Query: detect Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the in logs
Matching passage: Sigma rule: Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the. Logsource: linux / auditd. Rule: title: Suspicious C2 Activities id: f7158a64-6204-4d6d-868a-6e6378b467e0 status: test description: 'Detects suspicious activities as declared by Florian Roth in its ''Best Practice Auditd Configuration''. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132) ' references: - https://github.com/Neo23x0/auditd author: Marie Euler date: 2020-05-18 modified: 2021-11-27 tags: - attack.command-and-control logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /usr/bin/wget -p x -k susp_activity -w /usr/bin/curl -p x -k susp_activity -w /usr/bin/base64 -p x -k susp_activity -w /bin/nc -p x -k susp_activity -w /bin/netcat -p x -k susp_activity -w /usr/bin/ncat -p x -k susp_activity -w /usr/bin/ss -p x -k susp_activity -w /usr/bin/netstat -p x -k susp_activity -w /usr/bin/ssh -p x -k susp_activity -w /usr/bin/scp -p x -k susp_activity -w /usr/bin/sftp -p x -k susp_activity -w /usr/bin/ftp -p x -k susp_activity -w /usr/bin/socat -p x -k susp_activity -w /usr/bin/wireshark -p x -k susp_activity -w /usr/bin/tshark -p x -k susp_activity -w /usr/bin/rawshark -p x -k susp_activity -w /usr/bin/rdesktop -p x -k susp_activity -w /usr/local/bin/rdesktop -p x -k susp_activity -w /usr/bin/wlfreerdp -p x -k susp_activity -w /usr/bin/xfreerdp -p x -k susp_activity -w /usr/local/bin/xfreerdp -p x -k susp_activity -w /usr/bin/nmap -p x -k susp_activity (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336) ' detection: selection: key: susp_activity condition: selection falsepositives: - Admin or User activity level: medium
Near-miss passage: Sigma rule: Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic. Logsource: windows / security. Rule: title: HackTool - EDRSilencer Execution - Filter Added id: 98054878-5eab-434c-85d4-72d4e5a3361b status: test description: 'Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names. ' references: - https://github.com/netero1010/EDRSilencer author: Thodoris Polyzos (@SmoothDeploy) date: 2024-01-29 modified: 2024-01-30 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Policy Change needs to be enabled' detection: selection: EventID: - 5441 - 5447 FilterName|contains: Custom Outbound Filter condition: selection falsepositives: - Unknown level: high