Skip to content

Commit 7293d75

Browse files
tccontrenasbench
tccontre
and
nasbench
authored
Tagged Analytics Covering the Axios Compromise Post-Exploitation Activity (#3982)
--------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>
1 parent f416da5 commit 7293d75

19 files changed

+93
-37
lines changed

‎detections/endpoint/executables_or_script_creation_in_suspicious_path.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Executables Or Script Creation In Suspicious Path
22
id: a7e3f0f0-ae42-11eb-b245-acde48001122
3-
version: 25
4-
date: '2026-03-16'
3+
version: 26
4+
date: '2026-03-31'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -148,6 +148,7 @@ tags:
148148
- DynoWiper
149149
- XML Runner Loader
150150
- Void Manticore
151+
- Axios Supply Chain Post Compromise
151152
asset_type: Endpoint
152153
mitre_attack_id:
153154
- T1036

‎detections/endpoint/executables_or_script_creation_in_temp_path.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Executables Or Script Creation In Temp Path
22
id: e0422b71-2c05-4f32-8754-01fb415f49c9
3-
version: 21
4-
date: '2026-03-16'
3+
version: 22
4+
date: '2026-03-31'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -131,6 +131,7 @@ tags:
131131
- PromptFlux
132132
- XML Runner Loader
133133
- Void Manticore
134+
- Axios Supply Chain Post Compromise
134135
asset_type: Endpoint
135136
mitre_attack_id:
136137
- T1036

‎detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Linux Auditd File Permission Modification Via Chmod
22
id: 5f1d2ea7-eec0-4790-8b24-6875312ad492
3-
version: 13
4-
date: '2026-03-10'
3+
version: 14
4+
date: '2026-03-31'
55
author: "Teoderick Contreras, Splunk, Ivar Nygård"
66
status: production
77
type: Anomaly
@@ -45,6 +45,7 @@ tags:
4545
- XorDDos
4646
- Salt Typhoon
4747
- Linux Privilege Escalation
48+
- Axios Supply Chain Post Compromise
4849
asset_type: Endpoint
4950
mitre_attack_id:
5051
- T1222.002

‎detections/endpoint/linux_auditd_possible_access_to_credential_files.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Linux Auditd Possible Access To Credential Files
22
id: 0419cb7a-57ea-467b-974f-77c303dfe2a3
3-
version: 11
4-
date: '2026-03-10'
3+
version: 12
4+
date: '2026-03-31'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -44,6 +44,7 @@ tags:
4444
- China-Nexus Threat Activity
4545
- Salt Typhoon
4646
- Linux Privilege Escalation
47+
- Axios Supply Chain Post Compromise
4748
asset_type: Endpoint
4849
mitre_attack_id:
4950
- T1003.008

‎detections/endpoint/linux_common_process_for_elevation_control.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Linux Common Process For Elevation Control
22
id: 66ab15c0-63d0-11ec-9e70-acde48001122
3-
version: 10
4-
date: '2026-02-25'
3+
version: 11
4+
date: '2026-03-31'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Hunting
@@ -38,6 +38,7 @@ tags:
3838
- Linux Living Off The Land
3939
- Salt Typhoon
4040
- Linux Privilege Escalation
41+
- Axios Supply Chain Post Compromise
4142
asset_type: Endpoint
4243
mitre_attack_id:
4344
- T1548.001

‎detections/endpoint/linux_ingress_tool_transfer_hunting.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Linux Ingress Tool Transfer Hunting
22
id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf
3-
version: 10
4-
date: '2026-02-25'
3+
version: 11
4+
date: '2026-03-31'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -39,6 +39,7 @@ tags:
3939
- Linux Living Off The Land
4040
- XorDDos
4141
- NPM Supply Chain Compromise
42+
- Axios Supply Chain Post Compromise
4243
asset_type: Endpoint
4344
mitre_attack_id:
4445
- T1105

‎detections/endpoint/macos_lolbin.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
name: MacOS LOLbin
22
id: 58d270fb-5b39-418e-a855-4b8ac046805e
3-
version: 11
4-
date: '2026-03-10'
3+
version: 12
4+
date: '2026-03-31'
55
author: Patrick Bareiss, Splunk
66
status: production
77
type: TTP
88
description: The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
99
data_source:
1010
- osquery
1111
search: |-
12-
`osquery_macro` name=es_process_events columns.cmdline IN ("find*", "crontab*", "screencapture*", "openssl*", "curl*", "wget*", "killall*", "funzip*")
12+
`osquery_macro` name=es_process_events columns.cmdline IN ("find*", "crontab*", "screencapture*", "openssl*", "curl*", "wget*", "killall*", "funzip*", "chmod*")
1313
| rename columns.* as *
1414
| stats min(_time) as firstTime max(_time) as lastTime values(cmdline) as cmdline, values(pid) as pid, values(parent) as parent, values(path) as path, values(signing_id) as signing_id, dc(path) as dc_path
1515
BY username host
@@ -45,6 +45,7 @@ tags:
4545
analytic_story:
4646
- Living Off The Land
4747
- Hellcat Ransomware
48+
- Axios Supply Chain Post Compromise
4849
asset_type: Endpoint
4950
mitre_attack_id:
5051
- T1059.004

‎detections/endpoint/powershell_4104_hunting.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: PowerShell 4104 Hunting
22
id: d6f2b006-0041-11ec-8885-acde48001122
3-
version: 23
4-
date: '2026-03-10'
3+
version: 24
4+
date: '2026-03-31'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -238,6 +238,7 @@ tags:
238238
- Hellcat Ransomware
239239
- Microsoft WSUS CVE-2025-59287
240240
- MuddyWater
241+
- Axios Supply Chain Post Compromise
241242
asset_type: Endpoint
242243
mitre_attack_id:
243244
- T1059.001

‎detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Powershell Fileless Script Contains Base64 Encoded Content
22
id: 8acbc04c-c882-11eb-b060-acde48001122
3-
version: 17
4-
date: '2026-03-10'
3+
version: 18
4+
date: '2026-03-31'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -62,6 +62,7 @@ tags:
6262
- Microsoft WSUS CVE-2025-59287
6363
- NetSupport RMM Tool Abuse
6464
- MuddyWater
65+
- Axios Supply Chain Post Compromise
6566
mitre_attack_id:
6667
- T1027
6768
- T1059.001

‎detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: PowerShell Loading DotNET into Memory via Reflection
22
id: 85bc3f30-ca28-11eb-bd21-acde48001122
3-
version: 15
4-
date: '2026-03-10'
3+
version: 16
4+
date: '2026-03-31'
55
author: Michael Haag, Teoderick Contreras Splunk
66
status: production
77
type: Anomaly
@@ -55,6 +55,7 @@ tags:
5555
- Data Destruction
5656
- 0bj3ctivity Stealer
5757
- Hellcat Ransomware
58+
- Axios Supply Chain Post Compromise
5859
asset_type: Endpoint
5960
mitre_attack_id:
6061
- T1059.001

0 commit comments

Comments
 (0)