splunk · RavenTait · Jul 20, 2026 · Jul 21, 2026 · Jul 29, 2026
@@ -0,0 +1,73 @@
+name: Linux Bash History Access
+id: 0e4c2544-b27a-4a2d-b9be-cac8efe515fb
+version: 1
+creation_date: '2026-07-08'
+modification_date: '2026-07-08'
+author: Raven Tait, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects attempts to read bash history files. A bash history file is a log file that records all the commands executed in a Bash shell on a Linux or Unix-based operating system. A malicious actor who gains access to a user's bash history file can potentially obtain sensitive information and use it to compromise the user's system and data.
+data_source:
+    - Sysmon for Linux EventID 1
+search: |-
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where
+    Processes.process IN ("cat*", "head*", "tail*", "more*", "less*")
+    Processes.process="*.bash_history*"
+    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
+    Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest
+    Processes.process_current_directory Processes.process_path Processes.process_integrity_level
+    Processes.original_file_name Processes.parent_process Processes.parent_process_path
+    Processes.parent_process_guid Processes.parent_process_id Processes.process_guid
+    Processes.process_id Processes.user Processes.process_name
+    | `drop_dm_object_name(Processes)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `linux_bash_history_access_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators and automated scripts may access bash history files for auditing or troubleshooting purposes. Filter based on known administrative accounts and approved tooling in your environment.
+drilldown_searches:
+    - earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+      name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: '0'
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: Potential Bash History Access by $user$ on $dest$ via $process_name$.
+        - field: user
+          type: user
+          score: 20
+          message: Potential Bash History Access by $user$ on $dest$ via $process_name$.
+threat_objects:
+    - field: process_name
+      type: process_name
+analytic_story:
+    - Linux Post-Exploitation
+    - Compromised Linux Host
+    - Linux Privilege Escalation
+    - Linux Persistence Techniques
+    - Credential Dumping
+asset_type: Endpoint
+mitre_attack_id:
+    - T1552.003
+    - T1552.003
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      test_type: unit
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log
+          source: Syslog:Linux-Sysmon/Operational
+          sourcetype: sysmon:linux
@@ -0,0 +1,77 @@
+name: Linux Bash Pseudo Device Reverse Shell
+id: f324bc06-8436-4606-8882-0a8fb480b719
+version: 1
+creation_date: '2026-07-08'
+modification_date: '2026-07-08'
+author: Raven Tait, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the use of Bash's /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections. This special file system interface allows opening a network socket and sending or receiving data using simple shell commands. Attackers commonly abuse this native Bash capability to create reverse shells without requiring external tools such as netcat, by redirecting shell I/O over a TCP or UDP connection to an attacker-controlled host and port.
+data_source:
+    - Sysmon for Linux EventID 1
+search: |-
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where
+    Processes.process_path IN ("*/bash*", "*/sh*", "*/zsh*","*/dash*")
+    Processes.process IN ("*/dev/tcp/*", "*/dev/udp/*")
+    by Processes.process Processes.vendor_product
+    Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
+    Processes.action Processes.dest Processes.process_current_directory Processes.process_path
+    Processes.process_integrity_level Processes.original_file_name Processes.parent_process
+    Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
+    Processes.process_guid Processes.process_id Processes.user Processes.process_name
+    | `drop_dm_object_name(Processes)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    |`linux_bash_pseudo_device_reverse_shell_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators or developers may use /dev/tcp or /dev/udp for network diagnostics or testing purposes. Filter based on known authorized users and trusted source systems.
+references:
+    - https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#bash-tcp
+drilldown_searches:
+    - earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+      name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: '0'
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: Potential Bash Reverse Shell by $user$ on $dest$ via $process_name$.
+        - field: user
+          type: user
+          score: 20
+          message: Potential Bash Reverse Shell by $user$ on $dest$ via $process_name$.
+threat_objects:
+    - field: parent_process_name
+      type: parent_process_name
+    - field: process_name
+      type: process_name
+analytic_story:
+    - Linux Post-Exploitation
+    - Linux Persistence Techniques
+    - Linux Privilege Escalation
+    - Command And Control
+    - Compromised Linux Host
+asset_type: Endpoint
+mitre_attack_id:
+    - T1059
+    - T1048.003
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      test_type: unit
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log
+          source: Syslog:Linux-Sysmon/Operational
+          sourcetype: sysmon:linux
@@ -0,0 +1,78 @@
+name: Linux Binary Executed from Shared Memory Directory
+id: 2e954190-d547-447c-94d7-d8acac97873b
+version: 1
+creation_date: '2026-07-08'
+modification_date: '2026-07-08'
+author: Raven Tait, Splunk
+status: production
+type: Anomaly
+description: The following analytic identifies the execution of a binary by root from Linux shared memory directories (/dev/shm/ and /run/shm/). Threat actors place executables in these directories to persist on high-uptime servers as system backdoors. Both /dev/shm and /run/shm are tmpfs-backed directories that exist only in virtual memory with no persistent storage, making them attractive for staging fileless or semi-fileless malware while avoiding disk forensics.
+data_source:
+    - Sysmon for Linux EventID 1
+search: |-
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where
+    Processes.process_path IN ("/dev/shm/*", "/run/shm/*")
+    Processes.user=root
+    by Processes.process Processes.process_path Processes.process_name Processes.user
+    Processes.user_id Processes.process_hash Processes.parent_process_name
+    Processes.parent_process_path Processes.parent_process Processes.parent_process_guid
+    Processes.parent_process_id Processes.process_guid Processes.process_id
+    Processes.vendor_product Processes.action Processes.dest
+    Processes.process_current_directory Processes.process_integrity_level
+    Processes.original_file_name
+    | `drop_dm_object_name(Processes)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `linux_binary_executed_from_shared_memory_directory_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate applications may use shared memory directories for temporary file storage or inter-process communication. Verify any flagged activity against known software behavior and filter accordingly.
+references:
+    - https://linuxsecurity.com/features/fileless-malware-on-linux
+    - https://twitter.com/GossiTheDog/status/1522964028284411907
+    - https://github.com/elastic/detection-rules/blob/main/rules/linux/execution_process_started_in_shared_memory_directory.toml
+drilldown_searches:
+    - earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+      name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: '0'
+threat_objects:
+    - field: process_name
+      type: process_name
+    - field: process_path
+      type: process
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: Binary Executed from Shared Memory Directory activity observed on $dest$.
+        - field: user
+          type: user
+          score: 20
+          message: Binary Executed from Shared Memory Directory activity observed on $dest$.
+analytic_story:
+    - Linux Post-Exploitation
+    - Linux Persistence Techniques
+    - Linux Privilege Escalation
+    - Compromised Linux Host
+asset_type: Endpoint
+mitre_attack_id:
+    - T1059
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      test_type: unit
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log
+          source: Syslog:Linux-Sysmon/Operational
+          sourcetype: sysmon:linux
@@ -0,0 +1,69 @@
+name: Linux EFI Bootloader File Deletion
+id: 818a63f8-f2e1-4d1b-ac95-3a4f2ec7f113
+version: 1
+creation_date: '2026-07-08'
+modification_date: '2026-07-08'
+author: Raven Tait, Splunk
+status: production
+type: TTP
+description: The following analytic detects file deletions in the EFI boot directory. These files are responsible for initializing the Boot Manager during system startup. Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.
+data_source:
+    - Sysmon for Linux EventID 11
+search: |-
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Filesystem where
+    Filesystem.action=deleted
+    Filesystem.file_path="*/boot/efi/EFI/BOOT/*"
+    Filesystem.file_name="*.efi*"
+    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
+    Filesystem.action Filesystem.process_guid Filesystem.process_id
+    | `drop_dm_object_name(Filesystem)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `linux_efi_bootloader_file_deletion_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file deletion events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators or package managers may delete or replace EFI bootloader files during system updates or OS reinstallation. Filter for known maintenance windows and authorized administrative activity.
+references:
+    - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/
+    - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/
+drilldown_searches:
+    - earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+      name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: '0'
+finding:
+    title: Linux EFI Bootloader File Deletion detected on $dest$
+    entity:
+        field: dest
+        type: system
+        score: 50
+threat_objects:
+    - field: file_name
+      type: file_name
+analytic_story:
+    - Data Destruction
+    - Linux Persistence Techniques
+    - Ransomware
+asset_type: Endpoint
+cve:
+    - CVE-2024-7344
+mitre_attack_id:
+    - T1542.001
+    - T1542.003
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      test_type: unit
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log
+          source: Syslog:Linux-Sysmon/Operational
+          sourcetype: sysmon:linux