Analytics Story: Compromised Linux Host

Updated Date: 2026-05-13 ID: d7ea2fc0-3710-4257-b64f-f3c2a6abebd3 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Monitor for activities and techniques associated with Compromised Linux Host attacks. These include unauthorized access attempts, unusual network traffic patterns, and the presence of unknown or suspicious processes. Look for unexpected changes in system files, modifications to configuration files, and the installation of unrecognized software. Pay attention to abnormal resource usage, such as high CPU or memory consumption. Regularly review logs for signs of privilege escalation or lateral movement, and ensure integrity checks are in place to detect tampering with critical system components.

Why it matters

In a tale of digital intrusion, Imagine a system administrator noticing unexpected spikes in network traffic and CPU usage. Delving deeper, they find unknown processes running and unfamiliar software installed. System files and configurations show unauthorized modifications, hinting at privilege escalation. Log reviews reveal attempts at lateral movement across the network. The administrator's vigilance, combined with regular integrity checks, helps uncover and mitigate the threat. This narrative underscores the importance of monitoring and swift action in maintaining a secure Linux environment.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Linux Auditd Unload Module Via Modprobe	Kernel Modules and Extensions	TTP
Linux Auditd Change File Owner To Root	Linux and Mac Permissions	Anomaly
Linux Auditd Data Transfer Size Limits Via Split	Data Transfer Size Limits	Anomaly
Linux Auditd Whoami User Discovery	System Owner/User Discovery	Anomaly
Linux Auditd Database File And Directory Discovery	File and Directory Discovery	Anomaly
Linux Auditd Insert Kernel Module Using Insmod Utility	Kernel Modules and Extensions	Anomaly
Linux Auditd Auditd Daemon Shutdown	Disable or Modify Linux Audit System Log	Anomaly
Linux Auditd System Network Configuration Discovery	System Network Configuration Discovery	Anomaly
Linux Auditd Clipboard Data Copy	Clipboard Data	Anomaly
Linux Auditd Dd File Overwrite	Data Destruction	TTP
Linux Auditd Unix Shell Configuration Modification	Unix Shell Configuration Modification	TTP
Linux Auditd Auditd Daemon Start	Disable or Modify Linux Audit System Log	Anomaly
Linux Auditd Doas Tool Execution	Sudo and Sudo Caching	Anomaly
Linux Auditd Stop Services	Service Stop	Hunting
Linux Auditd Doas Conf File Creation	Sudo and Sudo Caching	TTP
Linux Magic SysRq Key Abuse	Unix Shell, Service Stop, Endpoint Denial of Service, System Shutdown/Reboot	TTP
Linux Auditd Auditd Daemon Abort	Disable or Modify Linux Audit System Log	Anomaly
Linux Auditd Possible Access To Credential Files	/etc/passwd and /etc/shadow	Anomaly
Linux Auditd Find Credentials From Password Managers	Password Managers	TTP
Linux Auditd Kernel Module Enumeration	Rootkit, System Information Discovery	Anomaly
Linux Auditd File Permission Modification Via Chmod	Linux and Mac Permissions	Anomaly
Linux Auditd Service Started	Service Execution	Anomaly
Linux Netcat Outbound Connection	Unix Shell	Anomaly
Windows Suspicious QEMU Execution	Data Obfuscation, Masquerading, Malicious File, Run Virtual Instance	TTP
Linux Auditd Sysmon Service Stop	Service Stop	Anomaly
Linux Auditd File And Directory Discovery	File and Directory Discovery	Anomaly
Linux Auditd Private Keys and Certificate Enumeration	Private Keys	Anomaly
Linux Auditd Auditd Service Stop	Service Stop	Anomaly
Linux Auditd Install Kernel Module Using Modprobe Utility	Kernel Modules and Extensions	Anomaly
Linux Auditd Hardware Addition Swapoff	Hardware Additions	Anomaly
Linux Auditd Hidden Files And Directories Creation	File and Directory Discovery	Anomaly
Linux Auditd Osquery Service Stop	Service Stop	Anomaly
Linux Auditd Data Transfer Size Limits Via Split Syscall	Data Transfer Size Limits	Anomaly
Linux Auditd Preload Hijack Via Preload File	Dynamic Linker Hijacking	TTP
Linux Auditd Setuid Using Setcap Utility	Setuid and Setgid	TTP
Linux Auditd Sudo Or Su Execution	Sudo and Sudo Caching	Anomaly
Linux Auditd Find Ssh Private Keys	Private Keys	Anomaly
Linux Auditd Virtual Disk File And Directory Discovery	File and Directory Discovery	Anomaly
Linux Shell Pseudo Device Reverse Shell	Exfiltration Over Unencrypted Non-C2 Protocol, Command and Scripting Interpreter	Anomaly
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File	Cron	Hunting
Linux Auditd Nopasswd Entry In Sudoers File	Sudo and Sudo Caching	Anomaly
Linux Auditd Add User Account Type	Local Account	Anomaly
Linux Auditd Shred Overwrite Command	Data Destruction	TTP
Linux Auditd Edit Cron Table Parameter	Cron	Anomaly
Linux Auditd File Permissions Modification Via Chattr	Linux and Mac Permissions	Anomaly
Linux Auditd Disable Or Modify System Firewall	Disable or Modify System Firewall	Anomaly
Linux Auditd At Application Execution	At	Anomaly
Linux Auditd Find Credentials From Password Stores	Password Managers	TTP
Linux Auditd Kernel Module Using Rmmod Utility	Kernel Modules and Extensions	TTP
Linux Auditd Possible Access To Sudoers File	Sudo and Sudo Caching	Anomaly
Linux Binary Executed from Shared Memory Directory	Command and Scripting Interpreter	Anomaly
Linux Auditd Preload Hijack Library Calls	Dynamic Linker Hijacking	TTP
Linux Suspicious Child Process of PostgreSQL	Exploit Public-Facing Application	TTP
Linux Shell History Access Via Command Line Utility	Shell History	Anomaly
Linux Auditd Base64 Decode Files	Deobfuscate/Decode Files or Information	Anomaly
Linux Suspicious Privileged Container Execution	Unix Shell, Deploy Container	Anomaly
Linux Auditd Possible Access Or Modification Of Sshd Config File	SSH Authorized Keys	Anomaly
Linux Auditd Service Restarted	Systemd Timers	Anomaly
Linux Auditd Setuid Using Chmod Utility	Setuid and Setgid	Anomaly
Linux Possible System Binary Backdoor	Masquerading, Unix Shell	Anomaly
Linux Suspicious Redis Activity	Exploitation of Remote Services, Server Software Component	TTP
Linux Auditd Add User Account	Local Account	Anomaly
Linux Auditd Data Destruction Command	Data Destruction	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Linux Auditd Execve	Linux	`auditd`	`auditd`
Linux Auditd Proctitle	Linux	`auditd`	`auditd`
Linux Auditd Syscall	Linux	`auditd`	`auditd`
Linux Auditd Daemon End	Linux	`auditd`	`auditd`
Linux Auditd Path	Linux	`auditd`	`auditd`
Linux Auditd Cwd	Linux	`auditd`	`auditd`
Linux Auditd Daemon Start	Linux	`auditd`	`auditd`
Linux Auditd Service Stop	Linux	`auditd`	`auditd`
Linux Auditd Daemon Abort	Linux	`auditd`	`auditd`
Sysmon for Linux EventID 3	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Linux Auditd Add User	Linux	`auditd`	`auditd`
Sysmon for Linux EventID 11	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`

References

Source: GitHub | Version: 2