linux_auditd_service_started.yml

name: Linux Auditd Service Started
id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a
version: 4
date: '2025-02-03'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the suspicious service started. This behavior
  is critical for a SOC to monitor because it may indicate attempts to gain unauthorized
  access or maintain control over a system. Such actions could be signs of malicious
  activity. If confirmed, this could lead to serious consequences, including a compromised
  system, unauthorized access to sensitive data, or even a wider breach affecting
  the entire network. Detecting and responding to these signs early is essential to
  prevent potential security incidents.
data_source:
- Linux Auditd Proctitle
search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host
  as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service
  %") ) AND(LIKE(process_exec, "% start %") OR LIKE(process_exec, "% enable %")) |
  stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle
  normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
  `linux_auditd_service_started_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
  data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
  executions and process details on Unix/Linux systems. These logs should be ingested
  and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
  which is essential for correctly parsing and categorizing the data. The next step
  involves normalizing the field names  to match the field names set by the Splunk
  Common Information Model (CIM) to ensure consistency across different data sources
  and enhance the efficiency of data modeling. This approach enables effective monitoring
  and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application
  for automation purposes. Please update the filter macros to remove false positives.
references:
- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
drilldown_searches:
- name: View the detection results for - "$dest$"
  search: '%original_detection_search% | search  dest = "$dest$"'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
rba:
  message: A [$process_exec$] event occurred on host - [$dest$] to start or enable
    a service.
  risk_objects:
  - field: dest
    type: system
    score: 40
  threat_objects: []
tags:
  analytic_story:
  - Linux Living Off The Land
  - Linux Privilege Escalation
  - Linux Persistence Techniques
  - Compromised Linux Host
  asset_type: Endpoint
  mitre_attack_id:
  - T1569.002
  - T1569
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/linux_service_start/linux_service_start.log
    source: /var/log/audit/audit.log
    sourcetype: linux:audit