Splunk Add-on for Sysmon for Linux is archived on Splunkbase
Abierto
Los mantenedores suelen responder en 1 día
@nasbench ya está trabajando en esto.
Desde el 1/10/2026.
Evaluación
Este issue todavía no se ha evaluado.
Descripción
Splunkbase TA: Splunk Add-on for Sysmon for Linux
This archived Splunkbase TA is referenced by data source objects used by detections.
Data source objects and detections
- Sysmon for Linux EventID 1
- Detection: Curl Execution with Percent Encoded URL
- Detection: File Download or Read to Pipe Execution
- Detection: Linux Add User Account
- Detection: Linux Apparmor Bypass Via Aaexec
- Detection: Linux APT Privilege Escalation
- Detection: Linux At Application Execution
- Detection: Linux AWK Privilege Escalation
- Detection: Linux Binary Executed from Shared Memory Directory
- Detection: Linux Busybox Privilege Escalation
- Detection: Linux c89 Privilege Escalation
- Detection: Linux c99 Privilege Escalation
- Detection: Linux Change File Owner To Root
- Detection: Linux Clipboard Data Copy
- Detection: Linux Common Process For Elevation Control
- Detection: Linux Composer Privilege Escalation
- Detection: Linux Cpulimit Privilege Escalation
- Detection: Linux Crontab Enumeration
- Detection: Linux Csvtool Privilege Escalation
- Detection: Linux Curl Upload File
- Detection: Linux Data Destruction Command
- Detection: Linux DD File Overwrite
- Detection: Linux Decode Base64 to Shell
- Detection: Linux Deleting Critical Directory Using RM Command
- Detection: Linux Disable Services
- Detection: Linux Doas Tool Execution
- Detection: Linux Docker Root Directory Mount
- Detection: Linux Docker Shell Execution
- Detection: Linux Edit Cron Table Parameter
- Detection: Linux Emacs Privilege Escalation
- Detection: Linux Find Privilege Escalation
- Detection: Linux GDB Privilege Escalation
- Detection: Linux Gdrive Binary Activity
- Detection: Linux Gem Privilege Escalation
- Detection: Linux Ghostscript Exploitation
- Detection: Linux GNU Awk Privilege Escalation
- Detection: Linux Hardware Addition SwapOff
- Detection: Linux Impair Defenses Process Kill
- Detection: Linux Indicator Removal Clear Cache
- Detection: Linux Indicator Removal Service File Deletion
- Detection: Linux Ingress Tool Transfer Hunting
- Detection: Linux Ingress Tool Transfer with Curl
- Detection: Linux Insert Kernel Module Using Insmod Utility
- Detection: Linux Install Kernel Module Using Modprobe Utility
- Detection: Linux Iptables Firewall Modification
- Detection: Linux Kernel Module Enumeration
- Detection: Linux Kworker Process In Writable Process Path
- Detection: Linux Make Privilege Escalation
- Detection: Linux MySQL Privilege Escalation
- Detection: Linux Ngrok Reverse Proxy Usage
- Detection: Linux Node Privilege Escalation
- Detection: Linux NOPASSWD Entry In Sudoers File
- Detection: Linux Obfuscated Files or Information Base64 Decode
- Detection: Linux Octave Privilege Escalation
- Detection: Linux OpenVPN Privilege Escalation
- Detection: Linux PHP Privilege Escalation
- Detection: Linux pkexec Privilege Escalation
- Detection: Linux Possible Access Or Modification Of sshd Config File
- Detection: Linux Possible Access To Credential Files
- Detection: Linux Possible Access To Sudoers File
- Detection: Linux Possible Append Command To At Allow Config File
- Detection: Linux Possible Append Command To Profile Config File
- Detection: Linux Possible Append Cronjob Entry on Existing Cronjob File
- Detection: Linux Possible Bootloader Modification
- Detection: Linux Possible Cronjob Modification With Editor
- Detection: Linux Possible GSM Privilege Escalation
- Detection: Linux Possible Nimbuspwn Privilege Escalation
- Detection: Linux Preload Hijack Library Calls
- Detection: Linux Proxy Socks Curl
- Detection: Linux Puppet Privilege Escalation
- Detection: Linux Root Execution of id
- Detection: Linux RPM Privilege Escalation
- Detection: Linux Ruby Privilege Escalation
- Detection: Linux Service Restarted
- Detection: Linux Service Started Or Enabled
- Detection: Linux Setuid Using Chmod Utility
- Detection: Linux Setuid Using Setcap Utility
- Detection: Linux Shell History Access Via Command Line Utility
- Detection: Linux Shell Pseudo Device Reverse Shell
- Detection: Linux Shred Overwrite Command
- Detection: Linux Sqlite3 Privilege Escalation
- Detection: Linux SSH Authorized Keys Modification
- Detection: Linux SSH Remote Services Script Execute
- Detection: Linux Stdout Redirection To Dev Null File
- Detection: Linux Stop Services
- Detection: Linux Sudo OR Su Execution
- Detection: Linux Suspicious Child Process of PostgreSQL
- Detection: Linux Suspicious Docker Build Command Execution
- Detection: Linux Suspicious GCC Invocation Building Init Shared Object
- Detection: Linux Suspicious Namespace Creation
- Detection: Linux Suspicious Privileged Container Execution
- Detection: Linux Suspicious React or Next.js Child Process
- Detection: Linux Suspicious Redis Activity
- Detection: Linux System Network Discovery
- Detection: Linux System Reboot Via System Request Key
- Detection: Linux Telnet Authentication Bypass
- Detection: Linux Unix Shell Enable All SysRq Functions
- Detection: Linux Usermod Root UID Set
- Detection: Linux Visudo Utility Execution
- Detection: Socat Network Listener Binding an Executable
- Detection: Socat Remote TCP Connection with Local Echo Disabled
- Detection: Suspicious Curl Network Connection
- Detection: Suspicious Linux Discovery Commands
- Detection: Web or Application Server Spawning a Shell
- Sysmon for Linux EventID 11
- Detection: GitHub Workflow File Creation or Modification
- Detection: Linux Account Manipulation Of SSH Config and Keys
- Detection: Linux Add Files In Known Crontab Directories
- Detection: Linux At Allow Config File Creation
- Detection: Linux Deletion Of Cron Jobs
- Detection: Linux Deletion Of Init Daemon Script
- Detection: Linux Deletion Of Services
- Detection: Linux Deletion of SSL Certificate
- Detection: Linux Doas Conf File Creation
- Detection: Linux EFI Bootloader File Deletion
- Detection: Linux File Created In Kernel Driver Directory
- Detection: Linux File Creation In Init Boot Directory
- Detection: Linux File Creation In Profile Directory
- Detection: Linux File Creation In System Generator Directory
- Detection: Linux High Frequency Of File Deletion In Boot Folder
- Detection: Linux High Frequency Of File Deletion In Etc Folder
- Detection: Linux Medusa Rootkit
- Detection: Linux MOTD Script Added
- Detection: Linux Possible Privilege Escalation via PYTHONPATH
- Detection: Linux Possible Ssh Key File Creation
- Detection: Linux Possible System Binary Backdoor
- Detection: Linux Service File Created In Systemd Directory
- Detection: Linux Sudoers Tmp File Creation
- Detection: Linux Suspicious Staging of Alternate System Files
- Detection: Linux Suspicious XDG Autostart
- Detection: Linux UDEV Rule Created
- Detection: Shai-Hulud 2 Exfiltration Artifact Files
- Detection: Shai-Hulud Workflow File Creation or Modification
- Sysmon for Linux EventID 3
- Detection: Linux Netcat Outbound Connection
This issue is maintained automatically by the archived TA daily workflow.
- Lenguaje dominante
- Python
- Estrellas
- 1.7k
- Forks
- 502
- Merge medio
- 4 d 2 h
- PR fusionados (30 d)
- 56
Preparar el entorno
- Sin Dockerfile ni archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de splunk/security_content
-
[BUG] Improve net.exe and net1.exe Detection Logic in Windows Cmdline Tool Execution From Non-Shell ProcessPosiblemente ocupada @mvanhorn la tomó hace 9 días. Abiertobug
Dificultad 2/5 1-3 horas Aptitud para principiantes 62/100
splunk/security_content#4334 · 1 comentario · 1 reacción ·
Los mantenedores suelen responder en 1 día
-
feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure FirewallPosiblemente ocupada @AAH20 la tomó hace 66 días. Abierto
Dificultad 4/5 3-5 días Aptitud para principiantes 45/100
splunk/security_content#4220 · 2 comentarios ·
Los mantenedores suelen responder en 1 día
-
Suggested Enhancement for Detection: Windows AD Short Lived Domain Account ServicePrincipalNameQuizá libre de nuevo @patel-bhavin la tomó hace 219 días y no hay ningún pull request abierto. Abiertoenhancement
splunk/security_content#3941 · 1 asignado ·
Los mantenedores suelen responder en 1 día
-
enhancement
Dificultad 3/5 1-2 días Aptitud para principiantes 58/100
splunk/security_content#3604 · 3 comentarios ·
Los mantenedores suelen responder en 1 día
-
[BUG] ESCU CS fields LogonType and TargetUserNameQuizá libre de nuevo @josehelps la tomó hace 1002 días y no hay ningún pull request abierto. Abiertobug
splunk/security_content#2869 · 3 comentarios · 1 asignado ·
Los mantenedores suelen responder en 1 día
Todos los issues de splunk/security_content
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 66/100
-
[Bug]: Queen's own Ollama model loses num_ctx when a running session switches to itPosiblemente ocupada @anasamin26 la tomó hoy. Abiertobug enhancement
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
aden-hive/hive#7508 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
llm translation
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
BerriAI/litellm#47884 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
Los mantenedores suelen responder en 1 día
-
bug 🐛
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
netalertx/NetAlertX#1856 · 1 reacción ·
Los mantenedores suelen responder en 1 día