Detection-as-code

Detections for SSH and Telnet attacks, written once in Sigma and converted to Splunk SPL and Microsoft Sentinel KQL. Every rule is tested in CI against attack events that must match and look-alike events that must not. The behaviour comes from the live honeypot.

11rules

13ATT&CK techniques

44attack test events

57look-alike test events

How a rule gets here

Sigma rule in rules/, tagged with ATT&CK
Validation: pySigma's 31 validators, and every regex checked to be RE2-safe for KQL
Tests: an evaluator runs the rule on match.jsonl (must fire) and nomatch.jsonl (must not)
Conversion to SPL and KQL, committed in dist/; CI fails if they're stale
Splunk check (local): the generated SPL runs in Splunk on the same test events and must agree with the evaluator

ATT&CK coverage

Tactic	Technique	Rules
Initial Access	T1078Valid Accounts	Login Followed By Tool Transfer
Execution	T1053.003Cron	Cron Job Added From Interactive Session
	T1059.004Unix Shell	Download And Execute In One Command, Writable And Executable Directory Probe
	T1059.008Network Device CLI	Network Device CLI Escape Attempt
Persistence	T1053.003Cron	Cron Job Added From Interactive Session
	T1078Valid Accounts	Login Followed By Tool Transfer
	T1098.004SSH Authorized Keys	SSH Authorized Keys Modified
Privilege Escalation	T1053.003Cron	Cron Job Added From Interactive Session
	T1078Valid Accounts	Login Followed By Tool Transfer
	T1098.004SSH Authorized Keys	SSH Authorized Keys Modified
Stealth	T1027Obfuscated Files or Information	Binary Written With Hex-Escaped Echo
	T1070.003Clear Command History	Shell History Cleared Or Disabled
	T1078Valid Accounts	Login Followed By Tool Transfer
Defense Impairment	T1685Disable or Modify Tools	Firewall Or Security Agent Disabled
Defense Impairment	T1686Disable or Modify System Firewall	Firewall Or Security Agent Disabled
Credential Access	T1110.001Password Guessing	Password Guessing From One Source
Discovery	T1083File and Directory Discovery	Writable And Executable Directory Probe
Command and Control	T1105Ingress Tool Transfer	Download And Execute In One Command, Binary Written With Hex-Escaped Echo, Login Followed By Tool Transfer
Impact	T1496Resource Hijacking	Cryptocurrency Miner Indicators

Rules

Binary Written With Hex-Escaped Echo high

echo -e / echo -ne with \xNN escapes redirected into a file: the attacker writes a binary or script chunk by chunk because the device has no wget, curl or tftp.

T1027 T1105 single event
Cron Job Added From Interactive Session high

A session installs a cron job, either through crontab or by writing to /etc/cron* or /var/spool/cron, so the payload restarts after a reboot or after being killed.

T1053.003 single event
Cryptocurrency Miner Indicators high

Miner binaries (xmrig, minerd, cpuminer), mining pool protocols (stratum+tcp, stratum+ssl) or pool names in a command.

T1496 single event
Download And Execute In One Command high

A single command line fetches a file with wget, curl, tftp or ftpget and runs it: piped into a shell, made executable with chmod +x, or started with sh.

T1059.004 T1105 single event
Login Followed By Tool Transfer high

A session logs in and transfers a tool within the same five-minute window: the automated dropper chain of IoT and Linux botnets.

T1078 T1105 correlation
SSH Authorized Keys Modified high

A command writes to or locks an authorized_keys file.

T1098.004 single event
Firewall Or Security Agent Disabled medium

The session flushes iptables, disables ufw or SELinux, or stops firewalld, AppArmor or a cloud provider's security agent (Alibaba Cloud's aegis / aliyun-service), clearing the way for the payload and its outbound connections.

T1685 T1686 single event
Password Guessing From One Source medium

One source tries five or more different passwords within ten minutes.

T1110.001 correlation
Shell History Cleared Or Disabled medium

history -c, deleting or truncating .bash_history, unsetting HISTFILE or pointing it at /dev/null: the attacker removes the record of the commands they just ran.

T1070.003 single event
Writable And Executable Directory Probe medium

The bot creates an empty dot-file in a directory and runs it with sh, for example `echo > /dev/shm/.b && sh /dev/shm/.b`.

T1059.004 T1083 single event
Network Device CLI Escape Attempt low

A Telnet or SSH session sends the bare words that break out of a router or IoT vendor CLI into a Linux shell (enable, system, shell, sh, linuxshell).

T1059.008 single event