Query: write Sigma for Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the
Matching passage: Sigma rule: Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the. Logsource: linux / auditd. Rule: title: Suspicious C2 Activities id: f7158a64-6204-4d6d-868a-6e6378b467e0 status: test description: 'Detects suspicious activities as declared by Florian Roth in its ''Best Practice Auditd Configuration''. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132) ' references: - https://github.com/Neo23x0/auditd author: Marie Euler date: 2020-05-18 modified: 2021-11-27 tags: - attack.command-and-control logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /usr/bin/wget -p x -k susp_activity -w /usr/bin/curl -p x -k susp_activity -w /usr/bin/base64 -p x -k susp_activity -w /bin/nc -p x -k susp_activity -w /bin/netcat -p x -k susp_activity -w /usr/bin/ncat -p x -k susp_activity -w /usr/bin/ss -p x -k susp_activity -w /usr/bin/netstat -p x -k susp_activity -w /usr/bin/ssh -p x -k susp_activity -w /usr/bin/scp -p x -k susp_activity -w /usr/bin/sftp -p x -k susp_activity -w /usr/bin/ftp -p x -k susp_activity -w /usr/bin/socat -p x -k susp_activity -w /usr/bin/wireshark -p x -k susp_activity -w /usr/bin/tshark -p x -k susp_activity -w /usr/bin/rawshark -p x -k susp_activity -w /usr/bin/rdesktop -p x -k susp_activity -w /usr/local/bin/rdesktop -p x -k susp_activity -w /usr/bin/wlfreerdp -p x -k susp_activity -w /usr/bin/xfreerdp -p x -k susp_activity -w /usr/local/bin/xfreerdp -p x -k susp_activity -w /usr/bin/nmap -p x -k susp_activity (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336) ' detection: selection: key: susp_activity condition: selection falsepositives: - Admin or User activity level: medium
Near-miss passage: Sigma rule: Identifies when a Firewall Policy is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Network Firewall Policy Modified or Deleted id: 83c17918-746e-4bd9-920b-8e098bf88c23 status: test description: Identifies when a Firewall Policy is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-09-02 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE condition: selection falsepositives: - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium