Splunk Add-on for Sysmon for Linux is archived on Splunkbase #4306

Splunkbase TA: Splunk Add-on for Sysmon for Linux

This archived Splunkbase TA is referenced by data source objects used by detections.

Data source objects and detections

• Sysmon for Linux EventID 1
  • Detection: Curl Execution with Percent Encoded URL
  • Detection: File Download or Read to Pipe Execution
  • Detection: Linux Add User Account
  • Detection: Linux Apparmor Bypass Via Aaexec
  • Detection: Linux APT Privilege Escalation
  • Detection: Linux At Application Execution
  • Detection: Linux AWK Privilege Escalation
  • Detection: Linux Binary Executed from Shared Memory Directory
  • Detection: Linux Busybox Privilege Escalation
  • Detection: Linux c89 Privilege Escalation
  • Detection: Linux c99 Privilege Escalation
  • Detection: Linux Change File Owner To Root
  • Detection: Linux Clipboard Data Copy
  • Detection: Linux Common Process For Elevation Control
  • Detection: Linux Composer Privilege Escalation
  • Detection: Linux Cpulimit Privilege Escalation
  • Detection: Linux Crontab Enumeration
  • Detection: Linux Csvtool Privilege Escalation
  • Detection: Linux Curl Upload File
  • Detection: Linux Data Destruction Command
  • Detection: Linux DD File Overwrite
  • Detection: Linux Decode Base64 to Shell
  • Detection: Linux Deleting Critical Directory Using RM Command
  • Detection: Linux Disable Services
  • Detection: Linux Doas Tool Execution
  • Detection: Linux Docker Root Directory Mount
  • Detection: Linux Docker Shell Execution
  • Detection: Linux Edit Cron Table Parameter
  • Detection: Linux Emacs Privilege Escalation
  • Detection: Linux Find Privilege Escalation
  • Detection: Linux GDB Privilege Escalation
  • Detection: Linux Gdrive Binary Activity
  • Detection: Linux Gem Privilege Escalation
  • Detection: Linux Ghostscript Exploitation
  • Detection: Linux GNU Awk Privilege Escalation
  • Detection: Linux Hardware Addition SwapOff
  • Detection: Linux Impair Defenses Process Kill
  • Detection: Linux Indicator Removal Clear Cache
  • Detection: Linux Indicator Removal Service File Deletion
  • Detection: Linux Ingress Tool Transfer Hunting
  • Detection: Linux Ingress Tool Transfer with Curl
  • Detection: Linux Insert Kernel Module Using Insmod Utility
  • Detection: Linux Install Kernel Module Using Modprobe Utility
  • Detection: Linux Iptables Firewall Modification
  • Detection: Linux Kernel Module Enumeration
  • Detection: Linux Kworker Process In Writable Process Path
  • Detection: Linux Make Privilege Escalation
  • Detection: Linux MySQL Privilege Escalation
  • Detection: Linux Ngrok Reverse Proxy Usage
  • Detection: Linux Node Privilege Escalation
  • Detection: Linux NOPASSWD Entry In Sudoers File
  • Detection: Linux Obfuscated Files or Information Base64 Decode
  • Detection: Linux Octave Privilege Escalation
  • Detection: Linux OpenVPN Privilege Escalation
  • Detection: Linux PHP Privilege Escalation
  • Detection: Linux pkexec Privilege Escalation
  • Detection: Linux Possible Access Or Modification Of sshd Config File
  • Detection: Linux Possible Access To Credential Files
  • Detection: Linux Possible Access To Sudoers File
  • Detection: Linux Possible Append Command To At Allow Config File
  • Detection: Linux Possible Append Command To Profile Config File
  • Detection: Linux Possible Append Cronjob Entry on Existing Cronjob File
  • Detection: Linux Possible Bootloader Modification
  • Detection: Linux Possible Cronjob Modification With Editor
  • Detection: Linux Possible GSM Privilege Escalation
  • Detection: Linux Possible Nimbuspwn Privilege Escalation
  • Detection: Linux Preload Hijack Library Calls
  • Detection: Linux Proxy Socks Curl
  • Detection: Linux Puppet Privilege Escalation
  • Detection: Linux Root Execution of id
  • Detection: Linux RPM Privilege Escalation
  • Detection: Linux Ruby Privilege Escalation
  • Detection: Linux Service Restarted
  • Detection: Linux Service Started Or Enabled
  • Detection: Linux Setuid Using Chmod Utility
  • Detection: Linux Setuid Using Setcap Utility
  • Detection: Linux Shell History Access Via Command Line Utility
  • Detection: Linux Shell Pseudo Device Reverse Shell
  • Detection: Linux Shred Overwrite Command
  • Detection: Linux Sqlite3 Privilege Escalation
  • Detection: Linux SSH Authorized Keys Modification
  • Detection: Linux SSH Remote Services Script Execute
  • Detection: Linux Stdout Redirection To Dev Null File
  • Detection: Linux Stop Services
  • Detection: Linux Sudo OR Su Execution
  • Detection: Linux Suspicious Child Process of PostgreSQL
  • Detection: Linux Suspicious Docker Build Command Execution
  • Detection: Linux Suspicious GCC Invocation Building Init Shared Object
  • Detection: Linux Suspicious Namespace Creation
  • Detection: Linux Suspicious Privileged Container Execution
  • Detection: Linux Suspicious React or Next.js Child Process
  • Detection: Linux Suspicious Redis Activity
  • Detection: Linux System Network Discovery
  • Detection: Linux System Reboot Via System Request Key
  • Detection: Linux Telnet Authentication Bypass
  • Detection: Linux Unix Shell Enable All SysRq Functions
  • Detection: Linux Usermod Root UID Set
  • Detection: Linux Visudo Utility Execution
  • Detection: Socat Network Listener Binding an Executable
  • Detection: Socat Remote TCP Connection with Local Echo Disabled
  • Detection: Suspicious Curl Network Connection
  • Detection: Suspicious Linux Discovery Commands
  • Detection: Web or Application Server Spawning a Shell
• Sysmon for Linux EventID 11
  • Detection: GitHub Workflow File Creation or Modification
  • Detection: Linux Account Manipulation Of SSH Config and Keys
  • Detection: Linux Add Files In Known Crontab Directories
  • Detection: Linux At Allow Config File Creation
  • Detection: Linux Deletion Of Cron Jobs
  • Detection: Linux Deletion Of Init Daemon Script
  • Detection: Linux Deletion Of Services
  • Detection: Linux Deletion of SSL Certificate
  • Detection: Linux Doas Conf File Creation
  • Detection: Linux EFI Bootloader File Deletion
  • Detection: Linux File Created In Kernel Driver Directory
  • Detection: Linux File Creation In Init Boot Directory
  • Detection: Linux File Creation In Profile Directory
  • Detection: Linux File Creation In System Generator Directory
  • Detection: Linux High Frequency Of File Deletion In Boot Folder
  • Detection: Linux High Frequency Of File Deletion In Etc Folder
  • Detection: Linux Medusa Rootkit
  • Detection: Linux MOTD Script Added
  • Detection: Linux Possible Privilege Escalation via PYTHONPATH
  • Detection: Linux Possible Ssh Key File Creation
  • Detection: Linux Possible System Binary Backdoor
  • Detection: Linux Service File Created In Systemd Directory
  • Detection: Linux Sudoers Tmp File Creation
  • Detection: Linux Suspicious Staging of Alternate System Files
  • Detection: Linux Suspicious XDG Autostart
  • Detection: Linux UDEV Rule Created
  • Detection: Shai-Hulud 2 Exfiltration Artifact Files
  • Detection: Shai-Hulud Workflow File Creation or Modification
• Sysmon for Linux EventID 3
  • Detection: Linux Netcat Outbound Connection

This issue is maintained automatically by the archived TA daily workflow.