diff --git a/detections/endpoint/linux_bash_history_access.yml b/detections/endpoint/linux_bash_history_access.yml new file mode 100644 index 0000000000..b5dbc8be6f --- /dev/null +++ b/detections/endpoint/linux_bash_history_access.yml @@ -0,0 +1,73 @@ +name: Linux Bash History Access +id: 0e4c2544-b27a-4a2d-b9be-cac8efe515fb +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects attempts to read bash history files. A bash history file is a log file that records all the commands executed in a Bash shell on a Linux or Unix-based operating system. A malicious actor who gains access to a user's bash history file can potentially obtain sensitive information and use it to compromise the user's system and data. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where + Processes.process IN ("cat*", "head*", "tail*", "more*", "less*") + Processes.process="*.bash_history*" + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest + Processes.process_current_directory Processes.process_path Processes.process_integrity_level + Processes.original_file_name Processes.parent_process Processes.parent_process_path + Processes.parent_process_guid Processes.parent_process_id Processes.process_guid + Processes.process_id Processes.user Processes.process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_bash_history_access_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators and automated scripts may access bash history files for auditing or troubleshooting purposes. Filter based on known administrative accounts and approved tooling in your environment. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential Bash History Access by $user$ on $dest$ via $process_name$. + - field: user + type: user + score: 20 + message: Potential Bash History Access by $user$ on $dest$ via $process_name$. +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Compromised Linux Host + - Linux Privilege Escalation + - Linux Persistence Techniques + - Credential Dumping +asset_type: Endpoint +mitre_attack_id: + - T1552.003 + - T1552.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_bash_pseudo_device_reverse_shell.yml b/detections/endpoint/linux_bash_pseudo_device_reverse_shell.yml new file mode 100644 index 0000000000..8aeacde068 --- /dev/null +++ b/detections/endpoint/linux_bash_pseudo_device_reverse_shell.yml @@ -0,0 +1,77 @@ +name: Linux Bash Pseudo Device Reverse Shell +id: f324bc06-8436-4606-8882-0a8fb480b719 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the use of Bash's /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections. This special file system interface allows opening a network socket and sending or receiving data using simple shell commands. Attackers commonly abuse this native Bash capability to create reverse shells without requiring external tools such as netcat, by redirecting shell I/O over a TCP or UDP connection to an attacker-controlled host and port. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where + Processes.process_path IN ("*/bash*", "*/sh*", "*/zsh*","*/dash*") + Processes.process IN ("*/dev/tcp/*", "*/dev/udp/*") + by Processes.process Processes.vendor_product + Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + |`linux_bash_pseudo_device_reverse_shell_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or developers may use /dev/tcp or /dev/udp for network diagnostics or testing purposes. Filter based on known authorized users and trusted source systems. +references: + - https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#bash-tcp +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential Bash Reverse Shell by $user$ on $dest$ via $process_name$. + - field: user + type: user + score: 20 + message: Potential Bash Reverse Shell by $user$ on $dest$ via $process_name$. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Command And Control + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1048.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml b/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml new file mode 100644 index 0000000000..4be412359e --- /dev/null +++ b/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml @@ -0,0 +1,78 @@ +name: Linux Binary Executed from Shared Memory Directory +id: 2e954190-d547-447c-94d7-d8acac97873b +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic identifies the execution of a binary by root from Linux shared memory directories (/dev/shm/ and /run/shm/). Threat actors place executables in these directories to persist on high-uptime servers as system backdoors. Both /dev/shm and /run/shm are tmpfs-backed directories that exist only in virtual memory with no persistent storage, making them attractive for staging fileless or semi-fileless malware while avoiding disk forensics. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where + Processes.process_path IN ("/dev/shm/*", "/run/shm/*") + Processes.user=root + by Processes.process Processes.process_path Processes.process_name Processes.user + Processes.user_id Processes.process_hash Processes.parent_process_name + Processes.parent_process_path Processes.parent_process Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id + Processes.vendor_product Processes.action Processes.dest + Processes.process_current_directory Processes.process_integrity_level + Processes.original_file_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_binary_executed_from_shared_memory_directory_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate applications may use shared memory directories for temporary file storage or inter-process communication. Verify any flagged activity against known software behavior and filter accordingly. +references: + - https://linuxsecurity.com/features/fileless-malware-on-linux + - https://twitter.com/GossiTheDog/status/1522964028284411907 + - https://github.com/elastic/detection-rules/blob/main/rules/linux/execution_process_started_in_shared_memory_directory.toml +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +threat_objects: + - field: process_name + type: process_name + - field: process_path + type: process +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Binary Executed from Shared Memory Directory activity observed on $dest$. + - field: user + type: user + score: 20 + message: Binary Executed from Shared Memory Directory activity observed on $dest$. +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_efi_bootloader_file_deletion.yml b/detections/endpoint/linux_efi_bootloader_file_deletion.yml new file mode 100644 index 0000000000..5321bd46e6 --- /dev/null +++ b/detections/endpoint/linux_efi_bootloader_file_deletion.yml @@ -0,0 +1,69 @@ +name: Linux EFI Bootloader File Deletion +id: 818a63f8-f2e1-4d1b-ac95-3a4f2ec7f113 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects file deletions in the EFI boot directory. These files are responsible for initializing the Boot Manager during system startup. Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where + Filesystem.action=deleted + Filesystem.file_path="*/boot/efi/EFI/BOOT/*" + Filesystem.file_name="*.efi*" + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_efi_bootloader_file_deletion_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file deletion events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or package managers may delete or replace EFI bootloader files during system updates or OS reinstallation. Filter for known maintenance windows and authorized administrative activity. +references: + - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ + - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux EFI Bootloader File Deletion detected on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Data Destruction + - Linux Persistence Techniques + - Ransomware +asset_type: Endpoint +cve: + - CVE-2024-7344 +mitre_attack_id: + - T1542.001 + - T1542.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ghostscript_exploitation.yml b/detections/endpoint/linux_ghostscript_exploitation.yml new file mode 100644 index 0000000000..29d8d49fcc --- /dev/null +++ b/detections/endpoint/linux_ghostscript_exploitation.yml @@ -0,0 +1,74 @@ +name: Linux Ghostscript Exploitation +id: 580f99d8-a4c8-4ef1-9c84-f355867bca41 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects exploitation of Ghostscript causing command execution. This can be used by attackers to abuse file conversion services or embedded LibreOffice documents. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="sh -c*" + Processes.parent_process_path IN ("*/gs", "*/ghostscript") by Processes.process + Processes.vendor_product Processes.user_id Processes.process_hash Processes.parent_process_name + Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory + Processes.process_path Processes.process_integrity_level Processes.original_file_name + Processes.parent_process Processes.parent_process_path Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user + Processes.process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_ghostscript_exploitation_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate use of Ghostscript for document processing or file conversion tasks may trigger this rule. Filter based on known authorized applications that rely on Ghostscript for routine document handling. +references: + - https://www.bleepingcomputer.com/news/security/rce-bug-in-widely-used-ghostscript-library-now-exploited-in-attacks/ + - https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux Ghostscript Exploitation identified on $dest$ via $process_name$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Unusual Processes + - Suspicious Command-Line Executions + - Linux Living Off The Land +asset_type: Endpoint +cve: + - CVE-2024-29510 +mitre_attack_id: + - T1204.002 + - T1566 + - T1059 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_motd_script_added.yml b/detections/endpoint/linux_motd_script_added.yml new file mode 100644 index 0000000000..437517c220 --- /dev/null +++ b/detections/endpoint/linux_motd_script_added.yml @@ -0,0 +1,64 @@ +name: Linux MOTD Script Added +id: 6dd14256-559b-4364-99d8-0968407b8074 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation of a file within the /etc/update-motd.d directory. This is used to add scripts that run with Message of the Day (MOTD) when a user logs in. This can be used by attackers for persistence if it contains malicious code. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where + Filesystem.file_path="/etc/update-motd.d/*" + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_motd_script_added_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators may add or modify MOTD scripts for valid operational purposes such as displaying system information or login banners. Filter based on known administrative activity and authorized users. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential MOTD Script added on $dest$. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_netcat_outbound_connection.yml b/detections/endpoint/linux_netcat_outbound_connection.yml new file mode 100644 index 0000000000..90baea3a9b --- /dev/null +++ b/detections/endpoint/linux_netcat_outbound_connection.yml @@ -0,0 +1,65 @@ +name: Linux Netcat Outbound Connection +id: 50a9de97-d58d-4844-8daf-928d2faceead +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems. Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by attackers to establish reverse shells, exfiltrate data, or create persistent backdoor connections to remote systems. This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic. If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system. +data_source: + - Sysmon EventID 3 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Network_Traffic.All_Traffic where + All_Traffic.app IN ("*ncat*", "*netcat*") + OR + All_Traffic.process_name IN ("*nc", "*ncat", "*netcat") + All_Traffic.direction=outbound + by All_Traffic.src All_Traffic.dest All_Traffic.dest_port All_Traffic.transport + All_Traffic.process_name All_Traffic.app All_Traffic.user All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_netcat_outbound_connection_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain network connection events including the source, destination, port, and process context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Network_Traffic` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or developers may use netcat for troubleshooting, port scanning, or testing network connectivity. Filter based on known administrative activity or authorized users. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Netcat Outbound Connection detected on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: dest + type: ip_address +analytic_story: + - Linux Post-Exploitation + - Command And Control + - Data Exfiltration + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_persistence_via_system_generator.yml b/detections/endpoint/linux_persistence_via_system_generator.yml new file mode 100644 index 0000000000..5c311b2658 --- /dev/null +++ b/detections/endpoint/linux_persistence_via_system_generator.yml @@ -0,0 +1,68 @@ +name: Linux Persistence via System Generator +id: 06c23568-e05b-4fff-95cd-8b0303b6d032 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects persistence using a systemd generator on Linux, which involves creating a malicious script or binary that is typically executed during the system's boot process. Systemd generators are typically placed in directories like /lib/systemd/system-generators/, where they are run early in the boot sequence to dynamically generate or modify unit files that control system services. By placing a custom generator in this directory, an attacker can ensure their code is executed each time the system starts, allowing them to maintain access or control even after reboots. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where + Filesystem.file_path="*lib/systemd/system-generators/*" + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_persistence_via_system_generator_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or software packages may place custom generators in systemd generator directories during system configuration or application deployment. Filter based on known software installations and verified administrative activity. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux Persistence via System Generator detected on $dest$ by $user$. + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Potential Persistence via System Generator on $dest$ by $user$. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1037.005 + - T1547 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_bootloader_modifications.yml b/detections/endpoint/linux_possible_bootloader_modifications.yml new file mode 100644 index 0000000000..a0d2cfedab --- /dev/null +++ b/detections/endpoint/linux_possible_bootloader_modifications.yml @@ -0,0 +1,77 @@ +name: Linux Possible Bootloader Modifications +id: 97fd4330-bd47-4742-abaf-c877d404822a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects processes modifying data in the EFI volume on Linux. These files are responsible for initializing the Boot Manager during system startup. Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*/EFI/BOOT*" + OR Processes.process_current_directory="*/EFI/BOOT*" by Processes.process Processes.vendor_product + Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_bootloader_modifications_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or package managers such as grub or shim may modify EFI volume files during OS upgrades or bootloader updates. Filter based on known update processes or trusted administrative activity. +references: + - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ + - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible Bootloader Modifications identified on $dest$ by $user$ via $process_name$ + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Potential Possible Bootloader Modifications by $user$ on $dest$ via $process_name$. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Rootkit + - Data Destruction + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2024-7344 +mitre_attack_id: + - T1542.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_gsm_privilege_escalation.yml b/detections/endpoint/linux_possible_gsm_privilege_escalation.yml new file mode 100644 index 0000000000..b409d2edc0 --- /dev/null +++ b/detections/endpoint/linux_possible_gsm_privilege_escalation.yml @@ -0,0 +1,75 @@ +name: Linux Possible GSM Privilege Escalation +id: ae13064b-72ea-41fb-9d29-716c27e01208 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the commands used in a race condition found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled. This could allow a local unprivileged user to escalate their privileges on the system. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where + Processes.process="*rmmod n_gsm*" + AND + Processes.process IN ( + "*exec /bin/bash*", + "*exec /bin/sh*", + "*exec /bin/dash*", + "*exec /bin/zsh*" + ) + by Processes.process Processes.vendor_product + Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_possible_gsm_privilege_escalation_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or developers testing GSM multiplexor configurations may trigger this detection. Filter based on known authorized users or testing environments. +references: + - https://access.redhat.com/security/cve/cve-2023-6546 + - https://github.com/Nassim-Asrir/ZDI-24-020/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential GSM Privilege Escalation on $dest$. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2023-6546 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml b/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml new file mode 100644 index 0000000000..1766ddc65b --- /dev/null +++ b/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml @@ -0,0 +1,74 @@ +name: Linux Possible Nimbuspwn Privilege Escalation +id: 24a540b7-6eec-4972-ad85-1f2232f9a849 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects directory traversal attempts associated with Nimbuspwn, a Linux privilege escalation vulnerability affecting the networkd-dispatcher service. Nimbuspwn exploits weaknesses in the networkd-dispatcher service to traverse directories and execute arbitrary code with elevated privileges. If confirmed malicious, this activity could allow an attacker to escalate privileges to root, potentially leading to full system compromise, persistent unauthorized access, and the ability to deploy additional malicious payloads. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where + Processes.process="*networkd-dispatcher*" + AND + Processes.process="*../*" + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_nimbuspwn_privilege_escalation_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system processes or administrative scripts that traverse directories in a similar pattern may trigger this detection. Filter based on known administrative activity and verified system processes. +references: + - https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible Nimbuspwn privilege escalation identified on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +cve: + - CVE-2022-29799 + - CVE-2022-29800 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml new file mode 100644 index 0000000000..b01ac09fd5 --- /dev/null +++ b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml @@ -0,0 +1,68 @@ +name: Linux Possible Privilege Escalation via PYTHONPATH +id: 5edda575-409a-4820-a048-5780796a181e +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects the creation of a malicious shared object at a Python importlib path outside the standard system library directories, a technique used to abuse PYTHONPATH for local privilege escalation. Attackers exploiting vulnerabilities such as the 2024 NeedRestart flaw (CVE-2024-48990) plant a crafted importlib/__init__.so in an attacker-controlled directory, then manipulate the PYTHONPATH environment variable so that a privileged process — such as NeedRestart running as root — loads the rogue module instead of the legitimate one, achieving code execution with elevated privileges. The detection monitors for file writes matching the importlib/__init__.so pattern that do not originate from expected system library paths. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where + Filesystem.file_path="*/importlib/__init__.so*" + NOT Filesystem.file_path="*/lib/*" + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.process_guid Filesystem.process_id + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_privilege_escalation_via_pythonpath_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate Python developers or system administrators may modify PYTHONPATH for testing or application configuration purposes. Filter based on known development environments and trusted user activity. +references: + - https://www.bleepingcomputer.com/news/security/ubuntu-linux-impacted-by-decade-old-needrestart-flaw-that-gives-root/ + - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible Privilege Escalation via PYTHONPATH detected on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2024-48990 +mitre_attack_id: + - T1068 + - T1574.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_system_binary_backdoor.yml b/detections/endpoint/linux_possible_system_binary_backdoor.yml new file mode 100644 index 0000000000..cf19311a0b --- /dev/null +++ b/detections/endpoint/linux_possible_system_binary_backdoor.yml @@ -0,0 +1,66 @@ +name: Linux Possible System Binary Backdoor +id: a806d611-ea81-4d8a-9b9b-fbf5b6ec520a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation or overwrite of commonly targeted Linux system binaries such as cat, ls, cp, ps, mv, netstat, ss, and lsof. Adversaries may replace these utilities with backdoored versions to hide malicious activity, harvest credentials, or maintain persistence while appearing to use legitimate system tools. This technique is associated with rootkit deployment and post-exploitation frameworks such as PANIX. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where + Filesystem.file_path IN ("/usr/bin/cat", "/usr/bin/ls", "/usr/bin/cp", "/usr/bin/ps", + "/usr/bin/mv", "/usr/bin/netstat", "/usr/bin/ss", "/usr/bin/lsof") + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_system_binary_backdoor_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system updates or package managers may create or overwrite system binaries during normal operations. Filter for known update processes and package management activity to reduce noise. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential Possible System Binary Backdoor activity observed on $dest$. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1036 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_root_execution_of_id.yml b/detections/endpoint/linux_root_execution_of_id.yml new file mode 100644 index 0000000000..f59befb1fb --- /dev/null +++ b/detections/endpoint/linux_root_execution_of_id.yml @@ -0,0 +1,70 @@ +name: Linux Root execution of id +id: 538dc501-ce3a-4a32-9f56-6dbe0aee1474 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of the `id` command by the root user on Linux systems. Attackers commonly run `id` during post-exploitation to confirm they have achieved root-level privileges after a privilege escalation attempt. This activity is significant because it may indicate an attacker is verifying superuser access following a successful compromise. If confirmed malicious, this could signal that an attacker has gained full control of the system, enabling them to perform destructive actions, exfiltrate sensitive data, or establish persistent unauthorized access. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path="/usr/bin/id" + Processes.user="root" by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_root_execution_of_id_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators and automated scripts routinely run the id command as root for system auditing or configuration tasks. Filter based on known administrative activity or trusted scripts. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential Root execution of id by $user$ on $dest$ via $process_name$. + - field: user + type: user + score: 20 + message: Potential Root execution of id by $user$ on $dest$ via $process_name$. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1033 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml b/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml new file mode 100644 index 0000000000..f513de1560 --- /dev/null +++ b/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml @@ -0,0 +1,82 @@ +name: Linux Suspicious Child Process of Postgresql +id: 6488b83f-8e76-43c3-91ee-c90a6d9e8d62 +version: 1 +creation_date: '2026-07-17' +modification_date: '2026-07-17' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects PostgreSQL spawning a shell, interpreter, or network utility as a child process. When an attacker exploits a remote code execution vulnerability in PostgreSQL (such as via malicious COPY TO/FROM PROGRAM, CVE-2019-9193, or an insecurely configured extension), the database process itself becomes the parent of attacker-controlled commands. Legitimate PostgreSQL processes do not normally fork shells or download tools, making this a high-fidelity signal for post-exploitation activity. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes + WHERE (Processes.parent_process_name IN ("postgres", "postmaster", "pg_ctl") + OR Processes.parent_process_path IN ("/usr/lib/postgresql/*/bin/postgres", "/usr/bin/postgres", "/usr/local/bin/postgres") + OR Processes.process_current_directory="*/var/lib/postgresql/*/main*") + AND Processes.process_name IN ( + "awk", "bash", "curl", "dash", "env", "gawk", "id", "ifconfig", + "ksh", "lua", "nc", "ncat", "netcat", "nmap", "openssl", "perl", + "php", "python", "python2", "python3", "ruby", "sh", "socat", + "tcpdump", "wget", "whoami", "zsh" + ) + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_child_process_of_postgresql_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Custom PostgreSQL extensions or wrapper scripts that legitimately invoke shell utilities may trigger this detection. Baseline the environment and use the filter macro to suppress known-good parent/child combinations. Recommend throttling by dest and process_name before enabling broadly. +references: + - https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/ + - https://www.postgresql.org/docs/current/sql-copy.html + - https://nvd.nist.gov/vuln/detail/CVE-2019-9193 +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux Suspicious Child Process of Postgresql identified on $dest$ via $process_name$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host + - SQL Injection +asset_type: Endpoint +mitre_attack_id: + - T1190 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_docker_build.yml b/detections/endpoint/linux_suspicious_docker_build.yml new file mode 100644 index 0000000000..b7eb16bcf8 --- /dev/null +++ b/detections/endpoint/linux_suspicious_docker_build.yml @@ -0,0 +1,63 @@ +name: Linux Suspicious Docker Build +id: dc4a58d2-fde3-4bdd-a36b-7368b2523589 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects docker build being executed on Dockerfiles within the /tmp directory. This is not a typical location for this activity and can indicate an actor adding a container for malicious future actions. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*docker build*" + AND + (Processes.process="-f /tmp" OR Processes.process_current_directory="/tmp") + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest + Processes.process_current_directory Processes.process_path Processes.process_integrity_level + Processes.original_file_name Processes.parent_process Processes.parent_process_path + Processes.parent_process_guid Processes.parent_process_id Processes.process_guid + Processes.process_id Processes.user Processes.process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_suspicious_docker_build_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Developers or administrators may occasionally use the /tmp directory for testing Docker builds in non-production environments. Filter based on known users or systems where this activity has been approved. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Docker Build on $dest$ via $process_name$. +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1610 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml b/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml new file mode 100644 index 0000000000..99039f09fc --- /dev/null +++ b/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml @@ -0,0 +1,77 @@ +name: Linux Suspicious GCC Invocation Building Init Shared Object +id: 9dbf4a61-0493-43bd-932c-532ba7671a7a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes + WHERE Processes.process_name IN ("gcc", "cc", "g++", "gcc-*", "*x86_64-linux-gnu-gcc*") + AND Processes.process="*-shared*" + AND Processes.process="*-Wl,-init,*" + AND Processes.process="*.so*" + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_gcc_invocation_building_init_shared_object_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate developers may use these GCC flags when building shared libraries that require initialization functions. Filter based on known development environments and trusted users. +references: + - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/ + - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Suspicious GCC Invocation Building Init Shared Object identified on $dest$. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2025-32463 +mitre_attack_id: + - T1129 + - T1068 + - T1608 + - T1027.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_privileged_container.yml b/detections/endpoint/linux_suspicious_privileged_container.yml new file mode 100644 index 0000000000..892a027887 --- /dev/null +++ b/detections/endpoint/linux_suspicious_privileged_container.yml @@ -0,0 +1,71 @@ +name: Linux Suspicious Privileged Container +id: 29b888db-d6e7-4286-bbf5-39d9f260444c +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of a Docker container with the privileged flag set, or with the pid namespace set to the host. This can indicate a container running with elevated permissions and access to the underlying system. Actors can hide containers such as this to enable persistent access. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where + Processes.process="*docker run*" + AND + Processes.process="*--privileged*" + AND + Processes.process="*--pid=host*" + by Processes.process + Processes.vendor_product Processes.user_id Processes.process_hash Processes.parent_process_name + Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory + Processes.process_path Processes.process_integrity_level Processes.original_file_name + Processes.parent_process Processes.parent_process_path Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user + Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_suspicious_privileged_container_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators may intentionally run privileged containers for maintenance, debugging, or specific infrastructure tasks. Filter based on known approved workflows and trusted administrative users. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Privileged Container on $dest$. +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1610 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_redis_activity.yml b/detections/endpoint/linux_suspicious_redis_activity.yml new file mode 100644 index 0000000000..cec9ca3f9e --- /dev/null +++ b/detections/endpoint/linux_suspicious_redis_activity.yml @@ -0,0 +1,82 @@ +name: Linux Suspicious Redis Activity +id: 098bbfa8-a591-44ab-9ec0-ae8ee82b4450 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects Redis processes spawning a system shell command. This can indicate exploitation activity of a redis server to gain code execution. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes + WHERE (Processes.parent_process_name IN ("redis-server", "redis-sentinel") + OR Processes.parent_process_path IN ("/usr/bin/redis*", "/usr/local/bin/redis*")) + AND Processes.process_name IN ( + "awk", "bash", "curl", "dash", "gawk", "id", "ifconfig", + "lua", "nc", "ncat", "netcat", "openssl", "perl", "php", + "python", "python2", "python3", "ruby", "sh", "socat", + "wget", "whoami", "zsh" + ) + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_redis_activity_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate administrative scripts or automated maintenance tasks may trigger this detection when managing Redis configurations or performing system operations. Filter based on known administrative activity and approved management tools. +references: + - https://thesecmaster.com/how-to-fix-cve-2022-0543-a-critical-lua-sandbox-escape-vulnerability-in-redis/ + - https://www.bleepingcomputer.com/news/security/new-p2pinfect-worm-malware-targets-linux-and-windows-redis-servers/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Suspicious Redis Activity identified on $dest$ via $process_name$. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Compromised Linux Host + - Linux Persistence Techniques + - Linux Privilege Escalation + - Linux Living Off The Land + - Command And Control +asset_type: Endpoint +cve: + - CVE-2022-0543 +mitre_attack_id: + - T1505 + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml b/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml new file mode 100644 index 0000000000..ddd8d8d41d --- /dev/null +++ b/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml @@ -0,0 +1,71 @@ +name: Linux Suspicious Staging of Alternate System Files +id: 250fd1b5-e62a-4515-baff-3010b52b4c12 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation of sensitive system files such as nsswitch.conf, passwd, shadow, sudoers, and NSS shared libraries outside of their canonical /etc or /var/lib/docker paths. This technique is associated with CVE-2025-32463 (chwoot), where an attacker stages a fake root directory containing spoofed system configuration files and NSS libraries to manipulate how privileged processes such as sudo resolve name services, enabling local privilege escalation by hijacking library loading without modifying the real /etc directory. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem + WHERE Filesystem.file_path IN ( + "*/etc/nsswitch.conf", "*/etc/passwd", "*/etc/shadow", "*/etc/group", + "*/etc/sudoers", "*/etc/pam.conf", "*/etc/sudo.conf", + "*/libnss_*" + ) + AND NOT Filesystem.file_path IN ("/etc/*", "/var/lib/docker/*") + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_staging_of_alternate_system_files_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Developers or system administrators may stage alternate system files for legitimate testing or containerized environments. Filter based on known development or testing systems. +references: + - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/ + - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Staging of Alternate System Files activity observed on $dest$. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1036 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_sudo_parameter.yml b/detections/endpoint/linux_suspicious_sudo_parameter.yml new file mode 100644 index 0000000000..14112bc67c --- /dev/null +++ b/detections/endpoint/linux_suspicious_sudo_parameter.yml @@ -0,0 +1,82 @@ +name: Linux Suspicious Sudo Parameter +id: e4af36aa-ed9e-4718-9aa7-451232b40719 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the usage of suspicious parameters with sudo. These have been seen with various privilege escalation techniques. These are very rarely used for normal usage of sudo. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes + WHERE Processes.process_name="sudo" + AND ( + Processes.process IN ("*-R *", "*--chroot*") + OR Processes.process="*-u#*" + OR Processes.process IN ("* -h *", "* --host *") + ) + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_sudo_parameter_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: The --chroot and -R flags may fire in container management or chroot jail administration scripts. The -h/--host flags may appear in legitimate remote sudo configurations. The -u# UID form is rarely used legitimately. Filter based on known administrative activity and approved tooling in your environment. +references: + - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/ + - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential Suspicious Sudo Parameter by $user$ on $dest$ via $process_name$. + - field: user + type: user + score: 20 + message: Potential Suspicious Sudo Parameter by $user$ on $dest$ via $process_name$. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2025-32463 +mitre_attack_id: + - T1548.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_xdg_autostart.yml b/detections/endpoint/linux_suspicious_xdg_autostart.yml new file mode 100644 index 0000000000..8ba2944bd4 --- /dev/null +++ b/detections/endpoint/linux_suspicious_xdg_autostart.yml @@ -0,0 +1,69 @@ +name: Linux Suspicious XDG Autostart +id: dc057fd6-34db-4c41-b8dd-00463c47bf83 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation of a .desktop file within XDG autostart directories, including the system-wide /etc/xdg/autostart and user-local ~/.config/autostart paths. Adversaries abuse XDG autostart entries to achieve persistence on Linux desktop environments — any .desktop file placed in these directories is automatically executed when a user logs into a graphical session. This technique is used by post-exploitation frameworks such as PANIX to survive reboots without requiring root on user-local paths, or to achieve system-wide persistence when writing to /etc/xdg/autostart. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem + WHERE Filesystem.file_path IN ( + "/etc/xdg/autostart/*.desktop", + "*/home/*/.config/autostart/*.desktop" + ) + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_xdg_autostart_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate software installations may create .desktop files in /etc/xdg/autostart as part of their normal setup process. Filter known software deployment tools and approved administrative activity as needed. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious XDG Autostart activity observed on $dest$. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_udev_rule_created.yml b/detections/endpoint/linux_udev_rule_created.yml new file mode 100644 index 0000000000..1ff25ef0f9 --- /dev/null +++ b/detections/endpoint/linux_udev_rule_created.yml @@ -0,0 +1,69 @@ +name: Linux UDEV Rule Created +id: 94d0e307-beae-4f85-8150-69c169b979c1 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation of files within udev rules directories, including /etc/udev/rules.d and /usr/lib/udev/rules.d. Adversaries abuse udev rules to achieve persistent code execution by embedding RUN+= directives that trigger arbitrary commands whenever a matching device event occurs, such as a USB device being connected or a network interface coming online. Because udev rules execute in the context of the udev daemon with elevated privileges, this technique can provide both persistence and privilege escalation. It is used by post-exploitation frameworks such as PANIX and is effective on headless servers where device events still fire despite no interactive user session. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem + WHERE Filesystem.file_path IN ( + "/etc/udev/rules.d/*", + "/usr/lib/udev/rules.d/*" + ) + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_udev_rule_created_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or software installers may create udev rules as part of normal hardware configuration or device management tasks. Filter based on known administrative activity and trusted software installations. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential UDEV rule created on $dest$. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation + - Linux Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_usermod_root_uid_set.yml b/detections/endpoint/linux_usermod_root_uid_set.yml new file mode 100644 index 0000000000..443c1fe2e1 --- /dev/null +++ b/detections/endpoint/linux_usermod_root_uid_set.yml @@ -0,0 +1,79 @@ +name: Linux Usermod Root UID Set +id: fe143ad6-ef29-4571-be14-0cd08a32ff34 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects the use of usermod to set a user's UID to 0. This functionally sets the user as a root user with full permissions. This approach can be used to bypass regular privilege escalation mechanisms, giving the attacker full control over the system while appearing as a regular user in most monitoring tools. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes + WHERE Processes.process_name="usermod" + AND (Processes.process IN ("* -u 0 *", "* -u 0") OR Processes.process="*--uid 0*") + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_usermod_root_uid_set_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Setting a user's UID to 0 is extremely rare in legitimate administration — there is almost no valid operational reason to create a second root-equivalent account this way. False positives are expected to be very low. Verify any alert against change management records before dismissing. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux Usermod Root UID Set identified on $dest$ by $user$ via $process_name$ + entity: + field: user + type: user + score: 50 +intermediate_findings: + entities: + - field: dest + type: system + score: 50 + message: Potential Usermod Root UID Set by $user$ on $dest$ via $process_name$. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1098 + - T1078 + - T1548.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux