Splunk Add-on for Sysmon for Linux is archived on Splunkbase
オープン
メンテナーはふだん 1 日以内に返信
@nasbench がすでに取り組んでいます。
2026年10月1日 から。
評価
この issue はまだ評価されていません。
説明
Splunkbase TA: Splunk Add-on for Sysmon for Linux
This archived Splunkbase TA is referenced by data source objects used by detections.
Data source objects and detections
- Sysmon for Linux EventID 1
- Detection: Curl Execution with Percent Encoded URL
- Detection: File Download or Read to Pipe Execution
- Detection: Inline PHP Code Execution
- Detection: Linux Add User Account
- Detection: Linux Apparmor Bypass Via Aaexec
- Detection: Linux APT Privilege Escalation
- Detection: Linux At Application Execution
- Detection: Linux AWK Privilege Escalation
- Detection: Linux Binary Executed from Shared Memory Directory
- Detection: Linux Busybox Privilege Escalation
- Detection: Linux c89 Privilege Escalation
- Detection: Linux c99 Privilege Escalation
- Detection: Linux Change File Owner To Root
- Detection: Linux Clipboard Data Copy
- Detection: Linux Common Process For Elevation Control
- Detection: Linux Composer Privilege Escalation
- Detection: Linux Cpulimit Privilege Escalation
- Detection: Linux Crontab Enumeration
- Detection: Linux Csvtool Privilege Escalation
- Detection: Linux Curl Upload File
- Detection: Linux Data Destruction Command
- Detection: Linux DD File Overwrite
- Detection: Linux Decode Base64 to Shell
- Detection: Linux Deleting Critical Directory Using RM Command
- Detection: Linux Disable Services
- Detection: Linux Doas Tool Execution
- Detection: Linux Docker Root Directory Mount
- Detection: Linux Docker Shell Execution
- Detection: Linux Edit Cron Table Parameter
- Detection: Linux Emacs Privilege Escalation
- Detection: Linux Find Privilege Escalation
- Detection: Linux GDB Privilege Escalation
- Detection: Linux Gdrive Binary Activity
- Detection: Linux Gem Privilege Escalation
- Detection: Linux Ghostscript Exploitation
- Detection: Linux GNU Awk Privilege Escalation
- Detection: Linux Hardware Addition SwapOff
- Detection: Linux Impair Defenses Process Kill
- Detection: Linux Indicator Removal Clear Cache
- Detection: Linux Indicator Removal Service File Deletion
- Detection: Linux Ingress Tool Transfer Hunting
- Detection: Linux Ingress Tool Transfer with Curl
- Detection: Linux Insert Kernel Module Using Insmod Utility
- Detection: Linux Install Kernel Module Using Modprobe Utility
- Detection: Linux Iptables Firewall Modification
- Detection: Linux Kernel Module Enumeration
- Detection: Linux Kworker Process In Writable Process Path
- Detection: Linux Make Privilege Escalation
- Detection: Linux MySQL Privilege Escalation
- Detection: Linux Ngrok Reverse Proxy Usage
- Detection: Linux Node Privilege Escalation
- Detection: Linux NOPASSWD Entry In Sudoers File
- Detection: Linux Obfuscated Files or Information Base64 Decode
- Detection: Linux Octave Privilege Escalation
- Detection: Linux OpenVPN Privilege Escalation
- Detection: Linux PHP Privilege Escalation
- Detection: Linux pkexec Privilege Escalation
- Detection: Linux Possible Access Or Modification Of sshd Config File
- Detection: Linux Possible Access To Credential Files
- Detection: Linux Possible Access To Sudoers File
- Detection: Linux Possible Append Command To At Allow Config File
- Detection: Linux Possible Append Command To Profile Config File
- Detection: Linux Possible Append Cronjob Entry on Existing Cronjob File
- Detection: Linux Possible Bootloader Modification
- Detection: Linux Possible Cronjob Modification With Editor
- Detection: Linux Possible GSM Privilege Escalation
- Detection: Linux Possible Nimbuspwn Privilege Escalation
- Detection: Linux Preload Hijack Library Calls
- Detection: Linux Proxy Socks Curl
- Detection: Linux Puppet Privilege Escalation
- Detection: Linux Root Execution of id
- Detection: Linux RPM Privilege Escalation
- Detection: Linux Ruby Privilege Escalation
- Detection: Linux Service Restarted
- Detection: Linux Service Started Or Enabled
- Detection: Linux Setuid Using Chmod Utility
- Detection: Linux Setuid Using Setcap Utility
- Detection: Linux Shell History Access Via Command Line Utility
- Detection: Linux Shell Pseudo Device Reverse Shell
- Detection: Linux Shred Overwrite Command
- Detection: Linux Sqlite3 Privilege Escalation
- Detection: Linux SSH Authorized Keys Modification
- Detection: Linux SSH Remote Services Script Execute
- Detection: Linux Stdout Redirection To Dev Null File
- Detection: Linux Stop Services
- Detection: Linux Sudo OR Su Execution
- Detection: Linux Suspicious Child Process of PostgreSQL
- Detection: Linux Suspicious Docker Build Command Execution
- Detection: Linux Suspicious GCC Invocation Building Init Shared Object
- Detection: Linux Suspicious Namespace Creation
- Detection: Linux Suspicious Privileged Container Execution
- Detection: Linux Suspicious React or Next.js Child Process
- Detection: Linux Suspicious Redis Activity
- Detection: Linux System Network Discovery
- Detection: Linux System Reboot Via System Request Key
- Detection: Linux Telnet Authentication Bypass
- Detection: Linux Unix Shell Enable All SysRq Functions
- Detection: Linux Usermod Root UID Set
- Detection: Linux Visudo Utility Execution
- Detection: Socat Network Listener Binding an Executable
- Detection: Socat Remote TCP Connection with Local Echo Disabled
- Detection: Suspicious Curl Network Connection
- Detection: Suspicious Linux Discovery Commands
- Detection: Web or Application Server Spawning a Shell
- Sysmon for Linux EventID 11
- Detection: GitHub Workflow File Creation or Modification
- Detection: Linux Account Manipulation Of SSH Config and Keys
- Detection: Linux Add Files In Known Crontab Directories
- Detection: Linux At Allow Config File Creation
- Detection: Linux Deletion Of Cron Jobs
- Detection: Linux Deletion Of Init Daemon Script
- Detection: Linux Deletion Of Services
- Detection: Linux Deletion of SSL Certificate
- Detection: Linux Doas Conf File Creation
- Detection: Linux EFI Bootloader File Deletion
- Detection: Linux File Created In Kernel Driver Directory
- Detection: Linux File Creation In Init Boot Directory
- Detection: Linux File Creation In Profile Directory
- Detection: Linux File Creation In System Generator Directory
- Detection: Linux High Frequency Of File Deletion In Boot Folder
- Detection: Linux High Frequency Of File Deletion In Etc Folder
- Detection: Linux Medusa Rootkit
- Detection: Linux MOTD Script Added
- Detection: Linux Possible Privilege Escalation via PYTHONPATH
- Detection: Linux Possible Ssh Key File Creation
- Detection: Linux Possible System Binary Backdoor
- Detection: Linux Service File Created In Systemd Directory
- Detection: Linux Sudoers Tmp File Creation
- Detection: Linux Suspicious Staging of Alternate System Files
- Detection: Linux Suspicious XDG Autostart
- Detection: Linux UDEV Rule Created
- Detection: Shai-Hulud 2 Exfiltration Artifact Files
- Detection: Shai-Hulud Workflow File Creation or Modification
- Sysmon for Linux EventID 3
- Detection: Linux Netcat Outbound Connection
This issue is maintained automatically by the archived TA daily workflow.
- 主要言語
- Python
- スター
- 1.7k
- フォーク
- 503
- 平均マージ
- 2日 18時間
- マージ済み PR（30日）
- 48
環境構築
- Dockerfile・Docker Compose ファイルなし
- プルリクエストのテンプレートあり
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
splunk/security_content のほかの issue
-
[BUG] Improve net.exe and net1.exe Detection Logic in Windows Cmdline Tool Execution From Non-Shell Process対応中かも @mvanhorn が 16 日前に担当しました。 オープンbug
難易度 2/5 1〜3時間 初心者へのやさしさ 62/100
splunk/security_content#4334 · コメント 1 件 · リアクション 1 件 ·
メンテナーはふだん 1 日以内に返信
-
feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure Firewall対応中かも @AAH20 が 73 日前に担当しました。 オープン
難易度 4/5 3〜5日 初心者へのやさしさ 45/100
splunk/security_content#4220 · コメント 2 件 ·
メンテナーはふだん 1 日以内に返信
-
Suggested Enhancement for Detection: Windows AD Short Lived Domain Account ServicePrincipalName再び着手できるかも @patel-bhavin が 226 日前に担当しましたが、オープン中のプルリクエストはありません。 オープンenhancement
splunk/security_content#3941 · 担当者 1 名 ·
メンテナーはふだん 1 日以内に返信
-
enhancement
難易度 3/5 1〜2日 初心者へのやさしさ 58/100
splunk/security_content#3604 · コメント 3 件 ·
メンテナーはふだん 1 日以内に返信
-
[BUG] ESCU CS fields LogonType and TargetUserName再び着手できるかも @josehelps が 1010 日前に担当しましたが、オープン中のプルリクエストはありません。 オープンbug
splunk/security_content#2869 · コメント 3 件 · 担当者 1 名 ·
メンテナーはふだん 1 日以内に返信
splunk/security_content の issue をすべて見る
似ている issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
btclib-org/btclib-ecc#404 ·
-
changelog investigate
難易度 1/5 1時間未満 初心者へのやさしさ 78/100
ramnes/notion-sdk-py#430 ·
-
bug good first issue
難易度 1/5 1時間未満 初心者へのやさしさ 91/100
hyeonjoong/debussy#56 ·
-
README устарел: статус проекта, версия 0.1.0 при описании тега v0.1.1, семантика фолбэка поискаオープンdocumentation
難易度 2/5 1〜3時間 初心者へのやさしさ 68/100
Lagrunge82/yandex-mail-mcp#43 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
liberation-data/drivine-python#252 · コメント 1 件 ·
メンテナーはふだん 1 日以内に返信