This analytic is to look for possible enumeration of local network configuration. This technique is commonly used as part of recon of adversaries or threat actor to know some network information for its next or further attack. This anomaly detections may capture normal event made by administrator during auditing or testing network connection of specific host or network to network.
- Type: Anomaly
- Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Datamodel: Endpoint
- Last Updated: 2022-02-11
- Author: Teoderick Contreras, Splunk
- ID: 535cb214-8b47-11ec-a2c7-acde48001122
|T1016||System Network Configuration Discovery||Discovery|
Kill Chain Phase
- CIS 3
- CIS 5
- CIS 16
1 2 3 4 5 | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name_list values(Processes.process) as process_list values(Processes.process_id) as process_id_list values(Processes.parent_process_id) as parent_process_id_list values(Processes.process_guid) as process_guid_list dc(Processes.process_name) as process_name_count from datamodel=Endpoint.Processes where Processes.process_name IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route") by _time span=30m Processes.dest Processes.user | where process_name_count >=4 | `drop_dm_object_name(Processes)` | `linux_system_network_discovery_filter`
The SPL above uses the following Macros:
Note that linux_system_network_discovery_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
How To Implement
To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
Known False Positives
Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
Associated Analytic story
|9.0||30||30||A commandline $process$ executed on $dest$|
source | version: 1