Detection rules › Splunk

New Linux Service Started_Enabled

Group by
_time, command_line, host
Source
github.com/anvilogic-forge/armory

Looks for new services being started or configured to start on boot. This could be used for persistence

MITRE ATT&CK coverage

Telemetry coverage

Rule body

id: '5030.5084'
title: New Linux Service Started_Enabled
description: 'Looks for new services being started or configured to start on boot.
  This could be used for persistence - Threat Actor Association: TeamTNT'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` type IN("EXECVE", "proctitle")
  ((TERM(systemctl) (TERM(start) OR TERM(enable))) OR ("/etc/init.d/" TERM(start))
  OR (TERM(chkconfig) TERM(on)) OR (TERM(service) TERM(start))) | rex field=_raw "(?i)proctitle=(\")?(?<proc>.+")|
  eval process=mvappend(proc, process)| rex field=process "(?i)(enable|start|\Q/etc/init.d\E|\Q/sbin/service\E)(\s)?(\/)?(?<service>[A-Za-z0-9\-\.\_\x5c]+")
  | table _time, host, user, process, process_*, service | bin span=1s | stats values(*)
  as * by _time, host, process '
techniques:
- persistence:create or modify system process:systemd service
- privilege-escalation:create or modify system process:systemd service
technique_id:
- T1543.002
data_category:
- Process command-line parameters
- Linux audit logs
references: null

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_unix` type IN("EXECVE", "proctitle") ((TERM(systemctl) (TERM(start) OR TERM(enable))) OR ("/etc/init.d/" TERM(start)) OR (TERM(chkconfig) TERM(on)) OR (TERM(service) TERM(start)))

Stage 2: rex

| rex field=_raw "(?i)proctitle=(\")?(?<proc>.+")

The parser skipped this rex command.

Stage 3: eval

| eval process=mvappend(proc, process)

Stage 4: rex

| rex field=process "(?i)(enable|start|\Q/etc/init.d\E|\Q/sbin/service\E)(\s)?(\/)?(?<service>[A-Za-z0-9\-\.\_\x5c]+")

The parser skipped this rex command.

Stage 5: table

| table _time, host, user, process, process_*, service

Stage 6: bucket

| bin span=1s

Stage 7: stats

| stats values(*) as * by _time, host, process

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
typein
  • "EXECVE"
  • "proctitle"
field:"type" kind:in

Search terms

These SPL tokens match against raw event text.

StageTerm
1systemctl
1start
1enable
1"/etc/init.d/"
1start
1chkconfig
1on
1service
1start