Browse Rules

Clear Linux System Logs [splunk-unix]

This use case would detect the alteration or removal of log files. Atomics T1070.003 Test #3 Atomics T1070.003 Test #5

Multiple Host logons [splunk-unix]

Use case looks for users who have logged into multiple hosts. -- Threat Actor Association: CL-STA-0043

Modify File Attributes [splunk-unix]

chattr changes the file attributes on a Linux file system. - Threat Actor Association: TeamTNT - Atomics T1222.002 Test #9

Suspicious Use of _dev_tcp [splunk-unix]

Detects suspicious command with /dev/tcp

Linux Auditd Auditd Daemon Abort

The following analytic detects the abnormal termination of the Linux audit daemon (auditd) by identifying DAEMON_ABORT events in audit logs. These terminations suggest a serious failure of the auditing subsystem, potentially due to resource exhaustion, corruption, or malicious interference. Unlike a clean shutdown, DAEMON_ABORT implies that audit logging may have been disabled without system administrator intent. Alerts should be generated on detection and correlated with DAEMON_START, DAEMON_EN

NIX Interactive Shell [splunk-unix]

This use case detects the creation of an interactive shell on a NIX host -- Software Association: Kinsing

Linux Auditd Auditd Daemon Start

The following analytic detects the (re)initialization of the Linux audit daemon (auditd) by identifying log entries of type DAEMON_START. This event indicates that the audit subsystem has resumed logging after being stopped or has started during system boot. While DAEMON_START may be expected during reboots or legitimate configuration changes, it can also signal attempts to re-enable audit logging after evasion, or restarts with modified or reduced rule sets. Monitoring this event in correlation

New Linux Service Started_Enabled [splunk-unix]

Looks for new services being started or configured to start on boot. This could be used for persistence - Threat Actor Association: TeamTNT

Potential SSH Authorized Key Overwrite [splunk-unix]

Potential overwrites of authorized_keys file for ssh. -- Threat Actor Association: TeamTNT

Multiple SSH Logins Across Different Machines [splunk-unix]

This rule looks for multiple SSH logins using password authentication type onto multiple servers within a period of time from same source IP. - Threat Actor Association: Lightbasin / UNC1945, Sandworm (UAC-0165), TeamTNT

Audit Rules Deleted Via Auditctl

Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.

Kubernetes Update Pod Configuration [splunk-unix]

This use case looks for when a pod configuration has been modified with kubectl-edit, scale, autoscale, or replace.

Linux CURL or WGET Direct to IPv4 Address [splunk-unix]

This rule looks for endpoint logs that contain a CURL or WGET command inside of the process line that try and connect directly to an IP address. This use case was originally created in response to CVE-2021-44228. -- Software Association: TeamTNT

Kubernetes Enumeration [splunk-unix]

This use case looks for when the Kubectl get command has been executed. -- Threat Actor Association: TeamTNT -- Atomics T1053.007 Test#1

SSH Brute Force detection [splunk-unix]

Detect possible brute force attempts using SSH in Unix. - Threat Actor Association: 8220 Gang, Daixin Team, Lancefly, Sandworm (UAC-0165)

Linux Auditd Auditd Daemon Shutdown

The following analytic detects the unexpected termination of the Linux Audit daemon (auditd) by monitoring for log entries of type DAEMON_END. This event signifies that the audit logging service has stopped, either due to a legitimate system shutdown, manual administrative action, or potentially malicious tampering. Since auditd is responsible for recording critical security events, its sudden stoppage may indicate an attempt to disable security monitoring or evade detection during an attack. Th

SSH Pivoting [splunk-unix]

This use case is searching for specific keywords that are generated when SSH pivoting is made - Threat Actor Association: Daixin Team, Lightbasin / UNC1945, TeamTNT

Web: Potential file transfer using SCP [splunk-unix]

This use case is searching for specific keywords that are generated when a SCP file transfer - Threat Actor Association: Lazarus

Hidden Executable with Command Line IP Argument - *nix [splunk-unix]

This use case detects when a hidden executable (any process name starting with .) is supplied with a command line argument containing an IP address.

Csplit_Split Small Data Staged for Exfil [splunk-unix]

Identify use of csplit or split, in order to chunk web server data into smaller files for later exfiltration. Atomics T1030 Test #1

File Execution (Unix) [splunk-unix]

Detect when a file has been executed -- Threat Actor Association: TeamTNT, Winnti Group - Software Association: Mélofée, Ransom Cartel -- Atomics T1548.003 Test#1 Atomics T1548.003 Test#2

Python Script with URL Argument - *nix [splunk-unix]

This use case detects when a URL is supplied to an argument to a Python script in suspicious locations (/Users/, /tmp/, /var/tmp/, or /private/tmp/) via the command line.

Attempt to Disable Auditd Service

Adversaries may attempt to disable the Auditd service to evade detection. Auditd is a Linux service that provides system auditing and logging. Disabling the Auditd service can prevent the system from logging important security events, which can be used to detect malicious activity.

Linux Kernel Module Commands [splunk-unix]

Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Atomics T1014 Test #1 Atomics T1014 Test #2 Atomics T1547.006 Test#1

Python module loaded [splunk-unix]

This use case detects when a Python module and possible destination port has been executed in the command line. Adversaries may abuse Python commands and scripts for execution. Atomic Test T1048.003 Test #1