mirror of https://github.com/infosecn1nja/HELK.git
141 lines
3.6 KiB
Plaintext
141 lines
3.6 KiB
Plaintext
{
|
|
"cells": [
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"# Program Executions in Suspicious Folders\n",
|
|
"Detects program executions in suspicious non-program folders related to malware or hacking activity"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"## Rule Content\n",
|
|
"```\n",
|
|
"- title: Program Executions in Suspicious Folders\n",
|
|
" id: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc\n",
|
|
" status: experimental\n",
|
|
" description: Detects program executions in suspicious non-program folders related\n",
|
|
" to malware or hacking activity\n",
|
|
" references:\n",
|
|
" - Internal Research\n",
|
|
" date: 2018/01/23\n",
|
|
" author: Florian Roth\n",
|
|
" logsource:\n",
|
|
" product: linux\n",
|
|
" service: auditd\n",
|
|
" category: null\n",
|
|
" detection:\n",
|
|
" selection:\n",
|
|
" type: SYSCALL\n",
|
|
" exe:\n",
|
|
" - /tmp/*\n",
|
|
" - /var/www/*\n",
|
|
" - /home/*/public_html/*\n",
|
|
" - /usr/local/apache2/*\n",
|
|
" - /usr/local/httpd/*\n",
|
|
" - /var/apache/*\n",
|
|
" - /srv/www/*\n",
|
|
" - /home/httpd/html/*\n",
|
|
" - /srv/http/*\n",
|
|
" - /usr/share/nginx/html/*\n",
|
|
" - /var/lib/pgsql/data/*\n",
|
|
" - /usr/local/mysql/data/*\n",
|
|
" - /var/lib/mysql/*\n",
|
|
" - /var/vsftpd/*\n",
|
|
" - /etc/bind/*\n",
|
|
" - /var/named/*\n",
|
|
" condition: selection\n",
|
|
" falsepositives:\n",
|
|
" - Admin activity (especially in /tmp folders)\n",
|
|
" - Crazy web applications\n",
|
|
" level: medium\n",
|
|
"\n",
|
|
"```"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"## Querying Elasticsearch"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Import Libraries"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"from elasticsearch import Elasticsearch\n",
|
|
"from elasticsearch_dsl import Search\n",
|
|
"import pandas as pd"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Initialize Elasticsearch client"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"es = Elasticsearch(['http://helk-elasticsearch:9200'])\n",
|
|
"searchContext = Search(using=es, index='logs-*', doc_type='doc')"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Run Elasticsearch Query"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"s = searchContext.query('query_string', query='(type:\"SYSCALL\" AND exe.keyword:(\\/tmp\\/* OR \\/var\\/www\\/* OR \\/home\\/*\\/public_html\\/* OR \\/usr\\/local\\/apache2\\/* OR \\/usr\\/local\\/httpd\\/* OR \\/var\\/apache\\/* OR \\/srv\\/www\\/* OR \\/home\\/httpd\\/html\\/* OR \\/srv\\/http\\/* OR \\/usr\\/share\\/nginx\\/html\\/* OR \\/var\\/lib\\/pgsql\\/data\\/* OR \\/usr\\/local\\/mysql\\/data\\/* OR \\/var\\/lib\\/mysql\\/* OR \\/var\\/vsftpd\\/* OR \\/etc\\/bind\\/* OR \\/var\\/named\\/*))')\n",
|
|
"response = s.execute()\n",
|
|
"if response.success():\n",
|
|
" df = pd.DataFrame((d.to_dict() for d in s.scan()))"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Show Results"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"df.head()"
|
|
]
|
|
}
|
|
],
|
|
"metadata": {},
|
|
"nbformat": 4,
|
|
"nbformat_minor": 4
|
|
}
|