Linux Network Service Scanning - Auditd

Title: Linux Network Service Scanning - Auditd
Status: test
Description:Detects enumeration of local or remote network services.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-21
modified:2023-09-26
Tags:

• -'attack.discovery'
• -'attack.t1046'

Logsource:

• product: linux
• service: auditd
• definition: Configure these rules https://github.com/Neo23x0/auditd/blob/e181243a7c708e9d579557d6f80e0ed3d3483b89/audit.rules#L182-L183

Detection:
  selection:
    type: 'SYSCALL'
    exe|endswith:
      -'/telnet'
      -'/nmap'
      -'/netcat'
      -'/nc'
      -'/ncat'
      -'/nc.openbsd'

    key: 'network_connect_4'
  condition:selection
Falsepositives:
  -Legitimate administration activities
Level: low