Skip to content

Commit 2eb9c03

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3352 from splunk/auditd_detection_updates
auditd_detection_updates
2 parents f0d60a4 + 99871b5 commit 2eb9c03

File tree

93 files changed

+948
-765
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

93 files changed

+948
-765
lines changed

‎data_sources/linux_auditd_add_user.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Linux Auditd Add User
22
id: 30f79353-e1d2-4585-8735-1e0359559f3f
3-
version: 1
4-
date: '2024-08-08'
3+
version: 2
4+
date: '2025-02-20'
55
author: Teoderick Contreras, Splunk
66
description: Data source object for Linux Auditd Add User Type
7-
source: /var/log/audit/audit.log
8-
sourcetype: linux:audit
7+
source: auditd
8+
sourcetype: auditd
99
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux

‎data_sources/linux_auditd_execve.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Linux Auditd Execve
22
id: 9ef6364d-cc67-480e-8448-3306829a6a24
3-
version: 1
4-
date: '2024-08-08'
3+
version: 2
4+
date: '2025-02-20'
55
author: Teoderick Contreras, Splunk
66
description: Data source object for Linux Auditd Execve Type
7-
source: /var/log/audit/audit.log
8-
sourcetype: linux:audit
7+
source: auditd
8+
sourcetype: auditd
99
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux

‎data_sources/linux_auditd_path.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Linux Auditd Path
22
id: 3d86125c-0496-4a5a-aae3-0d355a4f3d7d
3-
version: 1
4-
date: '2024-08-08'
3+
version: 2
4+
date: '2025-02-20'
55
author: Teoderick Contreras, Splunk
66
description: Data source object for Linux Auditd Path Type
7-
source: /var/log/audit/audit.log
8-
sourcetype: linux:audit
7+
source: auditd
8+
sourcetype: auditd
99
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux

‎data_sources/linux_auditd_proctitle.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Linux Auditd Proctitle
22
id: 5a25984a-2789-400a-858b-d75c923e06b1
3-
version: 1
4-
date: '2024-08-08'
3+
version: 2
4+
date: '2025-02-20'
55
author: Teoderick Contreras, Splunk
66
description: Data source object for Linux Auditd Proctitle Type
7-
source: /var/log/audit/audit.log
8-
sourcetype: linux:audit
7+
source: auditd
8+
sourcetype: auditd
99
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux

‎data_sources/linux_auditd_service_stop.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Linux Auditd Service Stop
22
id: 0643483c-bc62-455c-8d6e-1630e5f0e00d
3-
version: 1
4-
date: '2024-08-08'
3+
version: 2
4+
date: '2025-02-20'
55
author: Teoderick Contreras, Splunk
66
description: Data source object for Linux Auditd Service Stop Type
7-
source: /var/log/audit/audit.log
8-
sourcetype: linux:audit
7+
source: auditd
8+
sourcetype: auditd
99
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux

‎data_sources/linux_auditd_syscall.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Linux Auditd Syscall
22
id: 4dff7047-0d43-4096-bb3f-b756c889bbad
3-
version: 1
4-
date: '2024-08-08'
3+
version: 2
4+
date: '2025-02-20'
55
author: Teoderick Contreras, Splunk
66
description: Data source object for Linux Auditd Syscall Type
7-
source: /var/log/audit/audit.log
8-
sourcetype: linux:audit
7+
source: auditd
8+
sourcetype: auditd
99
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
1010
supported_TA:
1111
- name: Splunk Add-on for Unix and Linux

‎detections/endpoint/any_powershell_downloadfile.yml‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Any Powershell DownloadFile
22
id: 1a93b7ea-7af7-11eb-adb5-acde48001122
3-
version: 11
4-
date: '2025-02-10'
3+
version: '12'
4+
date: '2025-02-24'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -71,18 +71,18 @@ rba:
7171
type: process_name
7272
tags:
7373
analytic_story:
74-
- Data Destruction
7574
- Ingress Tool Transfer
75+
- China-Nexus Threat Activity
76+
- Crypto Stealer
77+
- Hermetic Wiper
7678
- DarkCrystal RAT
77-
- PXA Stealer
78-
- Braodo Stealer
79-
- Phemedrone Stealer
80-
- Log4Shell CVE-2021-44228
8179
- Malicious PowerShell
82-
- Hermetic Wiper
83-
- Crypto Stealer
84-
- Nexus APT Threat Activity
8580
- Earth Estries
81+
- Phemedrone Stealer
82+
- Braodo Stealer
83+
- PXA Stealer
84+
- Data Destruction
85+
- Log4Shell CVE-2021-44228
8686
asset_type: Endpoint
8787
cve:
8888
- CVE-2021-44228
@@ -97,7 +97,6 @@ tags:
9797
tests:
9898
- name: True Positive Test
9999
attack_data:
100-
- data:
101-
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
100+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
102101
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
103102
sourcetype: XmlWinEventLog

‎detections/endpoint/detect_renamed_psexec.yml‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Renamed PSExec
22
id: 683e6196-b8e8-11eb-9a79-acde48001122
3-
version: 11
4-
date: '2025-02-10'
3+
version: '12'
4+
date: '2025-02-24'
55
author: Michael Haag, Splunk, Alex Oberkircher, Github Community
66
status: production
77
type: Hunting
@@ -39,18 +39,18 @@ references:
3939
- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
4040
tags:
4141
analytic_story:
42+
- China-Nexus Threat Activity
4243
- BlackByte Ransomware
44+
- HAFNIUM Group
4345
- DHS Report TA18-074A
44-
- DarkSide Ransomware
45-
- SamSam Ransomware
4646
- CISA AA22-320A
47-
- HAFNIUM Group
48-
- Sandworm Tools
47+
- DarkSide Ransomware
4948
- Active Directory Lateral Movement
50-
- Nexus APT Threat Activity
5149
- DarkGate Malware
52-
- Earth Estries
50+
- Sandworm Tools
5351
- Rhysida Ransomware
52+
- Earth Estries
53+
- SamSam Ransomware
5454
asset_type: Endpoint
5555
mitre_attack_id:
5656
- T1569.002
@@ -62,7 +62,6 @@ tags:
6262
tests:
6363
- name: True Positive Test
6464
attack_data:
65-
- data:
66-
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
65+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
6766
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
6867
sourcetype: XmlWinEventLog

‎detections/endpoint/detect_renamed_winrar.yml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Renamed WinRAR
22
id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
3-
version: 9
4-
date: '2025-02-10'
3+
version: '10'
4+
date: '2025-02-24'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -38,10 +38,10 @@ references:
3838
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
3939
tags:
4040
analytic_story:
41+
- China-Nexus Threat Activity
42+
- CISA AA22-277A
4143
- Collection and Staging
4244
- Earth Estries
43-
- Nexus APT Threat Activity
44-
- CISA AA22-277A
4545
asset_type: Endpoint
4646
mitre_attack_id:
4747
- T1560.001
@@ -53,7 +53,6 @@ tags:
5353
tests:
5454
- name: True Positive Test
5555
attack_data:
56-
- data:
57-
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
56+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
5857
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
5958
sourcetype: XmlWinEventLog

‎detections/endpoint/executables_or_script_creation_in_suspicious_path.yml‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Executables Or Script Creation In Suspicious Path
22
id: a7e3f0f0-ae42-11eb-b245-acde48001122
3-
version: 10
4-
date: '2025-01-27'
3+
version: '11'
4+
date: '2025-02-24'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -61,46 +61,46 @@ rba:
6161
type: file_name
6262
tags:
6363
analytic_story:
64-
- Chaos Ransomware
64+
- BlackByte Ransomware
65+
- Brute Ratel C4
6566
- Trickbot
6667
- Snake Keylogger
67-
- CISA AA23-347A
68-
- Industroyer2
69-
- WinDealer RAT
70-
- Qakbot
68+
- Graceful Wipe Out Attack
69+
- PlugX
70+
- Handala Wiper
71+
- Earth Estries
7172
- Warzone RAT
72-
- IcedID
7373
- ValleyRAT
74-
- Azorult
75-
- Handala Wiper
74+
- NjRAT
7675
- LockBit Ransomware
77-
- Meduza Stealer
78-
- Brute Ratel C4
76+
- Double Zero Destructor
77+
- Swift Slicer
78+
- DarkCrystal RAT
7979
- AsyncRAT
80-
- AcidPour
80+
- Volt Typhoon
81+
- Chaos Ransomware
82+
- Hermetic Wiper
8183
- Derusbi
82-
- DarkGate Malware
83-
- Graceful Wipe Out Attack
84-
- NjRAT
85-
- WhisperGate
86-
- Data Destruction
87-
- BlackByte Ransomware
84+
- XMRig
8885
- AgentTesla
89-
- Swift Slicer
86+
- WinDealer RAT
87+
- RedLine Stealer
88+
- Remcos
89+
- Rhysida Ransomware
90+
- China-Nexus Threat Activity
9091
- Crypto Stealer
91-
- Hermetic Wiper
92+
- Qakbot
93+
- IcedID
94+
- Meduza Stealer
95+
- AcidPour
9296
- MoonPeak
93-
- Double Zero Destructor
94-
- XMRig
95-
- PlugX
97+
- CISA AA23-347A
98+
- DarkGate Malware
99+
- Industroyer2
100+
- Azorult
101+
- Data Destruction
96102
- Amadey
97-
- DarkCrystal RAT
98-
- Remcos
99-
- Nexus APT Threat Activity
100-
- Earth Estries
101-
- Rhysida Ransomware
102-
- RedLine Stealer
103-
- Volt Typhoon
103+
- WhisperGate
104104
asset_type: Endpoint
105105
mitre_attack_id:
106106
- T1036

0 commit comments

Comments
 (0)