remote file. Review activity for further details.
|
|
mitre_attack_id:
|
|
- T1105
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name #parent process name
|
|
- Processes.parent_process #parent cmdline
|
|
- Processes.original_file_name
|
|
- Processes.process_name #process name
|
|
- Processes.process #process cmdline
|
|
- Processes.process_id
|
|
- Processes.parent_process_path
|
|
- Processes.process_path
|
|
- Processes.parent_process_id
|
|
risk_score: 12
|
|
security_domain: endpoint
|