Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add new rule for password_group_discovery #5103

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

CheraghiMilad
Copy link
Contributor

Summary of the Pull Request

This rule detects adversaries attempting to discover group and permission settings. It looks for process execution related to groups, getent, or netstat commands which could indicate an attempt to gather information on available user accounts and groups, including elevated permissions.

groups log :
Dec 1 12:07:26 caldera-virtual-machine sysmon: 154100x8000000000000000286262Linux-Sysmon/Operationalcaldera-virtual-machine-2024-11-26 18:50:45.939{36fe7a82-1885-6746-91ce-8c4be7550000}19678/usr/bin/groups-----groups/tmpcaldera{36fe7a82-0000-0000-e803-000000000000}10003no levelSHA256=175a52497e658e138f7dce3fbb3ba7d794f302dc7be29f9c9ca79a8cb377554c{36fe7a82-1381-6743-d526-4b5458550000}2249/usr/bin/bashbashcaldera

host = caldera-virtual-machine
source = Syslog:Linux-Sysmon/Operational
sourcetype = sysmon_linux

netstat log:
Dec 1 12:08:55 caldera-virtual-machine sysmon: 154100x8000000000000000286269Linux-Sysmon/Operationalcaldera-virtual-machine-2024-11-26 18:52:15.275{36fe7a82-18df-6746-7d0c-f4aabf550000}19688/usr/bin/netstat-----netstat localgroup/tmpcaldera{36fe7a82-0000-0000-e803-000000000000}10003no levelSHA256=7af5f6cda055b65e31298fe20ed4456a87d2ca92803552bc0d3422f0e1a1fda1{36fe7a82-1381-6743-d526-4b5458550000}2249/usr/bin/bashbashcaldera

host = caldera-virtual-machine
source = Syslog:Linux-Sysmon/Operational
sourcetype = sysmon_linux

getent log:

Dec 1 12:08:30 caldera-virtual-machine sysmon: 154100x8000000000000000286268Linux-Sysmon/Operationalcaldera-virtual-machine-2024-11-26 18:51:50.183{36fe7a82-18c6-6746-6570-640d07560000}19682/usr/bin/getent-----getent group/tmpcaldera{36fe7a82-0000-0000-e803-000000000000}10003no levelSHA256=b8c45799a591949d1728e7177fa14ddb110102dfe20d7b3610ce7f448e7bb902{36fe7a82-1381-6743-d526-4b5458550000}2249/usr/bin/bashbashcaldera

host = caldera-virtual-machine
source = Syslog:Linux-Sysmon/Operational
sourcetype = sysmon_linux

pic of alert
Screenshot 2024-12-01 152248

Changelog

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Linux Pull request add/update linux related rules labels Dec 1, 2024
Copy link
Member

@frack113 frack113 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -0,0 +1,27 @@
title: Detection of Password Groups Discovery
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
title: Detection of Password Groups Discovery
title: Potential Linux Groups Discovery

Potential -> https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/sigmahq-title-convention.md
I can't find anything better to match the 3 selection.

@@ -0,0 +1,27 @@
title: Detection of Password Groups Discovery
id: 2b7d6524-c142-435a-ae96-be23543b9883
status: test
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@frack113 frack113 added the Work In Progress Some changes are needed label Dec 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Linux Pull request add/update linux related rules Rules Work In Progress Some changes are needed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants