Splunk Add-on for Sysmon for Linux is archived on Splunkbase
I maintainer di solito rispondono entro 1 giorno
@nasbench ci sta già lavorando.
Dal 1/10/2026.
Valutazione
Questa issue non è ancora stata valutata.
Descrizione
Splunkbase TA: Splunk Add-on for Sysmon for Linux
This archived Splunkbase TA is referenced by data source objects used by detections.
Data source objects and detections
- Sysmon for Linux EventID 1
- Detection: Curl Execution with Percent Encoded URL
- Detection: File Download or Read to Pipe Execution
- Detection: Linux Add User Account
- Detection: Linux Apparmor Bypass Via Aaexec
- Detection: Linux APT Privilege Escalation
- Detection: Linux At Application Execution
- Detection: Linux AWK Privilege Escalation
- Detection: Linux Binary Executed from Shared Memory Directory
- Detection: Linux Busybox Privilege Escalation
- Detection: Linux c89 Privilege Escalation
- Detection: Linux c99 Privilege Escalation
- Detection: Linux Change File Owner To Root
- Detection: Linux Clipboard Data Copy
- Detection: Linux Common Process For Elevation Control
- Detection: Linux Composer Privilege Escalation
- Detection: Linux Cpulimit Privilege Escalation
- Detection: Linux Crontab Enumeration
- Detection: Linux Csvtool Privilege Escalation
- Detection: Linux Curl Upload File
- Detection: Linux Data Destruction Command
- Detection: Linux DD File Overwrite
- Detection: Linux Decode Base64 to Shell
- Detection: Linux Deleting Critical Directory Using RM Command
- Detection: Linux Disable Services
- Detection: Linux Doas Tool Execution
- Detection: Linux Docker Root Directory Mount
- Detection: Linux Docker Shell Execution
- Detection: Linux Edit Cron Table Parameter
- Detection: Linux Emacs Privilege Escalation
- Detection: Linux Find Privilege Escalation
- Detection: Linux GDB Privilege Escalation
- Detection: Linux Gdrive Binary Activity
- Detection: Linux Gem Privilege Escalation
- Detection: Linux Ghostscript Exploitation
- Detection: Linux GNU Awk Privilege Escalation
- Detection: Linux Hardware Addition SwapOff
- Detection: Linux Impair Defenses Process Kill
- Detection: Linux Indicator Removal Clear Cache
- Detection: Linux Indicator Removal Service File Deletion
- Detection: Linux Ingress Tool Transfer Hunting
- Detection: Linux Ingress Tool Transfer with Curl
- Detection: Linux Insert Kernel Module Using Insmod Utility
- Detection: Linux Install Kernel Module Using Modprobe Utility
- Detection: Linux Iptables Firewall Modification
- Detection: Linux Kernel Module Enumeration
- Detection: Linux Kworker Process In Writable Process Path
- Detection: Linux Make Privilege Escalation
- Detection: Linux MySQL Privilege Escalation
- Detection: Linux Ngrok Reverse Proxy Usage
- Detection: Linux Node Privilege Escalation
- Detection: Linux NOPASSWD Entry In Sudoers File
- Detection: Linux Obfuscated Files or Information Base64 Decode
- Detection: Linux Octave Privilege Escalation
- Detection: Linux OpenVPN Privilege Escalation
- Detection: Linux PHP Privilege Escalation
- Detection: Linux pkexec Privilege Escalation
- Detection: Linux Possible Access Or Modification Of sshd Config File
- Detection: Linux Possible Access To Credential Files
- Detection: Linux Possible Access To Sudoers File
- Detection: Linux Possible Append Command To At Allow Config File
- Detection: Linux Possible Append Command To Profile Config File
- Detection: Linux Possible Append Cronjob Entry on Existing Cronjob File
- Detection: Linux Possible Bootloader Modification
- Detection: Linux Possible Cronjob Modification With Editor
- Detection: Linux Possible GSM Privilege Escalation
- Detection: Linux Possible Nimbuspwn Privilege Escalation
- Detection: Linux Preload Hijack Library Calls
- Detection: Linux Proxy Socks Curl
- Detection: Linux Puppet Privilege Escalation
- Detection: Linux Root Execution of id
- Detection: Linux RPM Privilege Escalation
- Detection: Linux Ruby Privilege Escalation
- Detection: Linux Service Restarted
- Detection: Linux Service Started Or Enabled
- Detection: Linux Setuid Using Chmod Utility
- Detection: Linux Setuid Using Setcap Utility
- Detection: Linux Shell History Access Via Command Line Utility
- Detection: Linux Shell Pseudo Device Reverse Shell
- Detection: Linux Shred Overwrite Command
- Detection: Linux Sqlite3 Privilege Escalation
- Detection: Linux SSH Authorized Keys Modification
- Detection: Linux SSH Remote Services Script Execute
- Detection: Linux Stdout Redirection To Dev Null File
- Detection: Linux Stop Services
- Detection: Linux Sudo OR Su Execution
- Detection: Linux Suspicious Child Process of PostgreSQL
- Detection: Linux Suspicious Docker Build Command Execution
- Detection: Linux Suspicious GCC Invocation Building Init Shared Object
- Detection: Linux Suspicious Namespace Creation
- Detection: Linux Suspicious Privileged Container Execution
- Detection: Linux Suspicious React or Next.js Child Process
- Detection: Linux Suspicious Redis Activity
- Detection: Linux System Network Discovery
- Detection: Linux System Reboot Via System Request Key
- Detection: Linux Telnet Authentication Bypass
- Detection: Linux Unix Shell Enable All SysRq Functions
- Detection: Linux Usermod Root UID Set
- Detection: Linux Visudo Utility Execution
- Detection: Socat Network Listener Binding an Executable
- Detection: Socat Remote TCP Connection with Local Echo Disabled
- Detection: Suspicious Curl Network Connection
- Detection: Suspicious Linux Discovery Commands
- Detection: Web or Application Server Spawning a Shell
- Sysmon for Linux EventID 11
- Detection: GitHub Workflow File Creation or Modification
- Detection: Linux Account Manipulation Of SSH Config and Keys
- Detection: Linux Add Files In Known Crontab Directories
- Detection: Linux At Allow Config File Creation
- Detection: Linux Deletion Of Cron Jobs
- Detection: Linux Deletion Of Init Daemon Script
- Detection: Linux Deletion Of Services
- Detection: Linux Deletion of SSL Certificate
- Detection: Linux Doas Conf File Creation
- Detection: Linux EFI Bootloader File Deletion
- Detection: Linux File Created In Kernel Driver Directory
- Detection: Linux File Creation In Init Boot Directory
- Detection: Linux File Creation In Profile Directory
- Detection: Linux File Creation In System Generator Directory
- Detection: Linux High Frequency Of File Deletion In Boot Folder
- Detection: Linux High Frequency Of File Deletion In Etc Folder
- Detection: Linux Medusa Rootkit
- Detection: Linux MOTD Script Added
- Detection: Linux Possible Privilege Escalation via PYTHONPATH
- Detection: Linux Possible Ssh Key File Creation
- Detection: Linux Possible System Binary Backdoor
- Detection: Linux Service File Created In Systemd Directory
- Detection: Linux Sudoers Tmp File Creation
- Detection: Linux Suspicious Staging of Alternate System Files
- Detection: Linux Suspicious XDG Autostart
- Detection: Linux UDEV Rule Created
- Detection: Shai-Hulud 2 Exfiltration Artifact Files
- Detection: Shai-Hulud Workflow File Creation or Modification
- Sysmon for Linux EventID 3
- Detection: Linux Netcat Outbound Connection
This issue is maintained automatically by the archived TA daily workflow.
- Lingua principale
- Python
- Stelle
- 1.7k
- Fork
- 501
- Merge medio
- 2g 22h
- PR unite (30g)
- 53
Preparare l'ambiente
- Nessun Dockerfile né file Docker Compose
- Ha un modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di splunk/security_content
-
[BUG] Improve net.exe and net1.exe Detection Logic in Windows Cmdline Tool Execution From Non-Shell ProcessForse già presa @mvanhorn l’ha presa 6 giorni fa. Apertabug
Difficoltà 2/5 1-3 ore Idoneità per principianti 62/100
splunk/security_content#4334 · 1 commento · 1 reazione ·
I maintainer di solito rispondono entro 1 giorno
-
[BUG] AWS CreateAccessKey: unquoted field names make the cross-user filter a no-op (fires on self-key creation)Forse già presa @themaryjo l’ha presa 19 giorni fa. Apertabug
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
splunk/security_content#4292 · 1 commento · 3 assegnatari ·
I maintainer di solito rispondono entro 1 giorno
-
feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure FirewallForse già presa @AAH20 l’ha presa 63 giorni fa. Aperta
Difficoltà 4/5 3-5 giorni Idoneità per principianti 45/100
splunk/security_content#4220 · 2 commenti ·
I maintainer di solito rispondono entro 1 giorno
-
Suggested Enhancement for Detection: Windows AD Short Lived Domain Account ServicePrincipalNameForse di nuovo libera @patel-bhavin l’ha presa 216 giorni fa e non c’è nessuna pull request aperta. Apertaenhancement
splunk/security_content#3941 · 1 assegnatario ·
I maintainer di solito rispondono entro 1 giorno
-
enhancement
Difficoltà 3/5 1-2 giorni Idoneità per principianti 58/100
splunk/security_content#3604 · 3 commenti ·
I maintainer di solito rispondono entro 1 giorno
Tutte le issue di splunk/security_content
Issue simili
-
documentation good first issue help wanted
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
drevendev/HungryCrab#273 ·
I maintainer di solito rispondono entro 1 giorno
-
good first issue help wanted
Difficoltà 2/5 1-3 ore Idoneità per principianti 76/100
drevendev/BeautifulRepo#19 ·
I maintainer di solito rispondono entro 2 giorni
-
Moonshot: Kimi K3 always sends `reasoning_effort="max"`, though the API now accepts `low` and `high`Apertaaccepted
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
UKGovernmentBEIS/inspect_ai#5939 ·
I maintainer di solito rispondono entro 1 giorno
-
bug linux
Difficoltà 2/5 1-3 ore Idoneità per principianti 75/100
I maintainer di solito rispondono entro 1 giorno
-
Fill paper for Screen2WordsApertaarea:data data-quality
Difficoltà 2/5 1-3 ore Idoneità per principianti 68/100
reacher-z/Awesome-CUA#1468 ·
I maintainer di solito rispondono entro 1 giorno