Skip to content

Commit 731df60

Browse files
nasbenchnasbench
authored
fix auditd PATH type detections (#3810)
--------- Co-authored-by: Nasreddine Bencherchali <[email protected]>
2 parents 064cbae + d8ddca1 commit 731df60

8 files changed

+541
-324
lines changed

‎data_sources/linux_auditd_cwd.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Linux Auditd Cwd
2+
id: a9ef851b-d864-478b-b1b3-76535d7ff7fc
3+
version: 1
4+
date: '2025-12-02'
5+
author: Nasreddine Bencherchali, Splunk
6+
description: This type is used to record the working directory from which the process that invoked the system call specified in the first record was executed. The purpose of this record is to record the current process's location in case a relative path winds up being captured in the associated PATH record. This way the absolute path can be reconstructed.
7+
source: auditd
8+
sourcetype: auditd
9+
separator: type
10+
separator_value: CWD
11+
configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
12+
supported_TA:
13+
- name: Splunk Add-on for Unix and Linux
14+
url: https://splunkbase.splunk.com/app/833
15+
version: 10.2.0
16+
fields:
17+
- cwd
18+
- date_hour
19+
- date_mday
20+
- date_minute
21+
- date_month
22+
- date_second
23+
- msg
24+
- type
25+
example_log: 'type=CWD msg=audit(11/20/2025 16:57:48.909:110027) : cwd=/etc/ssh'

‎detections/endpoint/linux_auditd_doas_conf_file_creation.yml‎

Lines changed: 84 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,78 +1,110 @@
11
name: Linux Auditd Doas Conf File Creation
22
id: 61059783-574b-40d2-ac2f-69b898afd6b4
3-
version: 7
4-
date: '2025-06-10'
5-
author: Teoderick Contreras, Splunk
3+
version: 8
4+
date: '2025-11-27'
5+
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
66
status: production
77
type: TTP
8-
description: The following analytic detects the creation of the doas.conf file on
9-
a Linux host. This file is used by the doas utility to allow standard users to perform
10-
tasks as root, similar to sudo. The detection leverages Linux Auditd data, focusing
11-
on the creation of the doas.conf file. This activity is significant because it can
12-
indicate an attempt to gain elevated privileges, potentially by an adversary. If
13-
confirmed malicious, this could allow an attacker to execute commands with root
14-
commands with root privileges, leading to full system compromise.
8+
description: |
9+
The following analytic detects the creation of the doas.conf file on a Linux host.
10+
This file is used by the doas utility to allow standard users to perform tasks as root, similar to sudo.
11+
The detection leverages Linux Auditd data, focusing on the creation of the doas.conf file.
12+
This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root commands with root privileges, leading to full system compromise.
1513
data_source:
16-
- Linux Auditd Path
17-
search: '`linux_auditd` type=PATH name ="/etc/doas.conf*"
18-
| rename host as dest
19-
| stats count min(_time) as firstTime max(_time) as lastTime
20-
by name nametype ogid type dest
14+
- Linux Auditd Path
15+
- Linux Auditd Cwd
16+
search: |
17+
`linux_auditd`
18+
(
19+
(type=PATH nametype="CREATE")
20+
OR
21+
type=CWD
22+
)
23+
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
24+
25+
| stats
26+
values(type) as types
27+
values(name) as names
28+
values(nametype) as nametype
29+
values(cwd) as cwd_list
30+
values(_time) as event_times
31+
by audit_id host
32+
33+
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
34+
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
35+
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/doas.conf.*"))
36+
| eval match_count = mvcount(matched_paths)
37+
| eval reconstructed_path = mvindex(matched_paths, 0)
38+
| eval e_time = mvindex(event_times, 0)
39+
| where match_count > 0
40+
| rename host as dest
41+
42+
| stats count min(e_time) as firstTime max(e_time) as lastTime
43+
values(nametype) as nametype
44+
by current_working_directory
45+
reconstructed_path
46+
match_count
47+
dest
48+
audit_id
49+
2150
| `security_content_ctime(firstTime)`
2251
| `security_content_ctime(lastTime)`
23-
| `linux_auditd_doas_conf_file_creation_filter`'
24-
how_to_implement: To implement this detection, the process begins by ingesting auditd
52+
| table nametype current_working_directory reconstructed_path dest audit_id match_count firstTime lastTime
53+
| `linux_auditd_doas_conf_file_creation_filter`
54+
how_to_implement: |
55+
To implement this detection, the process begins by ingesting auditd
2556
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
2657
executions and process details on Unix/Linux systems. These logs should be ingested
2758
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
2859
which is essential for correctly parsing and categorizing the data. The next step
2960
involves normalizing the field names to match the field names set by the Splunk
3061
Common Information Model (CIM) to ensure consistency across different data sources
31-
and enhance the efficiency of data modeling. This approach enables effective monitoring
32-
and detection of linux endpoints where auditd is deployed
33-
known_false_positives: Administrator or network operator can execute this command.
62+
and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
63+
This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
64+
known_false_positives: |
65+
Administrator or network operator can execute this command.
3466
Please update the filter macros to remove false positives.
3567
references:
36-
- https://wiki.gentoo.org/wiki/Doas
37-
- https://www.makeuseof.com/how-to-install-and-use-doas/
68+
- https://wiki.gentoo.org/wiki/Doas
69+
- https://www.makeuseof.com/how-to-install-and-use-doas/
3870
drilldown_searches:
39-
- name: View the detection results for - "$dest$"
40-
search: '%original_detection_search% | search dest = "$dest$"'
41-
earliest_offset: $info_min_time$
42-
latest_offset: $info_max_time$
43-
- name: View risk events for the last 7 days for - "$dest$"
44-
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
45-
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
46-
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
47-
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
48-
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
49-
| `security_content_ctime(lastTime)`'
50-
earliest_offset: $info_min_time$
51-
latest_offset: $info_max_time$
71+
- name: View the detection results for - "$dest$"
72+
search: '%original_detection_search% | search dest = "$dest$"'
73+
earliest_offset: $info_min_time$
74+
latest_offset: $info_max_time$
75+
- name: View risk events for the last 7 days for - "$dest$"
76+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
77+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
78+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
79+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
80+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
81+
| `security_content_ctime(lastTime)`'
82+
earliest_offset: $info_min_time$
83+
latest_offset: $info_max_time$
5284
rba:
53-
message: A [$type$] event occurred on host - [$dest$] to create a doas.conf file.
85+
message: A $reconstructed_path$ file was created on host - [$dest$]
5486
risk_objects:
55-
- field: dest
56-
type: system
57-
score: 64
87+
- field: dest
88+
type: system
89+
score: 64
5890
threat_objects: []
5991
tags:
6092
analytic_story:
61-
- Linux Privilege Escalation
62-
- Linux Persistence Techniques
63-
- Compromised Linux Host
93+
- Linux Privilege Escalation
94+
- Linux Persistence Techniques
95+
- Compromised Linux Host
6496
asset_type: Endpoint
6597
mitre_attack_id:
66-
- T1548.003
98+
- T1548.003
6799
product:
68-
- Splunk Enterprise
69-
- Splunk Enterprise Security
70-
- Splunk Cloud
100+
- Splunk Enterprise
101+
- Splunk Enterprise Security
102+
- Splunk Cloud
71103
security_domain: endpoint
72104
tests:
73-
- name: True Positive Test
74-
attack_data:
75-
- data:
76-
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_path_doas_config.log
77-
source: auditd
78-
sourcetype: auditd
105+
- name: True Positive Test
106+
attack_data:
107+
- data:
108+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/path_doas.log
109+
source: auditd
110+
sourcetype: auditd

‎detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml‎

Lines changed: 85 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,111 @@
11
name: Linux Auditd Possible Access Or Modification Of Sshd Config File
22
id: acb3ea33-70f7-47aa-b335-643b3aebcb2f
3-
version: 7
4-
date: '2025-06-10'
5-
author: Teoderick Contreras, Splunk
3+
version: 8
4+
date: '2025-11-27'
5+
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
8-
description: The following analytic detects suspicious access or modification of the
9-
sshd_config file on Linux systems. It leverages data from Linux Auditd, focusing
10-
on command-line executions involving processes like "cat," "nano," "vim," and "vi"
11-
accessing the sshd_config file. This activity is significant because unauthorized
12-
changes to sshd_config can allow threat actors to redirect port connections or use
13-
unauthorized keys, potentially compromising the system. If confirmed malicious,
14-
this could lead to unauthorized access, privilege escalation, or persistent backdoor
15-
access, posing a severe security risk.
8+
description: |
9+
The following analytic detects access, deletion or modification of the ssh_config file on Linux systems.
10+
It leverages data from Linux Auditd, focusing on events of type PATH with a nametype of ("NORMAL", "CREATE", "DELETE").
11+
This activity could be significant because unauthorized changes to ssh_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system.
12+
Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
13+
If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk.
1614
data_source:
17-
- Linux Auditd Path
18-
search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*"
15+
- Linux Auditd Path
16+
- Linux Auditd Cwd
17+
search: |
18+
`linux_auditd`
19+
(
20+
(type=PATH nametype IN ("NORMAL", "CREATE", "DELETE"))
21+
OR
22+
type=CWD
23+
)
24+
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
25+
26+
| stats
27+
values(type) as types
28+
values(name) as names
29+
values(nametype) as nametype
30+
values(cwd) as cwd_list
31+
values(_time) as event_times
32+
by audit_id, host
33+
34+
| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
35+
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
36+
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/ssh/ssh_config.*"))
37+
| eval match_count = mvcount(matched_paths)
38+
| eval reconstructed_path = mvindex(matched_paths, 0)
39+
| eval e_time = mvindex(event_times, 0)
40+
| where match_count > 0
1941
| rename host as dest
20-
| stats count min(_time) as firstTime max(_time) as lastTime
21-
by name nametype ogid type dest
42+
43+
| stats count min(e_time) as firstTime max(e_time) as lastTime
44+
values(nametype) as nametype
45+
by current_working_directory
46+
reconstructed_path
47+
match_count
48+
dest
49+
audit_id
50+
2251
| `security_content_ctime(firstTime)`
2352
| `security_content_ctime(lastTime)`
24-
| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`'
25-
how_to_implement: To implement this detection, the process begins by ingesting auditd
53+
| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`
54+
how_to_implement: |
55+
To implement this detection, the process begins by ingesting auditd
2656
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
2757
executions and process details on Unix/Linux systems. These logs should be ingested
2858
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
2959
which is essential for correctly parsing and categorizing the data. The next step
3060
involves normalizing the field names to match the field names set by the Splunk
3161
Common Information Model (CIM) to ensure consistency across different data sources
32-
and enhance the efficiency of data modeling. This approach enables effective monitoring
33-
and detection of linux endpoints where auditd is deployed
34-
known_false_positives: Administrator or network operator can use this commandline
35-
for automation purposes. Please update the filter macros to remove false positives.
62+
and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
63+
This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
64+
known_false_positives: |
65+
Administrator or network operator can use this commandline for automation purposes.
66+
Please update the filter macros to remove false positives.
3667
references:
37-
- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
38-
- https://attack.mitre.org/techniques/T1098/004/
68+
- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
69+
- https://attack.mitre.org/techniques/T1098/004/
3970
drilldown_searches:
40-
- name: View the detection results for - "$dest$"
41-
search: '%original_detection_search% | search dest = "$dest$"'
42-
earliest_offset: $info_min_time$
43-
latest_offset: $info_max_time$
44-
- name: View risk events for the last 7 days for - "$dest$"
45-
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
46-
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
47-
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
48-
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
49-
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
50-
| `security_content_ctime(lastTime)`'
51-
earliest_offset: $info_min_time$
52-
latest_offset: $info_max_time$
71+
- name: View the detection results for - "$dest$"
72+
search: '%original_detection_search% | search dest = "$dest$"'
73+
earliest_offset: $info_min_time$
74+
latest_offset: $info_max_time$
75+
- name: View risk events for the last 7 days for - "$dest$"
76+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
77+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
78+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
79+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
80+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
81+
| `security_content_ctime(lastTime)`'
82+
earliest_offset: $info_min_time$
83+
latest_offset: $info_max_time$
5384
rba:
54-
message: A [$type$] has been accessed/modified on host - [$dest$] to modify the
55-
sshd_config file.
85+
message: $reconstructed_path$ has been accessed with type $nametype$ on host - [$dest$]
5686
risk_objects:
57-
- field: dest
58-
type: system
59-
score: 25
87+
- field: dest
88+
type: system
89+
score: 25
6090
threat_objects: []
6191
tags:
6292
analytic_story:
63-
- Linux Living Off The Land
64-
- Linux Privilege Escalation
65-
- Linux Persistence Techniques
66-
- Compromised Linux Host
93+
- Linux Living Off The Land
94+
- Linux Privilege Escalation
95+
- Linux Persistence Techniques
96+
- Compromised Linux Host
6797
asset_type: Endpoint
6898
mitre_attack_id:
69-
- T1098.004
99+
- T1098.004
70100
product:
71-
- Splunk Enterprise
72-
- Splunk Enterprise Security
73-
- Splunk Cloud
101+
- Splunk Enterprise
102+
- Splunk Enterprise Security
103+
- Splunk Cloud
74104
security_domain: endpoint
75105
tests:
76-
- name: True Positive Test
77-
attack_data:
78-
- data:
79-
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_path_ssh_config.log
80-
source: auditd
81-
sourcetype: auditd
106+
- name: True Positive Test
107+
attack_data:
108+
- data:
109+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/auditd_path_ssh_config/path_ssh_config.log
110+
source: auditd
111+
sourcetype: auditd

0 commit comments

Comments
 (0)