Skip to content

Commit 9b112ca

Browse files
patel-bhavinpatel-bhavin
authored
Merge branch 'develop' into output_normalization_aws
2 parents 1f34478 + 9c3fd5d commit 9b112ca

File tree

33 files changed

+1017
-123
lines changed

33 files changed

+1017
-123
lines changed

‎data_sources/windows_event_log_security_4700.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Windows Event Log Security 4700
2+
id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde
3+
version: 1
4+
date: '2025-03-11'
5+
author: Steven Dick
6+
description: Data source object for Windows Event Log Security 4700
7+
source: XmlWinEventLog:Security
8+
sourcetype: xmlwineventlog
9+
separator: EventID
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- EventID
16+
example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event>'

‎data_sources/windows_event_log_security_4702.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Windows Event Log Security 4702
2+
id: 167e378e-3675-4042-b611-d3bfb6d2abc7
3+
version: 1
4+
date: '2025-03-11'
5+
author: Steven Dick
6+
description: Data source object for Windows Event Log Security 4702
7+
source: XmlWinEventLog:Security
8+
sourcetype: xmlwineventlog
9+
separator: EventID
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- EventID
16+
example_log: '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event>'

‎detections/cloud/o365_bec_email_hiding_rule_created.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: O365 BEC Email Hiding Rule Created
2+
id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
3+
version: 1
4+
date: '2025-02-14'
5+
author: '0xC0FFEEEE, Github Community'
6+
type: TTP
7+
status: production
8+
description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers.
9+
This may indicate that an attacker has gained access to the account.
10+
search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" |
11+
stats values(Name) as Name, values(MarkAsRead) as MarkAsRead, values(MoveToFolder)
12+
as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name | eval
13+
entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval
14+
read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder,
15+
"^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score
16+
| where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`'
17+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
18+
Office 365 management activity events. You also need to have the Splunk TA URL
19+
Toolbox (https://splunkbase.splunk.com/app/2734/) installed.
20+
known_false_positives: Short rule names may trigger false positives. Adjust
21+
the entropy and length thresholds as needed.
22+
references:
23+
- https://attack.mitre.org/techniques/T1564/008/
24+
drilldown_searches:
25+
- name: View the detection results for - "$user$"
26+
search: '%original_detection_search% | search dest = "$user$"'
27+
earliest_offset: $info_min_time$
28+
latest_offset: $info_max_time$
29+
- name: View risk events for the last 7 days for $user$
30+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
31+
earliest_offset: $info_min_time$
32+
latest_offset: $info_max_time$
33+
rba:
34+
message: Potential BEC mailbox rule was created by $user$
35+
risk_objects:
36+
- field: user
37+
type: user
38+
score: 25
39+
threat_objects:
40+
- field: Name
41+
type: signature
42+
tags:
43+
analytic_story:
44+
- Office 365 Account Takeover
45+
asset_type: O365 Tenant
46+
mitre_attack_id:
47+
- T1564.008
48+
product:
49+
- Splunk Enterprise
50+
- Splunk Enterprise Security
51+
- Splunk Cloud
52+
security_domain: audit
53+
tests:
54+
- name: True Positive Test
55+
attack_data:
56+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.008/o365/o365_suspicious_mailbox_rule.log
57+
sourcetype: o365:management:activity
58+
source: o365

‎detections/endpoint/detect_rare_executables.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Rare Executables
22
id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
3-
version: 7
4-
date: '2024-11-13'
3+
version: '8'
4+
date: '2025-02-07'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: Anomaly
@@ -58,9 +58,12 @@ rba:
5858
threat_objects: []
5959
tags:
6060
analytic_story:
61-
- Unusual Processes
61+
- SnappyBee
6262
- Rhysida Ransomware
63+
- China-Nexus Threat Activity
6364
- Crypto Stealer
65+
- Earth Estries
66+
- Unusual Processes
6467
asset_type: Endpoint
6568
mitre_attack_id:
6669
- T1204
@@ -72,7 +75,6 @@ tags:
7275
tests:
7376
- name: True Positive Test
7477
attack_data:
75-
- data:
76-
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/rare_executables/windows-sysmon.log
78+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/rare_executables/windows-sysmon.log
7779
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
7880
sourcetype: XmlWinEventLog

‎detections/endpoint/executables_or_script_creation_in_suspicious_path.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,14 @@ description: The following analytic identifies the creation of executables or sc
1515
a significant security threat.
1616
data_source:
1717
- Sysmon EventID 11
18-
search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as
19-
file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
20-
where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe",
21-
"*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*",
22-
"*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*",
23-
"*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*",
24-
"*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*")
18+
search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
19+
where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif")
20+
AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*",
21+
"*\\Windows\\repair\\*", "*\\PerfLogs\\*") AND NOT(Filesystem.file_path IN("*\\temp\\*"))
2522
by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user
26-
| `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `drop_dm_object_name(Filesystem)`
24+
| `security_content_ctime(firstTime)`
25+
| `security_content_ctime(lastTime)`
2726
| `executables_or_script_creation_in_suspicious_path_filter`'
2827
how_to_implement: To successfully implement this search you need to be ingesting information
2928
on process that include the name of the Filesystem responsible for the changes from
@@ -100,6 +99,7 @@ tags:
10099
- Azorult
101100
- Data Destruction
102101
- Amadey
102+
- SnappyBee
103103
- WhisperGate
104104
asset_type: Endpoint
105105
mitre_attack_id:
@@ -112,6 +112,6 @@ tags:
112112
tests:
113113
- name: True Positive Test
114114
attack_data:
115-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
115+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2.log
116116
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
117117
sourcetype: XmlWinEventLog

‎detections/endpoint/executables_or_script_creation_in_temp_path.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Executables Or Script Creation In Temp Path
2+
id: e0422b71-2c05-4f32-8754-01fb415f49c9
3+
version: 11
4+
date: '2025-02-11'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic identifies the creation of executables or scripts
9+
in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem
10+
data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created
11+
in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is
12+
significant as adversaries often use these paths to evade detection and maintain
13+
persistence. If confirmed malicious, this behavior could allow attackers to execute
14+
unauthorized code, escalate privileges, or persist within the environment, posing
15+
a significant security threat.
16+
data_source:
17+
- Sysmon EventID 11
18+
search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
19+
where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif")
20+
AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*:\\Windows\\Temp\\*", "*:\\Temp*")
21+
by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user
22+
| `drop_dm_object_name(Filesystem)`
23+
| `security_content_ctime(firstTime)`
24+
| `security_content_ctime(lastTime)`
25+
| `executables_or_script_creation_in_temp_path_filter`'
26+
how_to_implement: To successfully implement this search you need to be ingesting information
27+
on process that include the name of the Filesystem responsible for the changes from
28+
your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
29+
known_false_positives: Administrators may allow creation of script or exe in the paths
30+
specified. Filter as needed.
31+
references:
32+
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
33+
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
34+
- https://twitter.com/pr0xylife/status/1590394227758104576
35+
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
36+
drilldown_searches:
37+
- name: View the detection results for - "$user$"
38+
search: '%original_detection_search% | search user = "$user$"'
39+
earliest_offset: $info_min_time$
40+
latest_offset: $info_max_time$
41+
- name: View risk events for the last 7 days for - "$user$"
42+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$")
43+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
44+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
45+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
46+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
47+
| `security_content_ctime(lastTime)`'
48+
earliest_offset: $info_min_time$
49+
latest_offset: $info_max_time$
50+
rba:
51+
message: Potentially suspicious executable or script with file name $file_name$, $file_path$
52+
and process_id $process_id$ was created in temporary folder by $user$
53+
risk_objects:
54+
- field: user
55+
type: user
56+
score: 20
57+
threat_objects:
58+
- field: file_name
59+
type: file_name
60+
tags:
61+
analytic_story:
62+
- Chaos Ransomware
63+
- Trickbot
64+
- Snake Keylogger
65+
- CISA AA23-347A
66+
- Industroyer2
67+
- WinDealer RAT
68+
- Qakbot
69+
- Warzone RAT
70+
- IcedID
71+
- ValleyRAT
72+
- Azorult
73+
- Handala Wiper
74+
- LockBit Ransomware
75+
- Meduza Stealer
76+
- Brute Ratel C4
77+
- AsyncRAT
78+
- AcidPour
79+
- Derusbi
80+
- DarkGate Malware
81+
- Graceful Wipe Out Attack
82+
- NjRAT
83+
- WhisperGate
84+
- Data Destruction
85+
- BlackByte Ransomware
86+
- AgentTesla
87+
- Swift Slicer
88+
- Crypto Stealer
89+
- Hermetic Wiper
90+
- MoonPeak
91+
- Double Zero Destructor
92+
- XMRig
93+
- PlugX
94+
- Amadey
95+
- DarkCrystal RAT
96+
- Remcos
97+
- China-Nexus Threat Activity
98+
- Earth Estries
99+
- Rhysida Ransomware
100+
- RedLine Stealer
101+
- Volt Typhoon
102+
- SnappyBee
103+
asset_type: Endpoint
104+
mitre_attack_id:
105+
- T1036
106+
product:
107+
- Splunk Enterprise
108+
- Splunk Enterprise Security
109+
- Splunk Cloud
110+
security_domain: endpoint
111+
tests:
112+
- name: True Positive Test
113+
attack_data:
114+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
115+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
116+
sourcetype: XmlWinEventLog

‎detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,12 @@ rba:
5858
threat_objects: []
5959
tags:
6060
analytic_story:
61-
- Linux Privilege Escalation
62-
- Linux Living Off The Land
63-
- Compromised Linux Host
61+
- China-Nexus Threat Activity
6462
- Linux Persistence Techniques
6563
- XorDDos
66-
- China-Nexus Threat Activity
64+
- Linux Privilege Escalation
65+
- Compromised Linux Host
66+
- Linux Living Off The Land
6767
- Earth Estries
6868
asset_type: Endpoint
6969
mitre_attack_id:
@@ -80,3 +80,4 @@ tests:
8080
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/auditd_proctitle_chmod.log
8181
source: auditd
8282
sourcetype: auditd
83+

‎detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,10 @@ rba:
5757
threat_objects: []
5858
tags:
5959
analytic_story:
60+
- China-Nexus Threat Activity
61+
- Linux Persistence Techniques
6062
- Linux Privilege Escalation
6163
- Compromised Linux Host
62-
- Linux Persistence Techniques
63-
- China-Nexus Threat Activity
6464
- Earth Estries
6565
asset_type: Endpoint
6666
mitre_attack_id:
@@ -77,3 +77,4 @@ tests:
7777
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd2.log
7878
source: auditd
7979
sourcetype: auditd
80+

‎detections/endpoint/linux_auditd_possible_access_to_credential_files.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,10 @@ rba:
5757
threat_objects: []
5858
tags:
5959
analytic_story:
60+
- China-Nexus Threat Activity
61+
- Linux Persistence Techniques
6062
- Linux Privilege Escalation
6163
- Compromised Linux Host
62-
- Linux Persistence Techniques
63-
- China-Nexus Threat Activity
6464
- Earth Estries
6565
asset_type: Endpoint
6666
mitre_attack_id:
@@ -76,3 +76,4 @@ tests:
7676
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log
7777
source: auditd
7878
sourcetype: auditd
79+

‎detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,10 @@ rba:
5656
threat_objects: []
5757
tags:
5858
analytic_story:
59+
- China-Nexus Threat Activity
60+
- Linux Persistence Techniques
5961
- Linux Privilege Escalation
6062
- Compromised Linux Host
61-
- Linux Persistence Techniques
62-
- China-Nexus Threat Activity
6363
- Earth Estries
6464
asset_type: Endpoint
6565
mitre_attack_id:
@@ -76,3 +76,4 @@ tests:
7676
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log
7777
source: auditd
7878
sourcetype: auditd
79+

0 commit comments

Comments
 (0)