mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
70 lines
3.4 KiB
YAML
70 lines
3.4 KiB
YAML
name: Linux Edit Cron Table Parameter
|
|
id: 0d370304-5f26-11ec-a4bb-acde48001122
|
|
version: 1
|
|
date: '2021-12-17'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: Hunting
|
|
description: The following analytic detects the suspicious editing of cron jobs in Linux via the crontab command-line parameter. This tactic could be used by adversaries or malware to schedule execution of their malicious code, potentially leading to system compromise or unauthorized persistent access. It pinpoints this activity by monitoring command-line executions involving 'crontab' and the edit parameter (-e).\
|
|
|
|
Recognizing such activity is vital for a SOC as cron job manipulations might signal unauthorized persistence attempts or scheduled malicious actions, potentially resulting in substantial harm. A true positive signifies an active threat, with implications ranging from unauthorized access to broader network compromise.\
|
|
|
|
To implement this analytic, logs capturing process name, parent process, and command-line executions from your endpoints must be ingested.\
|
|
|
|
Known false positives could stem from valid administrative tasks or automation processes using crontab. To reduce these, fine-tune the filter macros according to the benign activities within your environment. These adjustments ensure legitimate actions aren't mistaken for threats, allowing analysts to focus on genuine potential risks.\
|
|
data_source:
|
|
- Sysmon Event ID 1
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = crontab
|
|
Processes.process = "*crontab *" Processes.process = "* -e*" by Processes.dest Processes.user
|
|
Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
|
|
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the process name, parent process, and command-line executions from your
|
|
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
|
|
Splunkbase.
|
|
known_false_positives: Administrator or network operator can use this application
|
|
for automation purposes. Please update the filter macros to remove false positives.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1053/003/
|
|
tags:
|
|
analytic_story:
|
|
- Linux Privilege Escalation
|
|
- Linux Persistence Techniques
|
|
- Linux Living Off The Land
|
|
- Scheduled Tasks
|
|
asset_type: Endpoint
|
|
confidence: 30
|
|
impact: 30
|
|
message: A possible crontab edit command $process$ executed on $dest$
|
|
mitre_attack_id:
|
|
- T1053.003
|
|
- T1053
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name
|
|
- Processes.process_name
|
|
- Processes.process
|
|
- Processes.process_id
|
|
- Processes.parent_process_id
|
|
risk_score: 9
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux.log
|
|
source: Syslog:Linux-Sysmon/Operational
|
|
sourcetype: sysmon_linux
|