linux_post-exploitation.md

title	Linux Post-Exploitation
last_modified_at	2021-12-03
toc	true
toc_label
tags	Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This analytic story detects popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-12-03
• Author: Rod Soto
• ID: d310ccfe-5477-11ec-ad05-acde48001122

Narrative

These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.

Detections

Name	Technique	Type
Detect AutoSUID post exploitation tool	Permission Groups Discovery, File and Directory Permissions Modification	TTP
Detect LinEnum execution	Account Discovery, Permission Groups Discovery, File and Directory Discovery, Process Discovery, Software Discovery, System Information Discovery, System Network Configuration Discovery, System Owner/User Discovery	TTP
Detect LinPeas Execution	System Information Discovery, File and Directory Discovery, System Owner/User Discovery, Account Discovery, Network Service Scanning, Process Discovery, Software Discovery, System Owner/User Discovery	TTP
Detect Linux Exploit Suggester Execution	Account Discovery, File and Directory Discovery, Permission Groups Discovery, Process Discovery, Software Discovery, System Information Discovery	TTP
Detect MimiPenguin	Unsecured Credentials	TTP

Reference

• https://attack.mitre.org/matrices/enterprise/linux/

source | version: 1