auditbeat.modules:
- module: file_integrity
paths:
- "C:\\Windows\\System32"
include_files: []
scan_at_start: true
scan_rate_per_sec: 50 MiB
max_file_size: 100 MiB
hash_types: [sha1]
recursive: false
output.logstash:
ssl.enabled: true
ssl.verification_mode: noneСтандартный конфигурационный файл Auditbeat
Для ОС Windows:
Для ОС Linux:
# =========================== Modules configuration ============================
auditbeat.modules:
- module: auditd
# Load audit rules from separate files. Same format as audit.rules(7).
audit_rule_files: ['${path.config}/audit.rules.d/*.conf']
audit_rules: |
# https://github.com/bfuzzy/auditd-attack/blob/master/auditd-attack.rules
# https://github.com/Neo23x0/auditd/blob/master/audit.rules
# Self Auditing ---------------------------------------------------------------
## Audit the audit logs
### Successful and unsuccessful attempts to read information from the audit records
-w /var/log/audit/ -p wra -k auditlog
-w /var/log/audit/ -p wra -k T1005_Data_From_Local_System_audit_log
-w /var/audit/ -p wra -k T1005_Data_From_Local_System_audit_log
## Auditd configuration
### Modifications to audit configuration that occur while the audit collection functions are operating
-w /etc/audit/ -p wa -k auditconfig
-w /etc/libaudit.conf -p wa -k auditconfig
-w /etc/audisp/ -p wa -k audispconfig
## Monitor for use of audit management tools
-w /sbin/auditctl -p x -k audittools
-w /sbin/auditd -p x -k audittools
-w /usr/sbin/auditd -p x -k audittools
-w /usr/sbin/augenrules -p x -k audittools
## Access to all audit trails
-a always,exit -F path=/usr/sbin/ausearch -F perm=x -k T1005_Data_From_Local_System_audit_log
-a always,exit -F path=/usr/sbin/aureport -F perm=x -k T1005_Data_From_Local_System_audit_log
-a always,exit -F path=/usr/sbin/aulast -F perm=x -k T1005_Data_From_Local_System_audit_log
-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k T1005_Data_From_Local_System_audit_log
-a always,exit -F path=/usr/sbin/auvirt -F perm=x -k T1005_Data_From_Local_System_audit_log
# Filters ---------------------------------------------------------------------
### We put these early because audit is a first match wins system.
## Ignore SELinux AVC records
-a always,exclude -F msgtype=AVC
## Ignore current working directory records
-a always,exclude -F msgtype=CWD
## Ignore EOE records (End Of Event, not needed)
-a always,exclude -F msgtype=EOE
## Cron jobs fill the logs with stuff we normally don't want (works with SELinux)
-a never,user -F subj_type=crond_t
-a never,exit -F subj_type=crond_t
## This prevents chrony from overwhelming the logs (if chrony installed)
#-a never,exit -F arch=b32 -S adjtimex -F auid=unset -F uid=chrony -F subj_type=chronyd_t
#-a never,exit -F arch=b64 -S adjtimex -F auid=unset -F uid=chrony -F subj_type=chronyd_t
## This is not very interesting and wastes a lot of space if the server is public facing
-a always,exclude -F msgtype=CRYPTO_KEY_USER
## VMware tools
-a never,exit -F arch=b32 -S fork -F success=0 -F path=/usr/lib/vmware-tools -F subj_type=initrc_t -F exit=-2
-a never,exit -F arch=b64 -S fork -F success=0 -F path=/usr/lib/vmware-tools -F subj_type=initrc_t -F exit=-2
-a never,exit -F arch=b32 -S all -F exe=/usr/bin/vmtoolsd
-a never,exit -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd
### High Volume Event Filter (especially on Linux Workstations)
-a never,exit -F arch=b32 -F dir=/dev/shm -k sharedmemaccess
-a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess
# if LVM installed
# -a never,exit -F arch=b32 -F dir=/var/lock/lvm -k locklvm
# -a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm
## FileBeat
-a never,exit -F arch=b32 -F path=/opt/filebeat -k filebeat
-a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat
## More information on how to filter events
### https://access.redhat.com/solutions/2482221
# Rules -----------------------------------------------------------------------
## Kernel parameters
-w /etc/sysctl.conf -p wa -k sysctl
-w /etc/sysctl.d -p wa -k sysctl
## Kernel module loading and unloading
-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules -k T1215_Kernel_Modules_and_Extensions
-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules -k T1215_Kernel_Modules_and_Extensions
-a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules -k T1215_Kernel_Modules_and_Extensions
-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules -k T1215_Kernel_Modules_and_Extensions
-a always,exit -F arch=b32 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules -k T1215_Kernel_Modules_and_Extensions
## Modprobe configuration
-w /etc/modprobe.conf -p wa -k modprobe -k T1215_Kernel_Modules_and_Extensions
-w /etc/modprobe.d -p wa -k modprobe -k T1215_Kernel_Modules_and_Extensions
## KExec usage (all actions)
-a always,exit -F arch=b64 -S kexec_load -k KEXEC
-a always,exit -F arch=b32 -S sys_kexec_load -k KEXEC
## Special files
-a always,exit -F arch=b32 -S mknod -S mknodat -k specialfiles
-a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles
## Mount operations (only attributable)
## Media Export Related Events
#-a always,exit -F arch=b32 -S mount -F auid>=500 -F auid!=4294967295
#-a always,exit -F arch=b64 -S mount -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S mount -S umount2 -F auid>=1000 -F auid!=-1 -k mount -k T1052_Exfiltration_Over_Physical_Medium
-a always,exit -F arch=b32 -S mount -S umount -S umount2 -F auid>=1000 -F auid!=-1 -k mount -k T1052_Exfiltration_Over_Physical_Medium
## Change swap (only attributable)
-a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap
-a always,exit -F arch=b32 -S swapon -S swapoff -F auid!=-1 -k swap
## Time Related Events
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S clock_settime -k time -k T1099_Timestomp
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k time -k T1099_Timestomp
# if NTP daemon is installed
# -a always,exit -F arch=b32 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time -k T1099_Timestomp
# -a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time -k T1099_Timestomp
### Local time zone
-w /etc/localtime -p wa -k localtime -k T1099_Timestomp
## Stunnel
-w /usr/sbin/stunnel -p x -k stunnel -k T1079_Multilayer_Encryption
-w /usr/bin/stunnel -p x -k stunnel -k T1079_Multilayer_Encryption
## Cron configuration & scheduled jobs related events
-w /etc/cron.allow -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/cron.deny -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/cron.d/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/cron.daily/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/cron.hourly/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/cron.monthly/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/cron.weekly/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/crontab -p wa -k cron -k T1168_Local_Job_Scheduling
-w /var/spool/cron/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /var/spool/cron/crontabs/ -k cron -k T1168_Local_Job_Scheduling
-w /etc/inittab -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/init.d/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/init/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/at.allow -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/at.deny -p wa -k cron -k T1168_Local_Job_Scheduling
-w /var/spool/at/ -p wa -k cron -k T1168_Local_Job_Scheduling
-w /etc/anacrontab -p wa -k cron -k T1168_Local_Job_Scheduling
## User, group, password databases
-w /etc/group -p wa -k T1087_Account_Discovery
-w /etc/passwd -p wa -k TT1087_Account_Discovery
-w /etc/gshadow -k T1087_Account_Discovery
-w /etc/shadow -k T1087_Account_Discovery
-w /etc/security/opasswd -k T1087_Account_Discovery
## Account Related Events
## Sudoers file changes
-w /etc/sudoers -p wa -k actions -k T1078_Valid_Accounts
-w /etc/sudoers.d/ -p wa -k actions -k T1078_Valid_Accounts
## Passwd
-w /usr/bin/passwd -p x -k passwd_modification -k T1078_Valid_Accounts
## Tools to change group identifiers
-w /usr/sbin/groupadd -p x -k group_modification -k T1078_Valid_Accounts
-w /usr/sbin/groupmod -p x -k group_modification -k T1078_Valid_Accounts
-w /usr/sbin/addgroup -p x -k group_modification -k T1078_Valid_Accounts
-w /usr/sbin/useradd -p x -k user_modification -k T1078_Valid_Accounts
-w /usr/sbin/userdel -p x -k user_modification -k T1078_Valid_Accounts
-w /usr/sbin/usermod -p x -k user_modification -k T1078_Valid_Accounts
-w /usr/sbin/adduser -p x -k user_modification -k T1078_Valid_Accounts
## Login configuration and information
## Login Related Events
-w /etc/login.defs -p wa -k login -k T1082_System_Information_Discovery
-w /etc/securetty -p wa -k login -k T1082_System_Information_Discovery
-w /var/log/faillog -p wa -k login -k T1021_Remote_Services -k T1082_System_Information_Discovery
-w /var/log/lastlog -p wa -k login -k T1021_Remote_Services -k T1082_System_Information_Discovery
-w /var/log/tallylog -p wa -k login -k T1082_System_Information_Discovery -k T1021_Remote_Services
## Network Environment
### Changes to hostname
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k network_modifications
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications
### Detect Remote Shell Use
-a always,exit -F arch=b32 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell"
-a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell"
-a always,exit -F arch=b32 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell"
-a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell"
### Successful IPv4 Connections
-a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4
-a always,exit -F arch=b32 -S connect -F a2=16 -F success=1 -F key=network_connect_4
### Successful IPv6 Connections
-a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6
-a always,exit -F arch=b32 -S connect -F a2=28 -F success=1 -F key=network_connect_6
### Changes to other files
# RHEL style configuration
# -w /etc/sysconfig/network -p wa -k network_modifications
# -w /etc/sysconfig/network-scripts -p w -k network_modifications
-w /etc/hosts -p wa -k network_modifications
-w /etc/network/ -p wa -k network
-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications
### Changes to issue
-w /etc/issue -p wa -k etcissue
-w /etc/issue.net -p wa -k etcissue
## System startup scripts
-w /etc/inittab -p wa -k init
-w /etc/init.d/ -p wa -k init
-w /etc/init/ -p wa -k init
## Library search paths
-w /etc/ld.so.conf -p wa -k libpath
-w /etc/ld.so.conf.d -p wa -k libpath
## Systemwide library preloads (LD_PRELOAD)
-w /etc/ld.so.preload -p wa -k systemwide_preloads
## Pam configuration
## Pam Related Events
-w /etc/pam.d/ -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
-w /etc/security/limits.conf -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
-w /etc/security/limits.d -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
-w /etc/security/pam_env.conf -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
-w /etc/security/namespace.conf -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
-w /etc/security/namespace.d -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
-w /etc/security/namespace.init -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
-w /etc/pam.d/common-password -p wa -k T1201_Password_Policy_Discovery
## Mail configuration
-w /etc/aliases -p wa -k mail
-w /etc/postfix/ -p wa -k mail
-w /etc/exim4/ -p wa -k mail
## SSH configuration
## SSH Related Events
-w /etc/ssh/sshd_config -k sshd -k T1021_Remote_Services
-w /etc/ssh/sshd_config.d -k sshd -k T1021_Remote_Services
## root ssh key tampering
-w /root/.ssh -p wa -k rootkey
# Systemd
-w /bin/systemctl -p x -k systemd
-w /etc/systemd/ -p wa -k systemd
-w /usr/lib/systemd -p wa -k systemd
## SELinux events that modify the system's Mandatory Access Controls (MAC)
-w /etc/selinux/ -p wa -k mac_policy
## Critical elements access failures
-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess
-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess
-a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess
-a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess
-a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess
-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess
-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess
-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess
## Process ID change (switching accounts) applications
-w /bin/su -p x -k priv_esc -k T1169_Sudo
-w /usr/bin/sudo -p x -k priv_esc -k T1169_Sudo
-w /etc/sudoers -p rw -k priv_esc -k T1169_Sudo
-w /etc/sudoers.d -p rw -k priv_esc -k T1169_Sudo
## Power state
-w /sbin/shutdown -p x -k power
-w /sbin/poweroff -p x -k power
-w /sbin/reboot -p x -k power
-w /sbin/halt -p x -k power
## Session initiation information
## Session Related Events
-w /var/run/utmp -p wa -k session -k T1108_Redundant_Access
-w /var/log/btmp -p wa -k session -k T1108_Redundant_Access
-w /var/log/wtmp -p wa -k session -k T1108_Redundant_Access
## Discretionary Access Control (DAC) modifications
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
#-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295
# Special Rules ---------------------------------------------------------------
## Reconnaissance
-w /usr/bin/whoami -p x -k recon -k T1033_System_Owner_User_Discovery
-w /usr/bin/id -p x -k recon
-w /bin/hostname -p x -k recon
-w /bin/uname -p x -k recon
-w /etc/issue -p r -k recon
-w /etc/hostname -p r -k recon -k T1082_System_Information_Discovery
## Suspicious activity
-w /usr/bin/ss -p x -k susp_activity
-w /usr/bin/netstat -p x -k susp_activity
-w /usr/bin/wireshark -p x -k T1049_System_Network_Connections_discovery
-w /usr/bin/tshark -p x -k T1049_System_Network_Connections_discovery
-w /usr/bin/rawshark -p x -k T1049_System_Network_Connections_discovery
-w /usr/bin/nmap -p x -k susp_activity
## T1219 Remote Access Tools
-w /usr/bin/wget -p x -k T1219_Remote_Access_Tools
-w /usr/bin/curl -p x -k T1219_Remote_Access_Tools
-w /usr/bin/base64 -p x -k T1219_Remote_Access_Tools
-w /bin/nc -p x -k T1219_Remote_Access_Tools
-w /bin/netcat -p x -k T1219_Remote_Access_Tools
-w /usr/bin/ncat -p x -k T1219_Remote_Access_Tools
-w /usr/bin/ssh -p x -k T1219_Remote_Access_Tools
-w /usr/bin/socat -p x -k T1219_Remote_Access_Tools
-w /usr/bin/rdesktop -p x -k T1219_Remote_Access_Tools
-w /usr/local/bin/rdesktop -p x -k T1219_Remote_Access_Tools
-w /usr/bin/xfreerdp -p x -k T1219_Remote_Access_Tools
-w /usr/local/bin/xfreerdp -p x -k T1219_Remote_Access_Tools
-w /usr/bin/wlfreerdp -p x -k T1219_Remote_Access_Tools
## T1105 remote file copy
-w /usr/bin/scp -p x -k T1105_remote_file_copy
-w /usr/bin/sftp -p x -k T1105_remote_file_copy
-w /usr/bin/ftp -p x -k T1105_remote_file_copy
## T1002 Data Compressed
-w /usr/bin/zip -p x -k T1002_Data_Compressed
-w /usr/bin/gzip -p x -k T1002_Data_Compressed
-w /usr/bin/tar -p x -k T1002_Data_Compressed
-w /usr/bin/bzip2 -p x -k T1002_Data_Compressed
-w /usr/bin/lzip -p x -k T1002_Data_Compressed
-w /usr/local/bin/lzip -p x -k T1002_Data_Compressed
-w /usr/bin/lz4 -p x -k T1002_Data_Compressed
-w /usr/local/bin/lz4 -p x -k T1002_Data_Compressed
-w /usr/bin/lzop -p x -k T1002_Data_Compressed
-w /usr/local/bin/lzop -p x -k T1002_Data_Compressed
-w /usr/bin/plzip -p x -k T1002_Data_Compressed
-w /usr/local/bin/plzip -p x -k T1002_Data_Compressed
-w /usr/bin/pbzip2 -p x -k T1002_Data_Compressed
-w /usr/local/bin/pbzip2 -p x -k T1002_Data_Compressed
-w /usr/bin/lbzip2 -p x -k T1002_Data_Compressed
-w /usr/local/bin/lbzip2 -p x -k T1002_Data_Compressed
-w /usr/bin/pixz -p x -k T1002_Data_Compressed
-w /usr/local/bin/pixz -p x -k T1002_Data_Compressed
-w /usr/bin/pigz -p x -k T1002_Data_Compressed
-w /usr/local/bin/pigz -p x -k T1002_Data_Compressed
-w /usr/bin/unpigz -p x -k T1002_Data_Compressed
-w /usr/local/bin/unpigz -p x -k T1002_Data_Compressed
-w /usr/bin/zstd -p x -k T1002_Data_Compressed
-w /usr/local/bin/zstd -p x -k T1002_Data_Compressed
## Added to catch netcat on Ubuntu
-w /bin/nc.openbsd -p x -k susp_activity
-w /bin/nc.traditional -p x -k susp_activity
## Sbin suspicious activity
-w /sbin/iptables -p x -k sbin_susp -k T1082_System_Information_Discovery
-w /sbin/ip6tables -p x -k sbin_susp -k T1082_System_Information_Discovery
-w /sbin/ifconfig -p x -k sbin_susp -k T1082_System_Information_Discovery
-w /usr/sbin/arptables -p x -k sbin_susp -k T1082_System_Information_Discovery
-w /usr/sbin/ebtables -p x -k sbin_susp
-w /sbin/xtables-nft-multi -p x -k sbin_susp
-w /usr/sbin/nft -p x -k sbin_susp
-w /usr/sbin/tcpdump -p x -k T1049_System_Network_Connections_discovery
-w /usr/sbin/traceroute -p x -k T1049_System_Network_Connections_discovery
-w /usr/sbin/ufw -p x -k sbin_susp -k T1082_System_Information_Discovery
## dbus-send invocation
### may indicate privilege escalation CVE-2021-3560
-w /usr/bin/dbus-send -p x -k dbus_send
-w /usr/bin/gdbus -p x -k gdubs_call
## pkexec invocation
### may indicate privilege escalation CVE-2021-4034
-w /usr/bin/pkexec -p x -k pkexec
## Suspicious shells
-w /bin/ash -p x -k susp_shell
-w /bin/bash -p x -k susp_shell
-w /bin/csh -p x -k susp_shell
-w /bin/dash -p x -k susp_shell
-w /bin/busybox -p x -k susp_shell
-w /bin/ksh -p x -k susp_shell
-w /bin/fish -p x -k susp_shell
-w /bin/tcsh -p x -k susp_shell
-w /bin/tclsh -p x -k susp_shell
-w /bin/zsh -p x -k susp_shell
-w /bin/xonsh -p x -k susp_shell
-w /usr/local/bin/xonsh -p x -k susp_shell
-w /bin/open -p x -k susp_shell
-w /bin/sh -p x -k susp_shell
-w /bin/rbash -p x -k susp_shell
### https://clustershell.readthedocs.io/
# -w /bin/clush -p x -k susp_shell
# -w /usr/local/bin/clush -p x -k susp_shell
# -w /etc/clustershell/clush.conf -p x -k susp_shell
### https://github.com/tmux/tmux
-w /bin/tmux -p x -k susp_shell
-w /usr/local/bin/tmux -p x -k susp_shell
### https://github.com/xxh/xxh
-w /bin/xxh -p x -k susp_shell
-w /usr/local/bin/xxh -p x -k susp_shell
## Shell/profile configurations
-w /etc/profile.d/ -p wa -k shell_profiles
-w /etc/profile -p wa -k shell_profiles
-w /etc/shells -p wa -k shell_profiles
-w /etc/bashrc -p wa -k shell_profiles
-w /etc/csh.cshrc -p wa -k shell_profiles
-w /etc/csh.login -p wa -k shell_profiles
-w /etc/fish/ -p wa -k shell_profiles
-w /etc/zsh/ -p wa -k shell_profiles
### https://github.com/xxh/xxh
-w /usr/local/bin/xxh.bash -p x -k susp_shell
-w /usr/local/bin/xxh.xsh -p x -k susp_shell
-w /usr/local/bin/xxh.zsh -p x -k susp_shell
## Injection
### These rules watch for code injection by the ptrace facility.
### This could indicate someone trying to do something bad or just debugging
-a always,exit -F arch=b32 -S ptrace -F a0=0x4 -k T1055_Process_Injection
-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k T1055_Process_Injection
-a always,exit -F arch=b32 -S ptrace -F a0=0x5 -k T1055_Process_Injection
-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k T1055_Process_Injection
-a always,exit -F arch=b32 -S ptrace -F a0=0x6 -k T1055_Process_Injection
-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k T1055_Process_Injection
-a always,exit -F arch=b32 -S ptrace -k T1055_Process_Injection
-a always,exit -F arch=b64 -S ptrace -k T1055_Process_Injection
## Anonymous File Creation
### These rules watch the use of memfd_create
### "memfd_create" creates anonymous file and returns a file descriptor to access it
### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk
-a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create
-a always,exit -F arch=b32 -S memfd_create -F key=anon_file_create
## Privilege Abuse
### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir.
-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse -k T1169_Sudo
#-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=4294967295 -C auid!=obj_uid
# Socket Creations
# will catch both IPv4 and IPv6
-a always,exit -F arch=b32 -S socket -F a0=2 -k T1011_Exfiltration_Over_Other_Network_Medium
-a always,exit -F arch=b64 -S socket -F a0=2 -k T1011_Exfiltration_Over_Other_Network_Medium
-a always,exit -F arch=b32 -S socket -F a0=10 -k T1011_Exfiltration_Over_Other_Network_Medium
-a always,exit -F arch=b64 -S socket -F a0=10 -k T1011_Exfiltration_Over_Other_Network_Medium
# Software Management ---------------------------------------------------------
# RPM (Redhat/CentOS)
-w /usr/bin/rpm -p x -k T1072_third_party_software
-w /usr/bin/yum -p x -k T1072_third_party_software
# DNF (Fedora/RedHat 8/CentOS 8)
-w /usr/bin/dnf -p x -k T1072_third_party_softwared
# YAST/Zypper/RPM (SuSE)
-w /sbin/yast -p x -k T1072_third_party_software
-w /sbin/yast2 -p x -k T1072_third_party_software
-w /bin/rpm -p x -k T1072_third_party_software
-w /usr/bin/zypper -k T1072_third_party_software
# DPKG / APT-GET (Debian/Ubuntu)
-w /usr/bin/dpkg -p x -k T1072_third_party_software
-w /usr/bin/apt -p x -k T1072_third_party_software
-w /usr/bin/apt-add-repository -p x -k T1072_third_party_software
-w /usr/bin/apt-get -p x -k T1072_third_party_software
-w /usr/bin/aptitude -p x -k T1072_third_party_software
-w /usr/bin/wajig -p x -k T1072_third_party_software
-w /usr/bin/snap -p x -k T1072_third_party_software
# PIP(3) (Python installs)
-w /usr/bin/pip -p x -k T1072_third_party_software
-w /usr/local/bin/pip -p x -k T1072_third_party_software
-w /usr/bin/pip3 -p x -k T1072_third_party_software
-w /usr/local/bin/pip3 -p x -k T1072_third_party_software
# npm
## T1072 third party software
## https://www.npmjs.com
## https://docs.npmjs.com/cli/v6/commands/npm-audit
-w /usr/bin/npm -p x -k T1072_third_party_software
# Comprehensive Perl Archive Network (CPAN) (CPAN installs)
## T1072 third party software
## https://www.cpan.org
-w /usr/bin/cpan -p x -k T1072_third_party_software
# Ruby (RubyGems installs)
## T1072 third party software
## https://rubygems.org
-w /usr/bin/gem -p x -k T1072_third_party_software
# LuaRocks (Lua installs)
## T1072 third party software
## https://luarocks.org
# -w /usr/bin/luarocks -p x -k T1072_third_party_software
# Pacman (Arch Linux)
## https://wiki.archlinux.org/title/Pacman
## T1072 third party software
-w /etc/pacman.conf -p x -k T1072_third_party_software
-w /etc/pacman.d -p x -k T1072_third_party_software
# Special Software ------------------------------------------------------------
## GDS specific secrets
# if Puppet installed
# -w /etc/puppet/ssl -p wa -k puppet_ssl
## IBM Bigfix BESClient
# -a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient
# -w /var/opt/BESClient/ -p wa -k soft_besclient
## CHEF https://www.chef.io/chef/
# -w /etc/chef -p wa -k soft_chef
## Salt
## https://saltproject.io/
## https://docs.saltproject.io/en/latest/ref/configuration/master.html
# -w /etc/salt -p wa -k soft_salt
# -w /usr/local/etc/salt -p wa -k soft_salt
## Otter
## https://inedo.com/otter
# -w /etc/otter -p wa -k soft_otter
## T1081 Credentials In Files
-w /usr/bin/grep -p x -k T1081_Credentials_In_Files
-w /usr/bin/egrep -p x -k T1081_Credentials_In_Files
-w /usr/bin/ugrep -p x -k T1081_Credentials_In_Files
### macOS
-w /usr/local/bin/grep -p x -k T1081_Credentials_In_Files
-w /usr/local/bin/egrep -p x -k T1081_Credentials_In_Files
-w /usr/local/bin/ugrep -p x -k T1081_Credentials_In_Files
### https://github.com/tmbinc/bgrep
-w /usr/bin/bgrep -p x -k T1081_Credentials_In_Files
### macOS
-w /usr/local/bin/bgrep -p x -k T1081_Credentials_In_Files
### https://github.com/BurntSushi/ripgrep
-w /usr/bin/rg -p x -k T1081_Credentials_In_Files
### macOS
-w /usr/local/bin/rg -p x -k T1081_Credentials_In_Files
### https://github.com/monochromegane/the_platinum_searcher
-w /usr/bin/pt -p x -k T1081_Credentials_In_Files
### macOS
-w /usr/local/bin/pt -p x -k T1081_Credentials_In_Files
### https://github.com/gvansickle/ucg
-w /usr/bin/ucg -p x -k T1081_Credentials_In_Files
### macOS
-w /usr/local/bin/ucg -p x -k T1081_Credentials_In_Files
### https://github.com/ggreer/the_silver_searcher
-w /usr/bin/ag -p x -k T1081_Credentials_In_Files
### macOS
-w /usr/local/bin/ag -p x -k T1081_Credentials_In_Files
### https://github.com/beyondgrep/ack3
### https://beyondgrep.com
-w /usr/bin/ack -p x -k T1081_Credentials_In_Files
-w /usr/local/bin/ack -p x -k T1081_Credentials_In_Files
-w /usr/bin/semgrep -p x -k T1081_Credentials_In_Files
### macOS
-w /usr/local/bin/semgrep -p x -k T1081_Credentials_In_Files
## Docker
# -w /usr/bin/dockerd -k docker
# -w /usr/bin/docker -k docker
# -w /usr/bin/docker-containerd -k docker
# -w /usr/bin/docker-runc -k docker
# -w /var/lib/docker -k docker
# -w /etc/docker -k docker
# -w /etc/sysconfig/docker -k docker
# -w /etc/sysconfig/docker-storage -k docker
# -w /usr/lib/systemd/system/docker.service -k docker
# -w /usr/lib/systemd/system/docker.socket -k docker
## Virtualization stuff
-w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/bin/qemu-img -p x -k qemu-img -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/bin/qemu-kvm -p x -k qemu-kvm -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/bin/qemu -p x -k qemu -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/bin/virtualbox -p x -k virtualbox -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/bin/virt-manager -p x -k virt-manager -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/bin/VBoxManage -p x -k VBoxManage -k T1497_Virtualization_Sandbox_Evasion_System_Checks
#### VirtualBox
-w /usr/local/bin/VirtualBox -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/VirtualBoxVM -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/VBoxManage -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/VBoxVRDP -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/VBoxHeadless -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/vboxwebsrv -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/VBoxBugReport -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/VBoxBalloonCtrl -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/VBoxAutostart -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/VBoxDTrace -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/vbox-img -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
### Parallels Desktop
-w /usr/local/bin/prl_convert -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/prl_disk_tool -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/prl_perf_ctl -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/prlcore2dmp -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/prlctl -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/prlexec -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/prlsrvctl -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
### qemu on macOS
-w /usr/local/bin/qemu-edid -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/qemu-img -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/qemu-io -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/qemu-nbd -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
-w /usr/local/bin/qemu-system-x86_64 -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
## Kubelet
-w /usr/bin/kubelet -k kubelet
# ipc system call T1559_Inter-Process_Communication
# /usr/include/linux/ipc.h
## msgctl (non x86)
# -a always,exit -S ipc -F a0=14 -k T1559_Inter-Process_Communication
## msgget (non x86)
# -a always,exit -S ipc -F a0=13 -k T1559_Inter-Process_Communication
## Use these lines on x86_64, ia64 instead
-a always,exit -F arch=b64 -S msgctl -k T1559_Inter-Process_Communication
-a always,exit -F arch=b64 -S msgget -k T1559_Inter-Process_Communication
## semctl (non x86)
# -a always,exit -S ipc -F a0=3 -k T1559_Inter-Process_Communication
## semget (non x86)
# -a always,exit -S ipc -F a0=2 -k T1559_Inter-Process_Communication
## semop (non x86)
# -a always,exit -S ipc -F a0=1 -k T1559_Inter-Process_Communication
## semtimedop (non x86)
# -a always,exit -S ipc -F a0=4 -k T1559_Inter-Process_Communication
## Use these lines on x86_64, ia64 instead
-a always,exit -F arch=b64 -S semctl -k T1559_Inter-Process_Communication
-a always,exit -F arch=b64 -S semget -k T1559_Inter-Process_Communication
-a always,exit -F arch=b64 -S semop -k T1559_Inter-Process_Communication
-a always,exit -F arch=b64 -S semtimedop -k T1559_Inter-Process_Communication
## shmctl
# -a always,exit -S ipc -F a0=24 -k T1559_Inter-Process_Communication
## shmget
# -a always,exit -S ipc -F a0=23 -k T1559_Inter-Process_Communication
## Use these lines on x86_64, ia64 instead
-a always,exit -F arch=b64 -S shmctl -k T1559_Inter-Process_Communication
-a always,exit -F arch=b64 -S shmget -k T1559_Inter-Process_Communication
# High Volume Events ----------------------------------------------------------
## Remove them if they cause to much volume in your environment
## Root command executions
-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=4294967295 -S execve -k rootcmd
-a always,exit -F arch=b32 -F euid=0 -F auid>=1000 -F auid!=4294967295 -S execve -k rootcmd
## File Deletion Events by User
-a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete
-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete
## File Access
### Unauthorized Access (unsuccessful)
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access
### Unsuccessful Creation
-a always,exit -F arch=b32 -S creat,link,mknod,mkdir,symlink,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation
-a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation
-a always,exit -F arch=b32 -S link,mkdir,symlink,mkdirat -F exit=-EPERM -k file_creation
-a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation
### Unsuccessful Modification
-a always,exit -F arch=b32 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification
-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification
-a always,exit -F arch=b32 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification
-a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification
## File Deletion by User Related Events T1107_File_Deletion T1070_Indicator_Removal_on_Host
-a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k T1107_File_Deletion
-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k T1107_File_Deletion
-a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid=0 -k T1070_Indicator_Removal_on_Host
-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid=0 -k T1070_Indicator_Removal_on_Host
## 32bit API Exploitation
### If you are on a 64 bit platform, everything _should_ be running
### in 64 bit mode. This rule will detect any use of the 32 bit syscalls
### because this might be a sign of someone exploiting a hole in the 32
### bit API.
-a always,exit -F arch=b32 -S all -k 32bit_api
# Register incoming network connections
-a always,exit -S accept -k network_connection
#Log all commands (Noisy) T1059_CommandLine_Interface
#-a always,exit -F arch=b64 -S execve -k T1059_CommandLine_Interface
#-a always,exit -F arch=b32 -S execve -k T1059_CommandLine_Interface
# Other techniques
## Shell configuration Persistence Related Events T1156_bash_profile_and_bashrc
-w /etc/profile.d/ -k T1156_bash_profile_and_bashrc
-w /etc/profile -k T1156_bash_profile_and_bashrc
-w /etc/shells -k T1156_bash_profile_and_bashrc
-w /etc/bashrc -k T1156_bash_profile_and_bashrc
-w /etc/csh.cshrc -k T1156_bash_profile_and_bashrc
-w /etc/csh.login -k T1156_bash_profile_and_bashrc
## Data Copy(Local) T1005_Data_from_Local_System
-w /usr/bin/cp -p x -k T1005_Data_from_Local_System
-w /usr/bin/dd -p x -k T1005_Data_from_Local_System
## Privleged Command Execution Related Events
-a always,exit -F arch=b64 -F euid=0 -S execve -k T1078_Valid_Accounts
-a always,exit -F arch=b32 -F euid=0 -S execve -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/userdel -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/bin/umount -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/bin/mount -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/bin/su -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/bin/chgrp -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/bin/ping6 -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/sbin/pwck -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/suexec -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/newusers -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/groupdel -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/ccreds_validate -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
##-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/Xorg -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/rlogin -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/at -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/rsh -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/kgrantpty -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/rcp -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/newrole -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
-a always,exit -F path=/usr/bin/kpac_dhcp_helper -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
##C2 Releated Events
#Log 64 bit processes (a2!=6e filters local unix socket calls)
-a always,exit -F arch=b64 -S connect -F a2!=110 -k T1043_Commonly_Used_Port
#Log 32 bit processes (a0=3 means only outbound sys_connect calls)
-a always,exit -F arch=b32 -S socketcall -F a0=3 -k T1043_Commonly_Used_Port
## Priv Escalation Related Events
-a always,exit -F arch=b64 -C auid!=uid -S execve -k T1166_Seuid_and_Setgid
-a always,exit -F arch=b32 -C auid!=uid -S execve -k T1166_Seuid_and_Setgid
-a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -k T1166_Seuid_and_Setgid
-a always,exit -F arch=b32 -S setuid -S setgid -S setreuid -S setregid -k T1166_Seuid_and_Setgid
-a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -F exit=EPERM -k T1166_Seuid_and_Setgid
-a always,exit -F arch=b32 -S setuid -S setgid -S setreuid -S setregid -F exit=EPERM -k T1166_Seuid_and_Setgid
-w /usr/bin/ -p wa -k T1068_Exploitation_for_Privilege_Escalation
## Recon Related Events
-w /usr/sbin/nologin -k T1087_Account_Discovery
-w /sbin/nologin -k T1087_Account_Discovery
-w /etc/resolv.conf -k T1016_System_Network_Configuration_Discovery
-w /etc/hosts.allow -k T1016_System_Network_Configuration_Discovery
-w /etc/hosts.deny -k T1016_System_Network_Configuration_Discovery
-w /usr/bin/ps -p x -k T1057_Process_Discovery
- module: file_integrity
paths:
- /bin
- /usr/bin
- /sbin
- /usr/sbin
- /etc
# ================================= Processors =================================
# Configure processors to enhance or manipulate events generated by the beat.
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
output.logstash:
ssl.enabled: true
ssl.verification_mode: noneБыла ли эта страница полезной?
Спасибо за отзыв!
Спасибо, мы учтём это для улучшения документации.