auto-generated queries from markdown notes

queries/linux/dd_data_destruction.yml

@@ -0,0 +1,14 @@
+title: DD Data Destruction
+description: Detection of data destruction with the DD command on *nix operating systems. Alternatively, DV 3.0 with 4.4 Agents will support TgtFileDeletionCount > "100" query for detection of over 100 files deleted, which can be combined with *FileType* for filtering.
+author: keyboardcrunch
+date: 10/10/2020
+modified: null
+mitre:
+   tactic: Impact
+   technique: T1485
+   subtechnique: null
+operating_system: linux
+query: AgentOS In ("linux","osx") AND TgtProcName = "dd" AND TgtProcCmdLine ContainsCIS "of="
+false_positives: null
+tags: null
+

queries/linux/disable_syslog.yml

@@ -0,0 +1,15 @@
+title: Disable Syslog
+description: Detect disabling of Linux Syslog service.
+author: keyboardcrunch
+date: 10/10/2020
+modified: null
+mitre:
+   tactic: Defense Evasion
+   technique: T1562
+   subtechnique: null
+operating_system: linux
+query: TgtProcName In Contains ("service","chkconfig","systemctl") AND TgtProcCmdLine
+  In Contains ("rsyslog stop","off rsyslog","stop rsyslog","disable rsyslog")
+false_positives: null
+tags: null
+

queries/linux/disabling_linux_firewall.yml

@@ -0,0 +1,16 @@
+title: Disabling Linux Firewall
+author: keyboardcrunch
+date: 10/10/2020
+modified: null
+description: Detection of Linux firewall being disabled.
+mitre:
+   tactic: Defense Evasion
+   technique: T1562
+   subtechnique: null
+operating_system: linux
+query: (SrcProcName In Contains ("service","chkconfig") AND SrcProcCmdLine In Contains
+  ("off","stop") AND SrcProcCmdLine ContainsCIS "tables") OR (TgtProcName = "systemctl"
+  AND TgtProcCmdLine In Contains ("stop","disable") AND TgtProcCmdLine Contains "firewalld")
+false_positives: null
+tags: null
+

queries/linux/local_account_added_nix.yml

@@ -0,0 +1,14 @@
+title: Local Account Added Linux
+description: Query all instances of local accounts being Linux and OSX.
+author: keyboardcrunch
+date: 10/10/2020
+modified: null
+mitre:
+   tactic: Persistence
+   technique: T1136
+   subtechnique: null
+operating_system: linux
+query: SrcProcCmdLine In Contains Anycase ("useradd")
+false_positives: General account maintenance.
+tags: null
+