mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
name: Detect Linux Rootkits using chkrookit
|
|
id: f2f9c859-976a-4836-9730-43673c6dbbde
|
|
version: 1
|
|
date: '2020-08-28'
|
|
description: This search looks for any positive matches found by the chkrootkit tool.
|
|
how_to_implement: You must install have chkrootkit installed on the endpoint as well as indexing its log under /var/log/chkrootkit/.
|
|
The default search assumes that chkrookit is indexed under the sourcetype chkrookit, please modify the macro if this is on another sourcetype.
|
|
type: ESCU
|
|
references: ['https://linuxhint.com/install_chkrootkit/',
|
|
'https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF']
|
|
author: Jose Hernandez, Splunk
|
|
search: '`chkrootkit` "INFECTED:"'
|
|
known_false_positives: chkrookit might flag some applications under linux as rootkits incorrectly, we have observed specifically Linux.Xor.DDoS being flag often incorrectly.
|
|
tags:
|
|
analytics_story:
|
|
- Linux Rootkits
|
|
kill_chain_phases:
|
|
- Obfuscation
|
|
mitre_attack_id:
|
|
- T1014
|
|
cis20:
|
|
- CIS 8
|
|
nist:
|
|
- DE.DP
|
|
- DE.AE
|
|
security_domain: system
|