Mirrors/keyboardcrunch-sentinelone-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/sentinelone-queries synced 2026-06-10 18:01:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

clean and reword of signatures

Browse Source
This commit is contained in:
keyboardcrunch
2020-12-05 12:50:21 -06:00
parent 3ecab6de5b
commit 08e20670ee
4 changed files with 22 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
queries/linux/dd_data_destruction.yml
+7 -6
View File
@@ -1,14 +1,15 @@
title: DD Data Destruction title: DD Data Destruction
description: Detection of data destruction with the DD command on *nix operating systems. Alternatively, DV 3.0 with 4.4 Agents will support TgtFileDeletionCount > "100" query for detection of over 100 files deleted, which can be combined with *FileType* for filtering. description: Detect data destruction with the DD command on *nix operating systems. Alternatively, DV 3.0 with 4.4 Agents will support TgtFileDeletionCount > "100" query for detection of over 100 files deleted, which can be combined with *FileType* for filtering.
author: keyboardcrunch author: keyboardcrunch
date: 10/10/2020 date: 10/10/2020
modified: null modified: 05/12/2020
mitre: mitre:
tactic: Impact tactic: Impact
technique: T1485 technique: T1485
subtechnique: null subtechnique:
operating_system: linux operating_system: linux
query: AgentOS In ("linux","osx") AND TgtProcName = "dd" AND TgtProcCmdLine ContainsCIS "of=" query: AgentOS In ("linux","osx") AND TgtProcName = "dd" AND TgtProcCmdLine ContainsCIS "of="
false_positives: null false_positives:
tags: null - Disk image captures
tags:
references:
queries/linux/disabling_linux_firewall.yml → queries/linux/linux_firewall_disabled.yml
+6 -6
View File
@@ -1,16 +1,16 @@
title: Disabling Linux Firewall title: Disabling Linux Firewall
author: keyboardcrunch author: keyboardcrunch
date: 10/10/2020 date: 10/10/2020
modified: null modified: 05/12/2020
description: Detection of Linux firewall being disabled. description: Detects Linux firewall being disabled.
mitre: mitre:
tactic: Defense Evasion tactic: Defense Evasion
technique: T1562 technique: T1562
subtechnique: null subtechnique:
operating_system: linux operating_system: linux
query: (SrcProcName In Contains ("service","chkconfig") AND SrcProcCmdLine In Contains query: (SrcProcName In Contains ("service","chkconfig") AND SrcProcCmdLine In Contains
("off","stop") AND SrcProcCmdLine ContainsCIS "tables") OR (TgtProcName = "systemctl" ("off","stop") AND SrcProcCmdLine ContainsCIS "tables") OR (TgtProcName = "systemctl"
AND TgtProcCmdLine In Contains ("stop","disable") AND TgtProcCmdLine Contains "firewalld") AND TgtProcCmdLine In Contains ("stop","disable") AND TgtProcCmdLine Contains "firewalld")
false_positives: null false_positives:
tags: null tags:
references:
queries/linux/local_account_added_nix.yml
+4 -4
View File
@@ -2,13 +2,13 @@ title: Local Account Added Linux
description: Query all instances of local accounts being Linux and OSX. description: Query all instances of local accounts being Linux and OSX.
author: keyboardcrunch author: keyboardcrunch
date: 10/10/2020 date: 10/10/2020
modified: null modified: 05/12/2020
mitre: mitre:
tactic: Persistence tactic: Persistence
technique: T1136 technique: T1136
subtechnique: null subtechnique:
operating_system: linux operating_system: linux
query: SrcProcCmdLine In Contains Anycase ("useradd") query: SrcProcCmdLine In Contains Anycase ("useradd")
false_positives: General account maintenance. false_positives: General account maintenance.
tags: null tags:
references:
queries/linux/disable_syslog.yml → queries/linux/syslog_disabled.yml
+5 -5
View File
@@ -2,14 +2,14 @@ title: Disable Syslog
description: Detect disabling of Linux Syslog service. description: Detect disabling of Linux Syslog service.
author: keyboardcrunch author: keyboardcrunch
date: 10/10/2020 date: 10/10/2020
modified: null modified:
mitre: mitre:
tactic: Defense Evasion tactic: Defense Evasion
technique: T1562 technique: T1562
subtechnique: null subtechnique:
operating_system: linux operating_system: linux
query: TgtProcName In Contains ("service","chkconfig","systemctl") AND TgtProcCmdLine query: TgtProcName In Contains ("service","chkconfig","systemctl") AND TgtProcCmdLine
In Contains ("rsyslog stop","off rsyslog","stop rsyslog","disable rsyslog") In Contains ("rsyslog stop","off rsyslog","stop rsyslog","disable rsyslog")
false_positives: null false_positives:
tags: null tags:
references: