Query: detection rule: Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the
Matching passage: Sigma rule: Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the. Logsource: linux / auditd. Rule: title: Suspicious C2 Activities id: f7158a64-6204-4d6d-868a-6e6378b467e0 status: test description: 'Detects suspicious activities as declared by Florian Roth in its ''Best Practice Auditd Configuration''. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132) ' references: - https://github.com/Neo23x0/auditd author: Marie Euler date: 2020-05-18 modified: 2021-11-27 tags: - attack.command-and-control logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /usr/bin/wget -p x -k susp_activity -w /usr/bin/curl -p x -k susp_activity -w /usr/bin/base64 -p x -k susp_activity -w /bin/nc -p x -k susp_activity -w /bin/netcat -p x -k susp_activity -w /usr/bin/ncat -p x -k susp_activity -w /usr/bin/ss -p x -k susp_activity -w /usr/bin/netstat -p x -k susp_activity -w /usr/bin/ssh -p x -k susp_activity -w /usr/bin/scp -p x -k susp_activity -w /usr/bin/sftp -p x -k susp_activity -w /usr/bin/ftp -p x -k susp_activity -w /usr/bin/socat -p x -k susp_activity -w /usr/bin/wireshark -p x -k susp_activity -w /usr/bin/tshark -p x -k susp_activity -w /usr/bin/rawshark -p x -k susp_activity -w /usr/bin/rdesktop -p x -k susp_activity -w /usr/local/bin/rdesktop -p x -k susp_activity -w /usr/bin/wlfreerdp -p x -k susp_activity -w /usr/bin/xfreerdp -p x -k susp_activity -w /usr/local/bin/xfreerdp -p x -k susp_activity -w /usr/bin/nmap -p x -k susp_activity (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336) ' detection: selection: key: susp_activity condition: selection falsepositives: - Admin or User activity level: medium
Near-miss passage: Sigma rule: Detects attempts to create and add an account to the admin group via "dscl". Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via Dscl id: b743623c-2776-40e0-87b1-682b975d0ca5 related: - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b type: obsolete status: test description: Detects attempts to create and add an account to the admin group via "dscl" references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos - https://ss64.com/osx/dscl.html author: Sohan G (D4rkCiph3r) date: 2023-03-19 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /dscl CommandLine|contains|all: - ' -append ' - ' /Groups/admin ' - ' GroupMembership ' condition: selection falsepositives: - Legitimate administration activities level: medium