linux_deletion_of_cron_jobs.yml

name: Linux Deletion Of Cron Jobs
id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8
version: 2
date: '2023-04-27'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic is to detect a deletion of cron job in a linux machine.
  This technique can be related to an attacker, threat actor or malware to disable
  scheduled cron jobs that might be related to security or to evade some detections.
  We also saw that this technique can be a good indicator for malware that is trying
  to wipe or delete several files on the compromised host like the acidrain malware.
  This anomaly detection can be a good pivot detection to look for process and user
  doing it why they doing. Take note that this event can be done by administrator
  so filtering on those possible false positive event is needed.
data_source:
- Sysmon for Linux EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path="/etc/cron.*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest
  Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)`
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`| `linux_deletion_of_cron_jobs_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
  Splunkbase.
known_false_positives: Administrator or network operator can execute this command.
  Please update the filter macros to remove false positives.
references:
- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
tags:
  analytic_story:
  - AcidRain
  - Data Destruction
  asset_type: Endpoint
  confidence: 70
  impact: 70
  message: Linux cron jobs are deleted on host $dest$ by process GUID- $process_guid$
  mitre_attack_id:
  - T1485
  - T1070.004
  - T1070
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: file_name
    type: File Name
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Filesystem.dest
  - Filesystem.file_create_time
  - Filesystem.file_name
  - Filesystem.process_guid
  - Filesystem.file_path
  - Filesystem.action
  risk_score: 49
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log
    source: Syslog:Linux-Sysmon/Operational
    sourcetype: sysmon_linux