Snapattack Linux Conversions

[RavenTait]

Details

This PR adds multiple new detections converted from Snap Attack. Below is a detailed summary of the changes introduced by the review.

New Analytics [24]

Multiple analytics (a total of 24) have been added in this PR covering a bunch of techniques.

• Linux Bash History Access
• Linux Bash Pseudo Device Reverse Shell
• Linux Binary Executed from Shared Memory Directory
• Linux EFI Bootloader File Deletion
• Linux Ghostscript Exploitation
• Linux MOTD Script Added
• Linux Netcat Outbound Connection
• Linux Persistence via System Generator
• Linux Possible Bootloader Modifications
• Linux Possible GSM Privilege Escalation
• Linux Possible Nimbuspwn Privilege Escalation
• Linux Possible Privilege Escalation via PYTHONPATH
• Linux Possible System Binary Backdoor
• Linux Root execution of id
• Linux Suspicious Child Process of Postgresql
• Linux Suspicious Docker Build
• Linux Suspicious GCC Invocation Building Init Shared Object
• Linux Suspicious Privileged Container
• Linux Suspicious Redis Activity
• Linux Suspicious Staging of Alternate System Files
• Linux Suspicious Sudo Parameter
• Linux Suspicious XDG Autostart
• Linux UDEV Rule Created
• Linux Usermod Root UID Set

[Copilot]

Pull request overview

Adds a new set of Linux endpoint detections converted from Snap Attack to expand coverage across privilege escalation, persistence, and post-exploitation behaviors in the Splunk Security Content detections catalog.

Changes:

• Introduces 24 new Linux endpoint detection YAMLs (primarily Sysmon for Linux EventID 1/11 and Network_Traffic DM).
• Adds drilldowns, findings/intermediate findings, ATT&CK mappings, and references for each analytic.
• Includes unit-test pointers to corresponding attack_data datasets for each new detection.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
detections/endpoint/linux_usermod_root_uid_set.yml	Detects usermod attempts to set UID 0.
detections/endpoint/linux_udev_rule_created.yml	Detects creation of udev rule files in standard udev rule directories.
detections/endpoint/linux_suspicious_xdg_autostart.yml	Detects .desktop file creation in XDG autostart locations.
detections/endpoint/linux_suspicious_sudo_parameter.yml	Detects suspicious sudo flags associated with privesc techniques.
detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml	Detects staging of sensitive system files outside canonical paths (chwoot-style).
detections/endpoint/linux_suspicious_redis_activity.yml	Detects Redis spawning suspicious child processes indicative of exploitation.
detections/endpoint/linux_suspicious_privileged_container.yml	Detects Docker runs with elevated options (privileged/host PID).
detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml	Detects gcc usage consistent with init-hook shared object build patterns.
detections/endpoint/linux_suspicious_docker_build.yml	Detects Docker builds executed from or targeting /tmp.
detections/endpoint/linux_suspicious_child_process_of_postgresql.yml	Detects PostgreSQL spawning shell/interpreter/network utilities.
detections/endpoint/linux_root_execution_of_id.yml	Detects root executing id as a post-exploitation validation behavior.
detections/endpoint/linux_possible_system_binary_backdoor.yml	Detects overwrites of common Linux system binaries.
detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml	Detects suspicious creation of importlib/__init__.so outside expected lib paths.
detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml	Detects potential Nimbuspwn directory traversal patterns.
detections/endpoint/linux_possible_gsm_privilege_escalation.yml	Detects command patterns associated with GSM multiplexor race-condition exploitation.
detections/endpoint/linux_possible_bootloader_modifications.yml	Detects process activity interacting with EFI boot paths.
detections/endpoint/linux_persistence_via_system_generator.yml	Detects file creation in systemd generator directories.
detections/endpoint/linux_netcat_outbound_connection.yml	Detects outbound connections originating from netcat-like tools.
detections/endpoint/linux_motd_script_added.yml	Detects file creation in /etc/update-motd.d for persistence.
detections/endpoint/linux_ghostscript_exploitation.yml	Detects Ghostscript spawning sh -c indicative of exploitation.
detections/endpoint/linux_efi_bootloader_file_deletion.yml	Detects deletion of EFI bootloader files.
detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml	Detects execution from /dev/shm or /run/shm (tmpfs/shared memory).
detections/endpoint/linux_bash_pseudo_device_reverse_shell.yml	Detects bash /dev/tcp and /dev/udp reverse shell patterns.
detections/endpoint/linux_bash_history_access.yml	Detects reads of bash history files via common file viewing tools.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nasbench]

This is true but the typo is that All_Traffic.process_name is not a correct field in [All_Traffic] (https://help.splunk.com/en/splunk-cloud-platform/common-information-model/8.6/data-models/network-traffic) DM