Linux CommandLine Use - Require Laurel / Sysmon / EDR

[Neo23x0]

Since Laurel now supports the concatenation of all parameters to a full command line, I'd like to make all new(!) Linux rules that trigger on command line values use the CommandLine field as if it existed.
This will get more attention and support as soon as Sysmon for Linux is out.

Laurel change
https://twitter.com/cyb3rops/status/1442030203320995846

Rules with ugly "a0", "a1" values used in native auditd logs
https://github.com/SigmaHQ/sigma/search?q=a0

Writing rules for the original auditd is just a pain in the neck.
We'd have to add these requirements in the description as we do it now in some cases in which special Sysmon EventIDs or PowerShell ScriptBlock logging has to be enabled to make that rule work.

[frack113]

HI,
I agree but I would like have the directory like :

• linux/auditd_old (My fisrt think "raw")
• linux/auditd_laurel

So If I don't have laurel (will be the case) I take only the "auditd_old" rule.

We'd have to add these requirements in the description as we do it now in some cases in which special Sysmon EventIDs or PowerShell ScriptBlock logging has to be enabled to make that rule work.

I agree since I spent my time completing the rules .

[Neo23x0]

Since Sysmon for Linux we be release later today and I expect it to have a full CommandLine value as well, we shouldn't call it auditd_laurel.

Maybe we can leave auditd as it is and create a new Linux generic category, as in windows, named process_creation, that would contain rules for all kinds of log generators running on Linux. Rules in this category would work with the CommandLine field and maybe an Image field.

We should check the overlapping field names in Sysmon for Linux and Laurel, once it gets released.
Maybe we can align or map the field names in the respective configs for Sysmon and Laurel.

[frack113]

auditd is a mess (a0 to a999 in the specs) and should stay in its own directory.
I am realy waiting to see the final result of sysmon.
I hope that the laurel output will be compatible with sysmon or that there will be a PR to "normalize" the 2...

What about the macos rules ?
Maybe there will be a sysmon for mac 😆

[Neo23x0]

See: https://twitter.com/cyb3rops/status/1448707500086337540

[Neo23x0]

Let me push a first rule in a pull request to show you all what I intend to do in the Linux>process_creation category

[Neo23x0]

Currently config/generic/sysmon.yml has this config. It seems that the Linux events don't have an EventID as the Sysmon events on Windows have. I think, we'd have to create a sysmon-linux.yml to allow a successful conversion.

[Neo23x0]

Oh, it has an EventID and it's the same

[Neo23x0]

[nasbench]

Closing this as outdated.