Splunk unknown stable spl

Linux Medusa Rootkit

This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. These files typically facilitate process hiding, credential theft, and backdoor access. Monitoring for such file creation patterns enables early detection of rootkit deployment before full compromise.

View Source

Detection Logic

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
FROM datamodel=Endpoint.Filesystem
  
WHERE Filesystem.file_path IN ("*/lib/libseconf", "*.backup_ld.so", "*.boot.sh", "*.logpam", "*sshpass.txt", "*sshpass2.txt", "*/lib/libdsx.so", "*rkload", "*/lib/libseconf/local.txt", "*/lib/locate/local.txt", "*/var/log/remote.txt", "*/lib/libseconf/.pts", "*/lib/locate /.pts", "*/libseconf/.ports")
  BY Filesystem.action Filesystem.dest Filesystem.file_access_time
     Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
     Filesystem.file_name Filesystem.file_path Filesystem.file_acl
     Filesystem.file_size Filesystem.process_guid Filesystem.process_id
     Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `linux_medusa_rootkit_filter`

False Positives

⚠ Little to no false positives in most environments. Tune as needed.

Field Validations

Loading…

Comments (0)

Loading comments...