corpus.blog
41,554 blogs · 5,316,985 posts Claim your blog
Record · corpus.blog/posts/01a087be-871a-716d-9022-ed2c72aac1f9

Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)

pberba.github.io · published 22 November 2021

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at pberba.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
38
Words captured
6,976

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://attack.mitre.org/matrices/enterprise/linux/
attack.mitre.org
https://attack.mitre.org/tactics/TA0003/
attack.mitre.org
https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-file_integrity.html
elastic.co
https://www.redhat.com/sysadmin/configure-linux-auditing-auditd
redhat.com
https://github.com/Sysinternals/SysmonForLinux
github.com
https://github.com/elastic/integrations/issues/1930
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/discovery/T1087.001_LocalAccount_Commands.xml
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/defense_evasion/T1070.006_Timestomp_Touch.xml
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
github.com
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing
access.redhat.com
https://linuxsecurity.com/features/lead-microsoft-engineer-kevin-sheldrake-brings-sysmon-to-linux
linuxsecurity.com
https://github.com/fleetdm/fleet
github.com
https://osquery.io/downloads/official/5.0.1
osquery.io
https://republicans-oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
republicans-oversight.house.gov
https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
owasp.org
https://github.com/JohnTroony/php-webshells/tree/master/Collection
github.com
https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_web_rce.yml
github.com
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-defining_audit_rules_and_controls
access.redhat.com
https://github.com/microsoft/MSTIC-Sysmon
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1505.003_WebShell_SuspSubProcesses.xml
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/75e131c07a3dc96ccddbeffa8c1d91e0759d4b25/linux/configs/attack-based/execution/T1059.004_UnixShell_CommonShells.xml
github.com
https://www.linkedin.com/pulse/using-auditd-monitor-network-connections-alex-maestretti/
linkedin.com
https://github.com/christophetd/log4shell-vulnerable-app
github.com
https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
huntress.com
https://www.digitalocean.com/community/tutorials/how-to-install-linux-nginx-mysql-php-lemp-stack-in-ubuntu-16-04
digitalocean.com
https://unsplash.com/@brookanderson?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText
unsplash.com
https://unsplash.com/s/photos/climbing?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText
unsplash.com
https://documentation.wazuh.com/current/learning-wazuh/detect-fs-changes.html
documentation.wazuh.com
https://github.com/Neo23x0/auditd
github.com
https://github.com/microsoft/MSTIC-Sysmon/tree/main/linux
github.com
https://attack.mitre.org/techniques/T1505/003/
attack.mitre.org
https://portswigger.net/web-security/os-command-injection
portswigger.net
https://github.com/Neo23x0/auditd/blob/master/audit.rules
github.com
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
docs.microsoft.com
https://techcommunity.microsoft.com/t5/sysinternals-blog/sysmon-the-rules-about-rules/ba-p/733649
techcommunity.microsoft.com
https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml
github.com
https://github.com/Sysinternals/SysmonForLinux/blob/main/INSTALL.md
github.com
https://www.elastic.co/guide/en/beats/auditbeat/7.15/auditbeat-installation-configuration.html
elastic.co