Splunk rules: 00

name: 7zip CommandLine To SMB Share Path
id: 01d29b48-ff6f-11eb-b81e-acde48001123
version: 10
creation_date: '2021-08-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it may indicate an attempt to archive and exfiltrate sensitive files to a network share, a technique observed in CONTI LEAK tools. If confirmed malicious, this behavior could lead to data exfiltration, compromising sensitive information and potentially aiding further attacks.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe" OR Processes.process_name = "7za.exe" OR Processes.process_name = "7zr.exe" OR Processes.original_file_name = "7z.exe" OR Processes.original_file_name =  "7za.exe" OR Processes.original_file_name =  "7zr.exe") AND (Processes.process="*\\C$\\*" OR Processes.process="*\\Admin$\\*" OR Processes.process="*\\IPC$\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `7zip_commandline_to_smb_share_path_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://threadreaderapp.com/thread/1423361119926816776.html
analytic_story:
    - Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1560.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint
id: 15838756-f425-43fa-9d88-a7f88063e81a
version: 9
creation_date: '2024-01-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. It detects this activity by monitoring for GET requests that receive a 403 Forbidden response with an empty body. This behavior is significant as it indicates potential exploitation attempts against Ivanti Connect Secure systems. If confirmed malicious, attackers could exploit these vulnerabilities to gain unauthorized access or control over the affected systems, leading to potential data breaches or system compromise.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url="*/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark*" Web.http_method=GET Web.status=403
      BY Web.src, Web.dest, Web.http_user_agent,
         Web.status, Web.url source
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
known_false_positives: This analytic is limited to HTTP Status 403; adjust as necessary. False positives may occur if the URI path is IP-restricted or externally blocked. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
references:
    - https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve2023-46805_2024_21887.nse
    - https://github.com/projectdiscovery/nuclei-templates/blob/c6b351e71b0fb0e40e222e97038f1fe09ac58194/http/misconfiguration/ivanti/CVE-2023-46085-CVE-2024-21887-mitigation-not-applied.yaml
    - https://github.com/rapid7/metasploit-framework/pull/18708/files
finding:
    title: Possible exploitation of CVE-2023-46805 and CVE-2024-21887 against $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ivanti Connect Secure VPN Vulnerabilities
    - CISA AA24-241A
asset_type: VPN Appliance
cve:
    - CVE-2023-46805
    - CVE-2024-21887
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Azure AD User Consent Blocked for Risky Application
id: 06b8ec9a-d3b5-4882-8f16-04b4d10f5eab
version: 11
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures.
data_source:
    - Azure Active Directory Consent to application
search: "`azure_monitor_aad` operationName=\"Consent to application\" properties.result=failure | rename properties.* as * | eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Reason\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Reason\"), -1) | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\"), -1) | search reason_index >= 0 | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) | search reason = \"\\\"Risky application detected\\\"\" | rex field=permissions \"Scope: (?<Scope> [ ^,]+)\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product reason Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_user_consent_blocked_for_risky_application_filter`"
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
references:
    - https://attack.mitre.org/techniques/T1528/
    - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
    - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
    - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
    - https://www.alteredsecurity.com/post/introduction-to-365-stealer
    - https://github.com/AlteredSecurity/365-Stealer
finding:
    title: Azure AD has blocked $user$ attempt to grant to consent to an application deemed risky.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1528
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint
id: c43f7b49-2dab-4e76-892e-7f971c2f20f1
version: 7
creation_date: '2025-04-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. It leverages Cisco Secure Firewall logs and compares the SSL certificate SHA1 fingerprint against a blacklist of certificates associated with malware distribution, command and control (C2) infrastructure, or phishing campaigns. This activity is significant as adversaries often reuse or self-sign certificates across malicious infrastructure, allowing defenders to track and detect encrypted sessions even when domains or IPs change. If confirmed malicious, this may indicate beaconing, malware download, or data exfiltration over TLS/SSL.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    `cisco_secure_firewall` EventType=* SSL_CertFingerprint=*
    | lookup sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason
    | where isnotnull(Listingreason)
    | stats min(_time) as firstTime max(_time) as lastTime
            values(dest) as dest
            values(dest_port) as dest_port
            values(rule) as rule
            values(url) as url
            values(Listingreason) as Reasons
            values(Listingdate) as "SSL Cert Listing Dates"
            count by SSL_CertFingerprint src transport action
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The access policy must also enable logging.
    This search also make use of lookup based on https://sslbl.abuse.ch/blacklist/sslblacklist.csv. Make sure its available
known_false_positives: Certain SSL certificates may be flagged in threat intelligence feeds due to historical misuse, yet still be used by legitimate services, particularly in content delivery or shared hosting environments. Internal or self-signed certificates used in testing or development environments may inadvertently match known blacklisted fingerprints. It is recommended to validate the connection context (destination IP, domain, ClientApplication) and correlate with other indicators before taking action.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
finding:
    title: Suspicious SSL certificate fingerprint - [$SSL_CertFingerprint$] used in connections [ListingReason - $Reasons$] from $src$
    entity:
        field: src
        type: system
        score: 50
threat_objects:
    - field: SSL_CertFingerprint
      type: tls_hash
    - field: url
      type: url
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1587.002
    - T1588.004
    - T1071.001
    - T1573.002
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Citrix ADC and Gateway Unauthorized Data Disclosure
id: b593cac5-dd20-4358-972a-d945fefdaf17
version: 10
creation_date: '2023-10-24'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit the Citrix Bleed vulnerability (CVE-2023-4966), which can lead to the leaking of session tokens. It identifies HTTP requests with a 200 status code targeting the /oauth/idp/.well-known/openid-configuration URL endpoint. By parsing web traffic and filtering based on user agent details, HTTP method, source and destination IPs, and sourcetype, it aims to identify potentially malicious requests. This activity is significant for a SOC because successful exploitation can allow attackers to impersonate legitimate users, bypass authentication, and access sensitive data. If confirmed malicious, it could lead to unauthorized data access, network propagation, and critical information exfiltration.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url IN ("*/oauth/idp/.well-known/openid-configuration*")  Web.status=200
      BY Web.http_user_agent, Web.status Web.http_method,
         Web.url, Web.url_length, Web.src,
         Web.dest, sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `citrix_adc_and_gateway_unauthorized_data_disclosure_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. We recommend hunting in the environment first to understand the scope of the issue and then deploying this detection to monitor for future exploitation attempts. Limit or restrict to Citrix devices only if possible.
known_false_positives: False positives may be present based on organization use of Citrix ADC and Gateway. Filter, or restrict the analytic to Citrix devices only.
references:
    - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
    - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
finding:
    title: Possible exploitation of Citrix Bleed vulnerability against $dest$ fron $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966
    - Scattered Lapsus$ Hunters
asset_type: Web Server
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Cloud Compute Instance Created With Previously Unseen Image
id: bc24922d-987c-4645-b288-f8c73ec194c4
version: 10
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of cloud compute instances using previously unseen image IDs. It leverages cloud infrastructure logs to identify new image IDs that have not been observed before. This activity is significant because it may indicate unauthorized or suspicious activity, such as the deployment of malicious payloads or unauthorized access to sensitive information. If confirmed malicious, this could lead to data breaches, unauthorized access, or further compromise of the cloud environment. Immediate investigation is required to determine the legitimacy of the instance creation and to mitigate potential threats.
data_source:
    - AWS CloudTrail
search: |-
    | tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest FROM datamodel=Change
      WHERE All_Changes.action=created
      BY All_Changes.Instance_Changes.image_id, All_Changes.user
    | `drop_dm_object_name("All_Changes")`
    | `drop_dm_object_name("Instance_Changes")`
    | where image_id != "unknown"
    | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data
    | eventstats max(enough_data) as enough_data
    | where enough_data=1
    | eval firstTimeSeenImage=min(firstTimeSeen)
    | where isnull(firstTimeSeenImage) OR firstTimeSeenImage > relative_time(now(), "-24h@h")
    | table firstTime, user, image_id, count, dest
    | `security_content_ctime(firstTime)`
    | `cloud_compute_instance_created_with_previously_unseen_image_filter`
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Images - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Images - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter` macro.
known_false_positives: After a new image is created, the first systems created with that image will cause this alert to fire.  Verify that the image being used was created by a legitimate user.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: User $user$ is creating an instance $dest$ with an image that has not been previously seen.
        - field: user
          type: user
          score: 20
          message: User $user$ is creating an instance $dest$ with an image that has not been previously seen.
analytic_story:
    - Cloud Cryptomining
asset_type: Cloud Compute Instance
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Cloud Compute Images - Update
    - Previously Seen Cloud Compute Images - Initial

name: Confluence CVE-2023-22515 Trigger Vulnerability
id: 630ea8b2-2800-4f5d-9cbc-d65c567349b0
version: 10
creation_date: '2023-10-04'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies potential exploitation attempts of the Confluence CVE-2023-22515 vulnerability. It detects successful accesses (HTTP status 200) to specific vulnerable endpoints by analyzing web logs within the Splunk 'Web' Data Model. This activity is significant for a SOC as it indicates possible privilege escalation attempts in Confluence. If confirmed malicious, attackers could gain unauthorized access or create accounts with escalated privileges, leading to potential data breaches or further exploitation within the environment.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url IN ("*/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false*","*/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&*") Web.http_method=GET Web.status=200
      BY Web.http_user_agent, Web.status Web.http_method,
         Web.url, Web.url_length, Web.src,
         Web.dest, sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `confluence_cve_2023_22515_trigger_vulnerability_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. Tested with Suricata and nginx:plus:kv.
known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to Confluence servers.
references:
    - https://github.com/Chocapikk/CVE-2023-22515/blob/main/exploit.py
    - https://x.com/Shadowserver/status/1712378833536741430?s=20
    - https://github.com/j3seer/CVE-2023-22515-POC
finding:
    title: Potential exploitation attempts on a known vulnerability in Atlassian Confluence detected. The source IP is $src$ and the destination hostname is $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
asset_type: Web Server
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Disable Defender Spynet Reporting
id: 898debf4-3021-11ec-ba7c-acde48001122
version: 15
creation_date: '2021-10-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the registry to disable Windows Defender SpyNet reporting. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender SpyNet settings. This activity is significant because disabling SpyNet reporting can prevent Windows Defender from sending telemetry data, potentially allowing malicious activities to go undetected. If confirmed malicious, this action could enable an attacker to evade detection, maintain persistence, and carry out further attacks without being flagged by Windows Defender.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_spynet_reporting_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Azorult
    - Windows Registry Abuse
    - Qakbot
    - IcedID
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Download Files Using Telegram
id: 58194e28-ae5e-11eb-8912-acde48001122
version: 12
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download malicious tools, such as network scanners, for further exploitation. If confirmed malicious, this behavior could lead to network mapping, lateral movement, and potential compromise of additional systems within the network.
data_source:
    - Sysmon EventID 15
search: |-
    `sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest dvc file_hash
           file_name file_path process_exec
           process_guid process_id process_name
           process_path signature signature_id
           user_id vendor_product Contents
           Image
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `download_files_using_telegram_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: normal download of file in telegram app. (if it was a common app in network)
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
finding:
    title: Suspicious files were downloaded with the Telegram application on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Phemedrone Stealer
    - Crypto Stealer
    - Snake Keylogger
    - XMRig
    - Water Gamayun
    - 0bj3ctivity Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31087.55689'
title: EnableLUA Registry Value Modified
description: Adversaries may bypass UAC mechanisms to elevate process privileges on
  system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. This use case detects
  registry modification events or process executions with registry modification commands
  targeting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("Set-Item-Property"
  OR "sp " OR "ADD") "EnableLUA" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  | table _time, host, user user, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1548/002/

name: Excessive Usage Of SC Service Utility
id: cb6b339e-d4c6-11eb-a026-acde48001122
version: 11
creation_date: '2021-06-24'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects excessive usage of the `sc.exe` service utility on a host machine. It leverages Sysmon EventCode 1 logs to identify instances where `sc.exe` is executed more frequently than normal within a 15-minute window. This behavior is significant as it is commonly associated with ransomware, cryptocurrency miners, and other malware attempting to create, modify, delete, or disable services, potentially related to security applications or for privilege escalation. If confirmed malicious, this activity could allow attackers to manipulate critical services, leading to system compromise or disruption of security defenses.
data_source:
    - Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly` count as numScExe min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product values(Processes.parent_process) as parent_process values(Processes.process_name) as process_name values(Processes.parent_process_id) as parent_process_id values(Processes.user) as user FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "sc.exe"
      BY Processes.dest _time span=15m
    | `drop_dm_object_name(Processes)`
    | eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots
      BY dest
    | eval upperThreshold=(avgScExe + stdScExe *3)
    | eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0)
    | search isOutlier=1
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `excessive_usage_of_sc_service_utility_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
known_false_positives: excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission.
references:
    - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Excessive Usage Of SC Service Utility on $dest$ by $user$
analytic_story:
    - Azorult
    - Ransomware
    - Crypto Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1569.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5694.5956'
title: Exchange New Export Request
description: 'This use case looks for exchange cmdlet to output email into a pst file.
  Adversaries may use these commands in order to exfiltrate sensitive information.
  - Threat Group Association: APT, 29, APT31, CL-STA-0043 - Software Association:
  ALPHV/BlackCat, Conti, Hafnium, Qakbot/Qbot, SEABORGIUM'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  TERM(EventCode=4103)) TERM(New-MailboxExportRequest) | regex process="(?i)-FilePath.{1,}\.pst"
  | table _time, host, user signature_id, process, process_* `group_events("host",1s)` '
techniques:
- collection:email collection:local email collection
- collection:email collection:remote email collection
technique_id:
- T1114.002
- T1114.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

id: '17741.29689'
title: Full Control Permissions Granted to Everyone - Windows
description: 'Adversaries may modify file or directory permissions/attributes to evade
  access control lists and access protected files. Windows implements file and directory
  ACLs as Discretionary Access Control Lists (DACLs). Adversaries can interact with
  the DACLs using built-in Windows commands which can grant adversaries higher permissions
  on specific files and folders. This use case detects commands assigning full control
  to Everyone which has been observed with Ryuk ransomware. -- Threat Actor Association:
  UNC5812 -- Atomics T1222.001 Test #2 Atomics T1222.001 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(icacls) OR ("/grant" "Everyone:F") | regex
  process="(?i)\s+\/grant\s+everyone" | table _time, host, user parent_*, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.logpoint.com/en/blog/ryuk-ransomware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md

name: Linux File Creation In Profile Directory
id: 46ba0082-61af-11ec-9826-acde48001122
version: 11
creation_date: '2021-12-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of files in the /etc/profile.d directory on Linux systems. It leverages filesystem data to identify new files in this directory, which is often used by adversaries for persistence by executing scripts upon system boot. This activity is significant as it may indicate an attempt to maintain long-term access to the compromised host. If confirmed malicious, this could allow attackers to execute arbitrary code with elevated privileges each time the system boots, potentially leading to further compromise and data exfiltration.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_path IN ("*/etc/profile.d/*")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `linux_file_creation_in_profile_directory_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can create file in profile.d folders for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1546/004/
    - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A file $file_name$ is created in $file_path$ on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1546.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: NLTest Domain Trust Discovery
id: c3e05466-5f22-11eb-ae93-0242ac130002
version: 14
creation_date: '2021-01-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of `nltest.exe` with command-line arguments `/domain_trusts` or `/all_trusts` to query Domain Trust information. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to understand domain trust relationships, which can inform their lateral movement strategies. If confirmed malicious, this activity could enable attackers to map out trusted domains, facilitating further compromise and pivoting within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=nltest.exe
            OR
            Processes.original_file_name=nltestrk.exe
        )
        (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `nltest_domain_trust_discovery_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may use nltest for troubleshooting purposes, otherwise, rarely used.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
    - https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104
    - https://attack.mitre.org/techniques/T1482/
    - https://owasp.org/www-pdf-archive/Red_Team_Operating_in_a_Modern_Environment.pdf
    - https://ss64.com/nt/nltest.html
    - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/
    - https://thedfirreport.com/2020/10/08/ryuks-return/
finding:
    title: Domain trust discovery execution on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
    - Qakbot
    - Domain Trust Discovery
    - Medusa Ransomware
    - Cleo File Transfer Software
    - Rhysida Ransomware
    - IcedID
    - Ryuk Ransomware
    - Storm-0501 Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '24645.45566'
title: Potential Proxy Malware via AutoRun Key
description: The Windows Registry Run keys can be abused to establish persistence
  for malware known as SystemBC (aka Coroxy or DroxiDat), which functions as a proxy,
  bot, backdoor, and RAT. Threat actors utilize this method to maintain continuous
  access to a compromised system, enabling them to gather information, execute commands,
  and deploy additional malware. SystemBC has been observed modifying AutoRun keys
  with a value of socks5. This use case detects modifications to registry keys containing
  the path \SOFTWARE\Microsoft\Windows\CurrentVersion\Run including the value "socks5".
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "socks5" | table _time, host,
  user signature_id, process, process_*, user, parent_process_path | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
- T1547.001
data_category:
- Windows Sysmon
references:
- https://rexorvc0.com/2023/11/12/Swiss-Knife-SystemBC-Coroxy/

name: Socat Network Listener Binding an Executable
id: 72482d45-1d05-46f5-bb6c-e2b709a8073a
version: 1
creation_date: '2026-08-27'
modification_date: '2026-08-27'
author: Maria Jose Erquiaga, Splunk
status: production
type: TTP
description: |-
    The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections.
    Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.
data_source:
    - Osquery Results
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count
      min(_time) as firstTime
      max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_name="socat*"
    Processes.process="*exec:*"
    Processes.process="*-listen:*"

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `socat_network_listener_binding_an_executable_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting.
references:
    - https://attack.mitre.org/tactics/TA0002/
    - https://attack.mitre.org/techniques/T1059
    - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/
    - https://gtfobins.github.io/gtfobins/socat/
    - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/
finding:
    title: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$].
    entity:
        field: dest
        type: system
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$].
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1059
    - T1572
product:
    - Splunk Cloud
    - Splunk Enterprise
    - Splunk Enterprise Security
category: endpoint
security_domain: endpoint

name: Unload Sysmon Filter Driver
id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe
version: 16
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the use of `fltMC.exe` to unload the Sysmon driver, which stops Sysmon from collecting data. It leverages Endpoint Detection and Response (EDR) logs, focusing on process names and command-line executions. This activity is significant because disabling Sysmon can blind security monitoring, allowing malicious actions to go undetected. If confirmed malicious, this could enable attackers to execute further attacks without being logged, leading to potential data breaches, privilege escalation, or persistent access within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=fltMC.exe
        AND
        Processes.process=*unload*
        AND
        Processes.process=*SysmonDrv*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime dest user count process_name process_id parent_process_name process
    | `unload_sysmon_filter_driver_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver
finding:
    title: Possible Sysmon filter driver unloading on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - CISA AA23-347A
    - Disabling Security Tools
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AD Short Lived Domain Account ServicePrincipalName
id: b681977c-d90c-4efc-81a5-c58f945fb541
version: 12
creation_date: '2022-11-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies the addition and quick deletion of a Service Principal Name (SPN) to a domain account within 5 minutes. This detection leverages EventCode 5136 from the Windows Security Event Log, focusing on changes to the servicePrincipalName attribute. This activity is significant as it may indicate an attempt to perform Kerberoasting, a technique used to crack the cleartext password of a domain account offline. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive information or escalate privileges within the domain environment.
data_source:
    - Windows Event Log Security 5136
search: |-
    `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
      | transaction ObjectDN AttributeValue startswith=(EventCode=5136 OperationType="%%14674") endswith=(EventCode=5136 OperationType="%%14675")
      | eval short_lived=case((duration<300),"TRUE")
      | search short_lived = TRUE
      | rename ObjectDN as user
      | rename Computer as dest
      | `windows_ad_short_lived_domain_account_serviceprincipalname_filter`
how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications.
known_false_positives: A Service Principal Name should only be added to an account when an application requires it. Adding an SPN and quickly deleting it is less common but may be part of legitimate action. Filter as needed.
references:
    - https://adsecurity.org/?p=3466
    - https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
finding:
    title: A Servince Principal Name for $user$ was set and shortly deleted
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Sneaky Active Directory Persistence Tricks
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Bluetooth Service Installed From Uncommon Location
id: f12b81e6-2fa2-48e0-95cd-f5f7e4d9ac89
version: 3
creation_date: '2026-03-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |
    Identifies the creation of a Windows service named "BluetoothService" with a binary path in user-writable directories, particularly %AppData%\Bluetooth.
    This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers created a service named "BluetoothService" pointing to a malicious binary (renamed Bitdefender Submission Wizard) in a hidden AppData directory.
    While legitimate Bluetooth services exist in Windows, they are system services with binaries in System32.
    Any BluetoothService created with a binary path in user directories (AppData, Temp, Downloads) is highly suspicious and indicates potential malware persistence.
data_source:
    - Windows Event Log System 7045
search: |
    `wineventlog_system`
    EventCode=7045
    ServiceName IN (
        "BluetoothService",
        "Bluetooth Service"
    )
    ImagePath IN (
        "*\\AppData\\*",
        "*\\ProgramData\\*",
        "*\\Temp\\*",
        "*\\Users\\*\\Bluetooth\\*"
    )
    | stats count min(_time) as firstTime max(_time) as lastTime
      by Computer ServiceName ImagePath ServiceType StartType UserID
    | rename Computer as dest
             UserID as user_id
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_bluetooth_service_installed_from_uncommon_location_filter`
how_to_implement: |
    To successfully implement this search, you need to be ingesting Windows System Event Logs (Event ID 7045) from your Windows endpoints. Event ID 7045 logs service installation events and includes the service name, binary path, service type, and start type.

    Ensure Windows Event Log forwarding is configured to send System logs to Splunk, or use a Windows Event Log collection agent. The Splunk Add-on for Microsoft Windows is required to properly parse these events.
known_false_positives: |
    Legitimate Bluetooth services in Windows are system services located in System32. Any BluetoothService created outside of system directories is highly suspicious. However, false positives may occur if:

    1. Third-party Bluetooth software installs services in Program Files (excluded by this detection)
    2. Development or testing environments create test services

    The detection specifically targets user-writable directories (AppData, Temp) which are strong indicators of malicious activity. Allowlist known-good third-party Bluetooth software installation paths if needed.
references:
    - https://attack.mitre.org/techniques/T1543/003/
    - https://attack.mitre.org/techniques/T1036/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious BluetoothService created on $dest$ with binary path $ImagePath$ in user-writable directory, indicating potential malware persistence
threat_objects:
    - field: ImagePath
      type: file_path
    - field: ServiceName
      type: service
analytic_story:
    - Lotus Blossom Chrysalis Backdoor
asset_type: Endpoint
mitre_attack_id:
    - T1543.003
    - T1036
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Default Cobalt Strike PowerShell Beacon
id: 25b6329b-d6b7-4ccd-9ac2-6ca1dfd2b0c1
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects default function and variable names known to be used by the Cobalt Strike PowerShell beacon.
    This beacon is used to gain command and control on a victim.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventID="4104"
    ScriptBlockText IN (
        "*func_get_proc_address*",
        "*$var_unsafe_native_methods*",
        "*$var_gpa.Invoke*",
        "*func_get_delegate_type*",
        "*$var_type_builder*"
    )
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime

    by Computer EventID ScriptBlockText dest signature signature_id
       user_id vendor_product Guid Opcode Name
       Path ProcessID ScriptBlockId

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_default_cobalt_strike_powershell_beacon_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    False positives are very unlikely as this detection targets default Cobalt Strike PowerShell beacon functions and variables. Modifications to the beacon's script may bypass detection but do not create false positives.
finding:
    title: Default Cobalt Strike PowerShell beacon activity observed on $dest$ via script block $ScriptBlockId$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Cobalt Strike
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint