Linux HackTool Execution

Title: Linux HackTool Execution
Status: test
Description:Detects known hacktool execution based on image name.
References:
  -https://github.com/Gui774ume/ebpfkit
  -https://github.com/pathtofile/bad-bpf
  -https://github.com/carlospolop/PEASS-ng
  -https://github.com/t3l3machus/hoaxshell
  -https://github.com/t3l3machus/Villain
  -https://github.com/HavocFramework/Havoc
  -https://github.com/1N3/Sn1per
  -https://github.com/Ne0nd0g/merlin
  -https://github.com/Pennyw0rth/NetExec/
Author: Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Date: 2023-01-03
modified:2024-09-19
Tags:

• -'attack.execution'
• -'attack.resource-development'
• -'attack.t1587'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection_c2_frameworks:
    Image|endswith:
      -'/crackmapexec'
      -'/havoc'
      -'/merlin-agent'
      -'/merlinServer-Linux-x64'
      -'/msfconsole'
      -'/msfvenom'
      -'/ps-empire server'
      -'/ps-empire'
      -'/sliver-client'
      -'/sliver-server'
      -'/Villain.py'

  selection_c2_framework_cobaltstrike:
    Image|contains:
      -'/cobaltstrike'
      -'/teamserver'

  selection_scanners:
    Image|endswith:
      -'/autorecon'
      -'/httpx'
      -'/legion'
      -'/naabu'
      -'/netdiscover'
      -'/nuclei'
      -'/recon-ng'

  selection_scanners_sniper:
    Image|contains: '/sniper'
  selection_web_enum:
    Image|endswith:
      -'/dirb'
      -'/dirbuster'
      -'/eyewitness'
      -'/feroxbuster'
      -'/ffuf'
      -'/gobuster'
      -'/wfuzz'
      -'/whatweb'

  selection_web_vuln:
    Image|endswith:
      -'/joomscan'
      -'/nikto'
      -'/wpscan'

  selection_exploit_tools:
    Image|endswith:
      -'/aircrack-ng'
      -'/bloodhound-python'
      -'/bpfdos'
      -'/ebpfki'
      -'/evil-winrm'
      -'/hashcat'
      -'/hoaxshell.py'
      -'/hydra'
      -'/john'
      -'/ncrack'
      -'/nxc-ubuntu-latest'
      -'/pidhide'
      -'/pspy32'
      -'/pspy32s'
      -'/pspy64'
      -'/pspy64s'
      -'/setoolkit'
      -'/sqlmap'
      -'/writeblocker'

  selection_linpeas:
    Image|contains: '/linpeas'
  condition:1 of selection_*
Falsepositives:
  -Unlikely
Level: high