Analytics Story: Compromised Linux Host

Date: 2024-06-25 ID: d7ea2fc0-3710-4257-b64f-f3c2a6abebd3 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Monitor for activities and techniques associated with Compromised Linux Host attacks. These include unauthorized access attempts, unusual network traffic patterns, and the presence of unknown or suspicious processes. Look for unexpected changes in system files, modifications to configuration files, and the installation of unrecognized software. Pay attention to abnormal resource usage, such as high CPU or memory consumption. Regularly review logs for signs of privilege escalation or lateral movement, and ensure integrity checks are in place to detect tampering with critical system components.

Why it matters

In a tale of digital intrusion, Imagine a system administrator noticing unexpected spikes in network traffic and CPU usage. Delving deeper, they find unknown processes running and unfamiliar software installed. System files and configurations show unauthorized modifications, hinting at privilege escalation. Log reviews reveal attempts at lateral movement across the network. The administrator's vigilance, combined with regular integrity checks, helps uncover and mitigate the threat. This narrative underscores the importance of monitoring and swift action in maintaining a secure Linux environment.

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
Linux Auditd Find Private Keys Private Keys TTP
Linux Auditd Add User Account Local Account Anomaly
Linux Auditd Add User Account Type Local Account Anomaly
Linux Auditd At Application Execution At Anomaly
Linux Auditd Auditd Service Stop Service Stop Anomaly
Linux Auditd Base64 Decode Files Deobfuscate/Decode Files or Information Anomaly
Linux Auditd Change File Owner To Root Linux and Mac File and Directory Permissions Modification TTP
Linux Auditd Clipboard Data Copy Clipboard Data Anomaly
Linux Auditd Data Destruction Command Data Destruction TTP
Linux Auditd Data Transfer Size Limits Via Split Data Transfer Size Limits Anomaly
Linux Auditd Data Transfer Size Limits Via Split Syscall Data Transfer Size Limits Anomaly
Linux Auditd Database File And Directory Discovery File and Directory Discovery Anomaly
Linux Auditd Dd File Overwrite Data Destruction TTP
Linux Auditd Disable Or Modify System Firewall Disable or Modify System Firewall Anomaly
Linux Auditd Doas Conf File Creation Sudo and Sudo Caching TTP
Linux Auditd Doas Tool Execution Sudo and Sudo Caching Anomaly
Linux Auditd Edit Cron Table Parameter Cron TTP
Linux Auditd File And Directory Discovery File and Directory Discovery Anomaly
Linux Auditd File Permission Modification Via Chmod Linux and Mac File and Directory Permissions Modification Anomaly
Linux Auditd File Permissions Modification Via Chattr Linux and Mac File and Directory Permissions Modification Anomaly
Linux Auditd Find Credentials From Password Managers Password Managers TTP
Linux Auditd Find Credentials From Password Stores Password Managers TTP
Linux Auditd Find Ssh Private Keys Private Keys Anomaly
Linux Auditd Hardware Addition Swapoff Hardware Additions Anomaly
Linux Auditd Hidden Files And Directories Creation File and Directory Discovery Anomaly
Linux Auditd Insert Kernel Module Using Insmod Utility Kernel Modules and Extensions Anomaly
Linux Auditd Install Kernel Module Using Modprobe Utility Kernel Modules and Extensions Anomaly
Linux Auditd Kernel Module Enumeration System Information Discovery, Rootkit Anomaly
Linux Auditd Kernel Module Using Rmmod Utility Kernel Modules and Extensions TTP
Linux Auditd Nopasswd Entry In Sudoers File Sudo and Sudo Caching Anomaly
Linux Auditd Osquery Service Stop Service Stop TTP
Linux Auditd Possible Access Or Modification Of Sshd Config File SSH Authorized Keys Anomaly
Linux Auditd Possible Access To Credential Files /etc/passwd and /etc/shadow Anomaly
Linux Auditd Possible Access To Sudoers File Sudo and Sudo Caching Anomaly
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File Cron Hunting
Linux Auditd Preload Hijack Library Calls Dynamic Linker Hijacking TTP
Linux Auditd Preload Hijack Via Preload File Dynamic Linker Hijacking TTP
Linux Auditd Private Keys and Certificate Enumeration Private Keys Anomaly
Linux Auditd Service Restarted Systemd Timers Anomaly
Linux Auditd Service Started Service Execution Anomaly
Linux Auditd Setuid Using Chmod Utility Setuid and Setgid Anomaly
Linux Auditd Setuid Using Setcap Utility Setuid and Setgid TTP
Linux Auditd Shred Overwrite Command Data Destruction TTP
Linux Auditd Stop Services Service Stop Hunting
Linux Auditd Sudo Or Su Execution Sudo and Sudo Caching Anomaly
Linux Auditd Sysmon Service Stop Service Stop TTP
Linux Auditd System Network Configuration Discovery System Network Configuration Discovery Anomaly
Linux Auditd Unix Shell Configuration Modification Unix Shell Configuration Modification TTP
Linux Auditd Unload Module Via Modprobe Kernel Modules and Extensions TTP
Linux Auditd Virtual Disk File And Directory Discovery File and Directory Discovery Anomaly
Linux Auditd Whoami User Discovery System Owner/User Discovery Anomaly

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
Linux Auditd Add User Linux icon Linux linux:audit /var/log/audit/audit.log
Linux Auditd Execve Linux icon Linux linux:audit /var/log/audit/audit.log
Linux Auditd Path Linux icon Linux linux:audit /var/log/audit/audit.log
Linux Auditd Proctitle Linux icon Linux linux:audit /var/log/audit/audit.log
Linux Auditd Service Stop Linux icon Linux linux:audit /var/log/audit/audit.log
Linux Auditd Syscall Linux icon Linux linux:audit /var/log/audit/audit.log

References

Source: GitHub | Version: 1