deardaniel/secdata-raw huggingface dataset:
Elastic SIEM Detection Rules: low volume process injection syscalls by executable

# Low Volume Process Injection-Related Syscalls by Process Executable

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies low volume process injection-related syscalls on Linux systems. It monitors audit logs for syscalls related to process injection, such as ptrace and memfd_create. The hunt focuses on processes that make these syscalls infrequently, which can indicate potential malicious activity.

- **UUID:** `c9931736-d5ec-4c89-b4d2-d71dcf5ca12a`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Low Volume Process Injection-Related Syscalls by Process Executable](../queries/low_volume_process_injection_syscalls_by_executable.toml)

## Query

```sql
from logs-auditd_manager.auditd-*, logs-auditd.log-*, auditbeat-*
| where @timestamp > now() - 30 day
| where host.os.type == "linux" and auditd.data.syscall in ("ptrace", "memfd_create")
| stats cc = count(*) by process.executable, auditd.data.syscall
| where cc <= 10
| limit 100
| sort cc asc
```

## Notes

- Monitors for process injection-related syscalls such as ptrace and memfd_create.
- Counts the occurrences of these syscalls by process executable to identify processes that make these syscalls infrequently.
- Focuses on low volume occurrences to detect potential malicious activity related to process injection.

## MITRE ATT&CK Techniques

- [T1055.001](https://attack.mitre.org/techniques/T1055/001)
- [T1055.009](https://attack.mitre.org/techniques/T1055/009)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: low volume modifications to critical system binaries

# Low Volume Modifications to Critical System Binaries by Unique Host

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies low volume modifications to critical system binaries on Linux systems. It monitors file modification events in critical directories such as /bin, /usr/bin, /sbin, and /usr/sbin. The hunt focuses on modifications made by unique hosts, excluding expected update processes like package managers. This can help detect unauthorized or suspicious modifications to system binaries.

- **UUID:** `c7044817-d9a5-4755-abab-9059e50dab24`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Low Volume Modifications to Critical System Binaries by Unique Host](../queries/low_volume_modifications_to_critical_system_binaries.toml)

## Query

```sql
from logs-endpoint.events.file-*
| where @timestamp > now() - 7 day
| where host.os.type == "linux" and
  (file.path like "/bin/*" or file.path like "/usr/bin/*" or file.path like "/sbin/*" or file.path like "/usr/sbin/*") and
  not (

  // Exclude expected update processes, e.g., package managers
  process.executable in ("/usr/bin/apt", "/usr/bin/dpkg", "/usr/bin/yum", "/usr/bin/rpm", "/usr/bin/pacman",
  "/usr/bin/pamac-daemon", "/usr/bin/update-alternatives", "/usr/bin/dockerd", "/usr/bin/microdnf", "/sbin/apk") or

  // Exclude certain benign or expected modification patterns, if applicable
  file.path like "/usr/bin/gzip*" // Example exclusion, adjust based on your environment
)
| stats modification_count = count(file.path), unique_files_modified = count_distinct(file.path), host_count = count_distinct(host.name) by process.executable
| where modification_count >= 1 and host_count == 1
| sort modification_count asc
| limit 100
```

## Notes

- Monitors for file modifications in critical directories like /bin, /usr/bin, /sbin, and /usr/sbin.
- Excludes modifications made by expected update processes such as package managers to reduce false positives.
- Counts the number of unique files modified by each host and the number of modifications made.
- Focuses on modifications made by unique hosts to detect unauthorized or suspicious changes.

## MITRE ATT&CK Techniques

- [T1070.004](https://attack.mitre.org/techniques/T1070/004)
- [T1569.002](https://attack.mitre.org/techniques/T1569/002)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: privilege escalation via existing sudoers

# Privilege Escalation Identification via Existing Sudoers File

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies entries in the sudoers file on Linux systems using OSQuery. The sudoers file controls which users have administrative privileges and can be a target for attackers seeking to escalate their privileges. This hunt lists all sudoers rules for further analysis.

- **UUID:** `6e57e6a6-f150-405d-b8be-e4e666a3a86d`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[SQL]`
- **Source File:** [Privilege Escalation Identification via Existing Sudoers File](../queries/privilege_escalation_via_existing_sudoers.toml)

## Query

```sql
SELECT * FROM sudoers
```

## Notes

- Lists all entries in the sudoers file using OSQuery to detect potentially unauthorized or suspicious rules.
- Requires additional data analysis and investigation into results to identify malicious or misconfigured sudoers entries.
- Focuses on monitoring and analyzing administrative privileges granted through the sudoers file.

## MITRE ATT&CK Techniques

- [T1548.003](https://attack.mitre.org/techniques/T1548/003)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: privilege escalation via process capabilities

# Process Capability Hunting

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies processes on Linux systems with specific capabilities set. It monitors process execution events where processes have effective or permitted capabilities, which can be indicative of elevated privileges. The hunt focuses on non-root users to detect potential privilege escalation attempts. The hunt lists detailed information for further analysis and investigation.

- **UUID:** `6f67704d-e5b1-4613-912c-e2965660fe17`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Process Capability Hunting](../queries/privilege_escalation_via_process_capabilities.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 30 day
| where host.os.type == "linux" and event.action == "exec" and event.type == "start" and (process.thread.capabilities.effective is not null or process.thread.capabilities.permitted is not null) and user.id != "0" and
not (
  // Remove these if you expect persistence through capabilities
  process.executable like "/var/lib/docker/*" or
  process.name == "gnome-keyring-daemon" or
  process.thread.capabilities.permitted == "CAP_WAKE_ALARM"
)
| stats cc = count(), host_count = count_distinct(host.name) by process.executable, process.thread.capabilities.effective, process.thread.capabilities.permitted
| where host_count <= 3 and cc < 5
| sort cc asc
| limit 100
```

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 30 day
| where host.os.type == "linux" and event.action == "exec" and event.type == "start" and (
  process.thread.capabilities.effective in ("CAP_SYS_MODULE", "CAP_SYS_PTRACE", "CAP_DAC_OVERRIDE", "CAP_DAC_READ_SEARCH", "CAP_SETUID", "CAP_SETGID", "CAP_SYS_ADMIN") or
  process.thread.capabilities.permitted in ("CAP_SYS_MODULE", "CAP_SYS_PTRACE", "CAP_DAC_OVERRIDE", "CAP_DAC_READ_SEARCH", "CAP_SETUID", "CAP_SETGID", "CAP_SYS_ADMIN")
) and user.id != "0"
| stats cc = count(), host_count = count_distinct(host.name) by process.executable, process.thread.capabilities.effective, process.thread.capabilities.permitted
| where host_count <= 3 and cc < 5
| sort cc asc
| limit 100
```

## Notes

- Monitors process execution events where processes have specific capabilities set, such as CAP_SYS_MODULE, CAP_SYS_PTRACE, and others.
- Excludes certain processes and capabilities to reduce false positives, but these can be adjusted based on your environment.
- Uses EVAL to tag potential privilege escalation events and counts occurrences to identify unusual activity.
- Focuses on non-root users to detect potential privilege escalation attempts.
- Requires additional data analysis and investigation into results to identify malicious or unauthorized use of process capabilities.

## MITRE ATT&CK Techniques

- [T1548.001](https://attack.mitre.org/techniques/T1548/001)
- [T1548.003](https://attack.mitre.org/techniques/T1548/003)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: privilege escalation via suid binaries

# OSQuery SUID Hunting

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies SUID binaries on Linux systems using OSQuery. SUID binaries can be exploited by attackers to gain elevated privileges. The hunt includes queries to list all SUID binaries and detailed information about these files, focusing on regular files owned by root with SUID or SGID bits set.

- **UUID:** `2db642d2-621a-4183-88b5-b2659dc2c940`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[SQL]`
- **Source File:** [OSQuery SUID Hunting](../queries/privilege_escalation_via_suid_binaries.toml)

## Query

```sql
SELECT * FROM suid_bin
```

```sql
SELECT
    f.filename,
    f.path,
    f.mode,
    f.uid,
    f.gid,
    f.type,
    u.username AS file_owner,
    g.groupname AS group_owner,
    datetime(f.atime, 'unixepoch') AS file_last_access_time,
    datetime(f.mtime, 'unixepoch') AS file_last_modified_time,
    datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,
    datetime(f.btime, 'unixepoch') AS file_created_time,
    f.size AS size_bytes
FROM
    file f
LEFT JOIN
    users u ON f.uid = u.uid
LEFT JOIN
    groups g ON f.gid = g.gid
WHERE
f.type == "regular" AND
(f.uid == 0 or f.gid == 0) AND
(f.mode LIKE "2%" OR f.mode LIKE "4%") AND
(
  f.path LIKE "/%%" OR
  f.path LIKE "/%%/%%" OR
  f.path LIKE "/%%/%%/%%" OR
  f.path LIKE "/%%/%%/%%/%%"
)
```

## Notes

- Identifies SUID binaries using OSQuery to detect potentially exploitable files with SUID or SGID bits set.
- Lists all SUID binaries and provides detailed information about these files, including their paths, owners, and permissions.
- Focuses on regular files owned by root with SUID or SGID bits set to identify potential privilege escalation vectors.
- OSQuery has limited support for wildcard queries, therefore the query includes multiple LIKE conditions for directories. These can be increased and decreased, based on the environment

## MITRE ATT&CK Techniques

- [T1548.001](https://attack.mitre.org/techniques/T1548/001)
- [T1574.002](https://attack.mitre.org/techniques/T1574/002)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: persistence via user group creation modification

# Privilege Escalation/Persistence via User/Group Creation and/or Modification

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies user and group creation or modification activities on Linux systems using OSQuery. It monitors changes to the shadow file, user and group information, and user processes. These activities can indicate potential unauthorized access or privilege escalation attempts. The hunt lists detailed information for further analysis and investigation.

- **UUID:** `f00c9757-d21b-432c-90a6-8372f18075d0`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[SQL]`
- **Source File:** [Privilege Escalation/Persistence via User/Group Creation and/or Modification](../queries/persistence_via_user_group_creation_modification.toml)

## Query

```sql
SELECT * FROM shadow
```

```sql
SELECT * FROM shadow
WHERE password_status != "locked"
```

```sql
SELECT username, gid, uid, shell, description FROM users
WHERE username != 'root' AND uid LIKE "0"
```

```sql
SELECT * FROM users WHERE username = "newuser"
```

```sql
SELECT * FROM logged_in_users WHERE user = "newuser"
```

```sql
SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username
```

## Notes

- Monitors changes to the shadow file and user/group information using OSQuery to detect potentially unauthorized access or privilege escalation attempts.
- Lists detailed information about users, including authentication status and running processes.
- Requires additional data analysis and investigation into results to identify malicious or unauthorized user and group modifications.

## MITRE ATT&CK Techniques

- [T1136](https://attack.mitre.org/techniques/T1136)
- [T1136.001](https://attack.mitre.org/techniques/T1136/001)
- [T1136.002](https://attack.mitre.org/techniques/T1136/002)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: persistence via web shell

# Persistence via Web Shell

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies potential persistence mechanisms leveraging web shells on Linux systems. Web shells are malicious scripts or executables that attackers deploy to provide remote access, execute arbitrary commands, or maintain persistence on compromised systems. This hunt focuses on detecting suspicious file creation events and anomalous network activity associated with known web shell behaviors.

- **UUID:** `e2e4a1ad-5e03-4968-927c-9ef13c49a3b8`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Persistence via Web Shell](../queries/persistence_via_web_shell.toml)

## Query

```sql
from logs-endpoint.events.file-*
| keep @timestamp, host.os.type, event.action, file.extension, process.name, agent.id, file.name, process.executable
| where @timestamp > now() - 30 days
| where host.os.type == "linux" and event.action in ("rename", "creation") and
file.extension in ("php", "py", "pl", "rb", "rs", "lua", "jsp") and not (
  // Add your noisy exclusions here
  process.name in ("dnf", "dpkg", "pip3", "pip", "yum", "tar", "code", "vmtoolsd")
)
| stats cc = count(), agent_count = count_distinct(agent.id) by file.name, process.executable
| where agent_count <= 3
| sort cc asc
| limit 100
```

```sql
from logs-endpoint.events.network-*
| keep @timestamp, host.os.type, event.type, event.action, process.name, source.ip, agent.id, process.executable, process.command_line
| where @timestamp > now() - 30 days
| where host.os.type == "linux" and event.type == "end" and event.action == "disconnect_received" and
(
  process.name like "ruby*" or
  process.name like "perl*" or
  process.name like "python*" or
  process.name like "php*"
) and source.ip IS NOT null and not CIDR_MATCH(source.ip, "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "::1", "172.18.0.0/16")
| stats cc = count(), agent_count = count_distinct(agent.id) by process.executable, process.command_line, source.ip
| where agent_count <= 3
| sort cc asc
| limit 100
```

## Notes

- Monitors for the creation or renaming of files with extensions commonly associated with web shells, such as PHP, Python, Perl, Ruby, Lua, and JSP scripts.
- Analyzes network disconnect events to identify anomalous connections initiated by scripting engines, indicating potential use of web shells for remote access.
- Provides statistics and counts to detect rare or unusual activity related to file modifications or network events, helping prioritize investigation efforts.

## MITRE ATT&CK Techniques

- [T1505.003](https://attack.mitre.org/techniques/T1505/003)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: defense evasion via hidden process execution

# Hidden Process Execution

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies hidden process executions on Linux systems. It detects processes executed from hidden files, which are often used by malicious actors to conceal their activities. By focusing on hidden files rather than directories, this hunt aims to catch stealthy processes while minimizing noise.

- **UUID:** `00461198-9a2d-4823-b4cc-f3d1b5c17935`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Hidden Process Execution](../queries/defense_evasion_via_hidden_process_execution.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 30 day
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and 
  process.executable rlike "/[^/]+/\\.[^/]+"
| stats cc = count(), host_count = count_distinct(host.name) by process.executable, process.parent.executable, user.id
// Alter this threshold to make sense for your environment
| where cc <= 3 and host_count <= 3
| sort cc asc
| limit 100
```

## Notes

- Included only hidden files, excluding hidden directories, as hidden directories are common in Unix.
- Included a process or parent process count of <= 3, and a host count of <= 3 to eliminate common processes across different hosts.

## MITRE ATT&CK Techniques

- [T1036.004](https://attack.mitre.org/techniques/T1036/004)
- [T1059](https://attack.mitre.org/techniques/T1059)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: privilege escalation via segmentation fault and buffer overflow

# Segmentation Fault & Potential Buffer Overflow Hunting

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies segmentation faults (segfaults) and potential buffer overflow attacks on Linux systems by parsing syslog messages related to segfaults. It captures details about the crashing process, shared object file, and other relevant information to help identify and investigate potential exploitation attempts.

- **UUID:** `3f3fd2b9-940c-4310-adb1-d8b7d726e281`
- **Integration:** [system](https://docs.elastic.co/integrations/system)
- **Language:** `[ES|QL]`
- **Source File:** [Segmentation Fault & Potential Buffer Overflow Hunting](../queries/privilege_escalation_via_segmentation_fault_and_buffer_overflow.toml)

## Query

```sql
from logs-system.syslog*
| where @timestamp > now() - 12 hour
| where host.os.type == "linux" and process.name == "kernel" and message like "*segfault*"
| grok message "\\[%{NUMBER:timestamp}\\] %{WORD:process}\\[%{NUMBER:pid}\\]: segfault at %{BASE16NUM:segfault_address} ip %{BASE16NUM:instruction_pointer} sp %{BASE16NUM:stack_pointer} error %{NUMBER:error_code} in %{DATA:so_file}\\[%{BASE16NUM:so_base_address}\\+%{BASE16NUM:so_offset}\\]"
| keep timestamp, process, pid, so_file, segfault_address, instruction_pointer, stack_pointer, error_code, so_base_address, so_offset
```

```sql
from logs-system.syslog*
| where host.os.type == "linux" and process.name == "kernel" and message like "*segfault*"
| where @timestamp > now() - 12 hour
| grok message "\\[%{DATA:timestamp}\\] %{WORD:process}\\[%{NUMBER:pid}\\]: segfault at %{BASE16NUM:segfault_address} ip %{BASE16NUM:instruction_pointer} sp %{BASE16NUM:stack_pointer} error %{NUMBER:error_code} in %{DATA:so_name}\\[%{BASE16NUM:so_base_address}\\+%{BASE16NUM:so_offset}\\] likely on CPU %{NUMBER:cpu} \\(core %{NUMBER:core}, socket %{NUMBER:socket}\\)"
| eval timestamp = REPLACE(timestamp, "\\s+", "")
| keep timestamp, process, pid, segfault_address, instruction_pointer, stack_pointer, error_code, so_name, so_base_address, so_offset, cpu, core, socket
| stats cc = count() by process, so_name
// Alter this threshold to make sense for your environment
| where cc > 100
| limit 10
```

## Notes

- Detects segfaults and parses syslog messages related to segfaults to identify the crashing process and shared object file along with additional crash details.
- Uses GROK to extract relevant fields from syslog messages.
- Counts occurrences of segfaults within a plain text message field to potentially detect buffer overflow attacks and unsuccessful process injection attempts.
- Removes prepending spaces from syslog messages using EVAL to ensure consistent parsing.
- Depending on the Syslog configuration, additional parsing may be required to extract the necessary fields from the message.

## MITRE ATT&CK Techniques

- [T1203](https://attack.mitre.org/techniques/T1203)
- [T1068](https://attack.mitre.org/techniques/T1068)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: persistence reverse bind shells

# Persistence Through Reverse/Bind Shells

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt provides several OSQuery queries that can aid in the detection of reverse/bind shells. Reverse shells are a type of shell in which the target machine communicates back to the attacking machine. Bind shells are a type of shell in which the target machine opens a communication port on the victim machine and waits for an attacker to connect to it. These shells can be used by attackers to gain remote access to a system.

- **UUID:** `7422faf1-ba51-49c3-b8ba-13759e6bcec4`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[SQL]`
- **Source File:** [Persistence Through Reverse/Bind Shells](../queries/persistence_reverse_bind_shells.toml)

## Query

```sql
SELECT (
  CASE family 
  WHEN 2 THEN 'IP4' 
  WHEN 10 THEN 'IP6' 
  ELSE family END
) AS family, (
  CASE protocol 
  WHEN 6 THEN 'TCP' 
  WHEN 17 THEN 'UDP' 
  ELSE protocol END
) AS protocol, local_address, local_port, 
  remote_address, remote_port 
FROM process_open_sockets 
WHERE family IN (2, 10) 
AND protocol IN (6, 17) 
```

```sql
SELECT cmdline, name, path, pid, state, threads, total_size 
FROM processes 
WHERE cmdline != ''
```

```sql
SELECT pid, address, port, socket, protocol, path FROM listening_ports
```

## Notes

- The hunt provides OSQuery queries to detect reverse/bind shells on Linux systems.
- The first hunt query retrieves information about open sockets on the system.
- The second hunt query retrieves information about running processes on the system.
- The third hunt query retrieves information about listening ports on the system.
- Investigate strange or unexpected open sockets, processes, or listening ports on the system.
- Use the information from each hunt to pivot and investigate further for potential reverse/bind shells.

## MITRE ATT&CK Techniques

- [T1059.004](https://attack.mitre.org/techniques/T1059/004)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: defense evasion via capitalized process execution

# Defense Evasion via Capitalized Process Execution

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies potential defense evasion techniques via capitalized process execution on Linux systems. It detects processes that have two or more consecutive capital letters within their names, which can indicate an attempt to evade detection. Such naming conventions are often used in malicious payloads to blend in with legitimate processes.

- **UUID:** `9d485892-1ca2-464b-9e4e-6b21ab379b9a`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Defense Evasion via Capitalized Process Execution](../queries/defense_evasion_via_capitalized_process_execution.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 10 day
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  (process.name rlike """[A-Z]{2,}[a-z]{1,}[0-9]{0,}""") or
  (process.name rlike """[A-Z]{1,}[0-9]{0,}""")
)
| stats cc = count(), host_count = count_distinct(host.name) by process.name
// Alter this threshold to make sense for your environment
| where cc <= 3 and host_count <= 3
| limit 100
```

## Notes

- Detects processes that have two or more consecutive capital letters within their names, with optional digits.
- This technique is often used in malicious payloads, such as Metasploit payloads, to evade detection.
- Included a process count of <= 3 and a host count of <= 3 to eliminate common processes across different hosts.

## MITRE ATT&CK Techniques

- [T1036.004](https://attack.mitre.org/techniques/T1036/004)
- [T1070](https://attack.mitre.org/techniques/T1070)

## License

- `Elastic License v2`