Linux Exploitation Tools

detections/endpoint/suspicious_linux_discovery_commands.yml

@@ -0,0 +1,59 @@
+name: Suspicious Linux Discovery Commands
+id: 0edd5112-56c9-11ec-b990-acde48001122
+version: 1
+date: '2021-12-06'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\
+
+  The search logic specifically looks for high number of distinct commands run in a short period of time. 
+search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
+  Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
+known_false_positives: Unless an administrator is using these commands to troubleshoot
+  or audit a system, the execution of these commands should be monitored.
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+- https://attack.mitre.org/techniques/T1059/004/
+- https://github.com/IvanGlinkin/AutoSUID
+- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
+- https://github.com/rebootuser/LinEnum
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Suspicious Linux Discovery Commands detected on $dest$
+  mitre_attack_id:
+  - T1059.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.user 
+  - Processes.process_name
+  risk_score: 81
+  security_domain: endpoint

lookups/linux_tool_discovery_process.csv

@@ -0,0 +1,61 @@
+process
+cat /proc/version
+cat /etc/*-release
+/etc/passwd 
+cat /etc/*
+lastlog 
+id
+PermitRootLogin
+sestatus *
+ps
+mysql*
+netstat*
+find *
+head /var/mail/root
+docker
+cat /etc/issue
+cat /etc/*-release
+cat /proc/version
+uname -a
+uname -mrs
+rpm -q kernel
+dmesg | grep Linux
+ls /boot | grep vmlinuz-
+cat /etc/profile
+cat /etc/bashrc
+cat ~/.bash_profile
+cat ~/.bashrc
+cat ~/.bash_logout
+ps -aux | grep root
+ps -ef | grep root
+crontab -l
+cat /etc/cron*
+cat /etc/cron.allow
+cat /etc/cron.deny
+cat /etc/crontab
+grep -i user *
+grep -i pass *
+ifconfig
+cat /etc/network/interfaces
+cat /etc/sysconfig/network
+cat /etc/resolv.conf
+cat /etc/networks
+cvelist-file:*
+exploit-db*
+strings -e /etc/apache2/apache2.conf
+strings -e /etc/ssh/sshd_config
+strings -e /etc/shadow
+iptables -L
+lsof -i
+netstat -antup
+netstat -antpx
+netstat -tulpn
+arp -e
+route
+cat /etc/passwd
+cat /etc/group
+cat /etc/shadow
+find / -perm -u=s
+find / -perm -g=s
+find / -perm -4000
+find / -perm -2000

lookups/linux_tool_discovery_process.yml

@@ -0,0 +1,7 @@
+description: A list of suspicious bash commonly used by attackers via scripts
+filename: linux_tool_discovery_process.csv
+name: linux_tool_discovery_process
+default_match: 'false'
+match_type: WILDCARD(process)
+min_matches: 1
+case_sensitive_match: 'false'

stories/linux_post_exploitation.yml

@@ -0,0 +1,19 @@
+name: Linux Post-Exploitation
+id: d310ccfe-5477-11ec-ad05-acde48001122
+version: 1
+date: '2021-12-03'
+author: Rod Soto
+description: This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.
+narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring

tests/endpoint/suspicious_linux_discovery_commands.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Linux Discovery Commands
+tests:
+- name: Suspicious Linux Discovery Commands
+  file: endpoint/suspicious_linux_discovery_commands.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-60d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux