Linux Persistence and Privilege Escalation Risk Behavior

name: Linux Persistence and Privilege Escalation Risk Behavior
id: ad5ac21b-3b1e-492c-8e19-ea5d5e8e5cf1
version: 11
creation_date: '2022-07-21'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Correlation
description: The following analytic identifies potential Linux persistence and privilege escalation activities. It leverages risk scores and event counts from various Linux-related data sources, focusing on tactics associated with persistence and privilege escalation. This activity is significant for a SOC because it highlights behaviors that could allow an attacker to maintain access or gain elevated privileges on a Linux system. If confirmed malicious, this activity could enable an attacker to execute code with higher privileges, persist in the environment, and potentially access sensitive information, posing a severe security risk.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
      WHERE (
            All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques")
            OR
            source = "*Linux*"
        )
        All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system"
      BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >= 4
    | `linux_persistence_and_privilege_escalation_risk_behavior_filter`
how_to_implement: Ensure Linux anomaly and TTP analytics are enabled. TTP may be set to finding  for point detections, anomaly should not be findings but risk generators. The correlation relies on more than x amount of distict detection names generated before generating a finding. Modify the value as needed. Default value is set to 4. This value may need to be increased based on activity in your environment.
known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers.
references:
    - https://attack.mitre.org/tactics/TA0004/
drilldown_searches:
    - name: View the detection results for - "$risk_object$"
      search: '%original_detection_search% | search  risk_object = "$risk_object$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$risk_object$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: Linux Persistence and Privilege Escalation Risk Behavior - $risk_object$
    entity:
        field: risk_object
        type: system
        score: 0
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1548
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: audit
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/linux_risk/linuxrisk.log
          source: linuxrisk
          sourcetype: stash
      test_type: unit