SigmaHQ/rules/linux/auditd/lnx_auditd_susp_C2_commands.yml
2020-09-15 06:10:57 -06:00

21 lines
902 B
YAML

title: Suspicious C2 Activities
id: f7158a64-6204-4d6d-868a-6e6378b467e0
status: experimental
description: Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
author: Marie Euler
references:
- 'https://github.com/Neo23x0/auditd'
date: 2020/05/18
logsource:
product: linux
service: auditd
detection:
selection:
key:
- 'susp_activity'
condition: selection
falsepositives:
- Admin or User activity
level: medium
tags:
- attack.command_and_control