Linux Recon Indicators

Title: Linux Recon Indicators
Status: test
Description:Detects events with patterns found in commands used for reconnaissance on linux systems
References:
  -https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py
Author: Florian Roth (Nextron Systems)
Date: 2022-06-20
modified:None
Tags:

• -'attack.reconnaissance'
• -'attack.t1592.004'
• -'attack.credential-access'
• -'attack.t1552.001'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection:
    CommandLine|contains:
      -' -name .htpasswd'
      -' -perm -4000 '

  condition:selection
Falsepositives:
  -Legitimate administration activities
Level: high