Linux At Allow Config File Creation

Original Source: [splunk source]
Name:Linux At Allow Config File Creation
id:977b3082-5f3d-11ec-b954-acde48001122
version:3
date:2024-09-30
author:Teoderick Contreras, Splunk
status:production
type:Anomaly
Description:The following analytic detects the creation of the /etc/at.allow or /etc/at.deny configuration files in Linux. It leverages file creation events from the Endpoint datamodel to identify when these files are created. This activity is significant as these files control user permissions for the "at" scheduling application and can be abused by attackers to establish persistence. If confirmed malicious, this could allow unauthorized execution of malicious code, leading to potential data theft or further system compromise. Analysts should review the file path, creation time, and associated processes to assess the threat.
Data_source:
  • -Sysmon for Linux EventID 11
search:| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/at.allow", "*/etc/at.deny") by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path
| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `linux_at_allow_config_file_creation_filter`


how_to_implement:To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives:Administrator or network operator can create this file for automation purposes. Please update the filter macros to remove false positives.
References:
  -https://linuxize.com/post/at-command-in-linux/
drilldown_searches:
name:'View the detection results for - "$dest$"'
search:'%original_detection_search% | search dest = "$dest$"'
earliest_offset:'$info_min_time$'
latest_offset:'$info_max_time$'
name:'View risk events for the last 7 days for - "$dest$"'
search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset:'$info_min_time$'
latest_offset:'$info_max_time$'
tags:
  analytic_story:
    - 'Linux Privilege Escalation'
    - 'Linux Persistence Techniques'
    - 'Linux Living Off The Land'
    - 'Scheduled Tasks'
  asset_type:Endpoint
  confidence:50
  impact:50
  message:A file $file_name$ is created in $file_path$ on $dest$
  mitre_attack_id:
    - 'T1053.003'
    - 'T1053'
  observable:
    name:'dest'
    type:'Hostname'
    - role:
      - 'Victim'
  product:
    - 'Splunk Enterprise'
    - 'Splunk Enterprise Security'
    - 'Splunk Cloud'
  required_fields:
    - '_time'
    - 'Filesystem.dest'
    - 'Filesystem.file_create_time'
    - 'Filesystem.file_name'
    - 'Filesystem.process_guid'
    - 'Filesystem.file_path'
  risk_score:25
  security_domain:endpoint

tests:
name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log
  source: Syslog:Linux-Sysmon/Operational
  sourcetype: sysmon:linux
manual_test:None