Splunk rules: 01

name: Azure AD External Guest User Invited
id: c1fb4edb-cab1-4359-9b40-925ffd797fb5
version: 12
creation_date: '2022-08-19'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the invitation of an external guest user within Azure AD. It leverages Azure AD AuditLogs to identify events where an external user is invited, using fields such as operationName and initiatedBy. Monitoring these invitations is crucial as they can lead to unauthorized access if abused. If confirmed malicious, this activity could allow attackers to gain access to internal resources, potentially leading to data breaches or further exploitation of the environment.
data_source:
    - Azure Active Directory Invite external user
search: |-
    `azure_monitor_aad` operationName="Invite external user"
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename targetResources{}.type as type
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           initiatedBy type signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_external_guest_user_invited_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: Administrator may legitimately invite external guest users. Filter as needed.
references:
    - https://dirkjanm.io/assets/raw/US-22-Mollema-Backdooring-and-hijacking-Azure-AD-accounts_final.pdf
    - https://www.blackhat.com/us-22/briefings/schedule/#backdooring-and-hijacking-azure-ad-accounts-by-abusing-external-identities-26999
    - https://attack.mitre.org/techniques/T1136/003/
    - https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal
finding:
    title: External Guest User $user$ initiated by $initiatedBy$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: initiatedBy
          type: user
          score: 50
          message: External Guest User $user$ initiated by $initiatedBy$
analytic_story:
    - Azure Active Directory Persistence
asset_type: Azure Active Directory
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Azure AD New MFA Method Registered
id: 0488e814-eb81-42c3-9f1f-b2244973e3a3
version: 12
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for a user account in Azure Active Directory. It leverages Azure AD audit logs to identify changes in MFA configurations. This activity is significant because adding a new MFA method can indicate an attacker's attempt to maintain persistence on a compromised account. If confirmed malicious, the attacker could bypass existing security measures, solidify their access, and potentially escalate privileges, access sensitive data, or make unauthorized changes. Immediate verification and remediation are required to secure the affected account.
data_source:
    - Azure Active Directory Update user
search: "`azure_monitor_aad` operationName=\"Update user\" | rename properties.* as * | eval propertyName = mvindex('targetResources{}.modifiedProperties{}.displayName',0) | search propertyName = StrongAuthenticationMethod | eval oldvalue = mvindex('targetResources{}.modifiedProperties{}.oldValue',0) | eval newvalue = mvindex('targetResources{}.modifiedProperties{}.newValue',0) | rex field=newvalue max_match=0 \"(?i)(?<new_method_type>\\\"MethodType\\\")\" | rex field=oldvalue max_match=0 \"(?i)(?<old_method_type>\\\"MethodType\\\")\" | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product newvalue oldvalue signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_new_mfa_method_registered_filter`"
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Users may register MFA methods legitimally, investigate and filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/005/
    - https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
    - https://www.csoonline.com/article/573451/sophisticated-bec-scammers-bypass-microsoft-365-multi-factor-authentication.html
finding:
    title: A new MFA method was registered for user $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
    - Scattered Lapsus$ Hunters
asset_type: Azure Tenant
mitre_attack_id:
    - T1098.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco NVM - Installation of Typosquatted Python Package
id: 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d
version: 5
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered.
    Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones.
    This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    dest_hostname IN ("*.pythonhosted.org", "*pypi.org", "*python-poetry.org")
    (
      (process_arguments = "*pip*" process_arguments = "*install*")
      OR
      (process_arguments = "*poetry*" process_arguments = "*add*")
    )
    | rex field=process_arguments "(?i)(?:pip|poetry)[^|]*?\s+(?:install|add)\s+(?P<package_name>[^\s\"']+)$"
    | lookup typo_squatted_python_packages
             typosquatted_package_name as package_name
             OUTPUTNEW comment package_official_url
    | where isnotnull(comment)
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport package_name comment package_official_url
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime src dest_hostname dest dest_port transport  package_name comment package_official_url
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
    | `cisco_nvm___installation_of_typosquatted_python_package_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
    In addition to this, the search make use of the lookup "typo_squatted_python_packages". Which needs to be configured and tuned.
known_false_positives: |
    False positives should be very minimal to non existent, as the names of the packages in the lookup are all extracted from previously malicious packages.
references:
    - https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218/
    - https://blog.checkpoint.com/securing-the-cloud/pypi-inundated-by-malicious-typosquatting-campaign/
    - https://rhisac.org/threat-intelligence/typosquatting-campaign-targets-python-developers-with-hundreds-of-malicious-libraries/
finding:
    title: Host $src$ used pip or poetry to install a likely typosquatted python package $package_name$ from $dest_hostname$
    entity:
        field: src
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Zerologon via Zeek
id: bf7a06ec-f703-11ea-adc1-0242ac120002
version: 10
creation_date: '2020-09-18'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: 'The following analytic detects attempts to exploit the Zerologon CVE-2020-1472 vulnerability via Zeek RPC. It leverages Zeek DCE-RPC data to identify specific operations: NetrServerPasswordSet2, NetrServerReqChallenge, and NetrServerAuthenticate3. This activity is significant because it indicates an attempt to gain unauthorized access to a domain controller, potentially leading to a complete takeover of an organization''s IT infrastructure. If confirmed malicious, the impact could be severe, including data theft, ransomware deployment, or other devastating outcomes. Immediate investigation of the identified IP addresses and RPC operations is crucial.'
data_source: []
search: |-
    `zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3)
      | bin span=5m _time
      | stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount count as totalcount
        BY _time,src_ip,dest_ip
      | search opscount=3 authcount>4 passcount>0
      | search `detect_zerologon_via_zeek_filter`
how_to_implement: You must be ingesting Zeek DCE-RPC data into Splunk. Zeek data should also be getting ingested in JSON format.  We are detecting when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app via bro:rpc:json.  These three operations are then correlated on the Zeek UID field.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.secura.com/blog/zero-logon
    - https://github.com/SecuraBV/CVE-2020-1472
    - https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
finding:
    title: Potential Zerologon activity detected [ $dest_ip$ ]
    entity:
        field: dest_ip
        type: system
        score: 50
analytic_story:
    - Detect Zerologon Attack
    - Rhysida Ransomware
    - Black Basta Ransomware
asset_type: Network
cve:
    - CVE-2020-1472
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Get-DomainTrust with PowerShell
id: 4fa7f846-054a-11ec-a836-acde48001122
version: 10
creation_date: '2021-09-02'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of the Get-DomainTrust command from PowerView using PowerShell, which is used to gather domain trust information. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant as it indicates potential reconnaissance efforts by an adversary to understand domain trust relationships, which can inform lateral movement strategies. If confirmed malicious, this could allow attackers to map out the network, identify potential targets, and plan further attacks, potentially compromising additional systems within the domain.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process=*get-domaintrust*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `get_domaintrust_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute.
references:
    - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/
finding:
    title: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$.
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 Email New Inbox Rule Created
id: 449f525a-7b42-47be-96a7-d9724e336c19
version: 6
creation_date: '2025-01-23'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies the creation of new email inbox rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters that may indicate mail forwarding, removal, or obfuscation. Inbox rule creation is a typical end-user activity however attackers also leverage this technique for multiple reasons.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=Exchange AND (Operation=New-InboxRule OR Operation=Set-InboxRule) Parameters{}.Name IN (SoftDeleteMessage,DeleteMessage,ForwardTo,ForwardAsAttachmentTo,RedirectTo,MoveToFolder,CopyToFolder)
    | eval file_path = mvappend(MoveToFolder,CopyToFolder), recipient=mvappend(ForwardTo, ForwardAsAttachmentTo, RedirectTo), user = lower(UserId), signature = Operation, src = if(match(ClientIP, "^\["), ltrim(mvindex(split(ClientIP, "]:"), 0), "["), mvindex(split(ClientIP,":"),0)), desc = Name, action = 'Parameters{}.Name'

    | stats values(action) as action, values(src) as src, values(recipient) as recipient, values(file_path) as file_path, count, min(_time) as firstTime, max(_time) as lastTime by user, signature, desc
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_email_new_inbox_rule_created_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Users may create email rules for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
    - https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A new email inbox rule was created for $user$
threat_objects:
    - field: desc
      type: signature
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.003
    - T1564.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: Outbound Network Connection from Java Using Default Ports
id: d2c14d28-5c47-11ec-9892-acde48001122
version: 13
creation_date: '2021-12-13'
modification_date: '2026-05-13'
author: Mauricio Velazco, Lou Stella, Splunk
status: production
type: TTP
description: |
    The following analytic detects outbound network connections from Java processes to default ports used by LDAP and RMI protocols, which may indicate exploitation of the CVE-2021-44228-Log4j vulnerability.
    This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs.
    Monitoring this activity is crucial as it can signify an attacker's attempt to perform JNDI lookups and retrieve malicious payloads.
    If confirmed malicious, this activity could lead to remote code execution and further compromise of the affected server.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
search: |-
    | tstats `security_content_summariesonly` count
    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name IN (
        "java.exe",
        "javaw.exe"
    )
    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | join process_id dest
    [
        | tstats `security_content_summariesonly` count
        FROM datamodel=Network_Traffic.All_Traffic WHERE
        All_Traffic.dest_port IN (
                    389,
                    636,
                    1099,
                    1389
        )
        BY All_Traffic.action All_Traffic.app All_Traffic.bytes
            All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest
            All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc
            All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
            All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport
            All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
            All_Traffic.process_id
        | `drop_dm_object_name(All_Traffic)`
        | rename dest as connection_to_CNC
        | rename src as dest
    ]
    | table _time dest
            parent_process_path parent_process_name parent_process
            process_path process_name process process_hash
            connection_to_CNC dest_port user
    | `outbound_network_connection_from_java_using_default_ports_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Legitimate Java applications may use perform outbound connections to these ports. Filter as needed
references:
    - https://www.lunasec.io/docs/blog/log4j-zero-day/
    - https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
finding:
    title: Java performed outbound connections to default ports of LDAP or RMI on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Log4Shell CVE-2021-44228
asset_type: Endpoint
cve:
    - CVE-2021-44228
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32266.57400'
title: Potential AutoHotkey .ahk Execution
description: Adversaries may execute commands and perform malicious tasks using AutoIT
  and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages
  that enable users to automate Windows tasks. These automation scripts can be used
  to perform a wide variety of actions, such as clicking on buttons, entering text,
  and opening and closing programs. This use case detects exeuction of .ahk files,
  accounting for renamed AutoHotkey binaries. Due to the broad nature of this rule,
  false positives for .ahk creation are expected. Allowlisting for expected executables
  and command line arguments is recommended.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ".ahk" | regex process="(?i)\.exe.+\S+\.ahk(\s|$|\")" | table _time, host, user,
  process, parent_process_name, process_name, process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1059/010/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_renamed_autohotkey/
- https://www.autohotkey.com/

name: Suspicious GPUpdate no Command Line Arguments
id: f308490a-473a-40ef-ae64-dd7a6eba284a
version: 13
creation_date: '2021-02-23'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of gpupdate.exe without any command line arguments. This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. It is significant because gpupdate.exe typically runs with specific arguments, and its execution without them is often associated with malicious activities, such as those performed by Cobalt Strike. If confirmed malicious, this activity could indicate an attempt to execute unauthorized commands or scripts, potentially leading to further system compromise or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where
    (Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)
    Processes.process IN ("*gpupdate","*gpupdate.exe", "*gpupdate.exe\"")
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_gpupdate_no_command_line_arguments_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process.
references:
    - https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/
finding:
    title: Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$
analytic_story:
    - BlackByte Ransomware
    - Cobalt Strike
    - Graceful Wipe Out Attack
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious microsoft workflow compiler usage
id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
version: 13
creation_date: '2021-01-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the usage of microsoft.workflow.compiler.exe, a rarely utilized executable typically found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution telemetry. The significance of this activity lies in its uncommon usage, which may indicate malicious intent such as code execution or persistence mechanisms. If confirmed malicious, an attacker could leverage this process to execute arbitrary code, potentially leading to unauthorized access or further compromise of the system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=microsoft.workflow.compiler.exe
            OR
            Processes.original_file_name=Microsoft.Workflow.Compiler.exe
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_microsoft_workflow_compiler_usage_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, limited instances have been identified coming from native Microsoft utilities similar to SCCM.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
finding:
    title: Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$
analytic_story:
    - Trusted Developer Utilities Proxy Execution
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1127
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious mshta child process
id: 60023bb6-5500-11eb-ae93-0242ac130002
version: 15
creation_date: '2021-01-17'
modification_date: '2026-05-13'
author: Michael Haag, Teoderick Contreras Splunk
status: production
type: TTP
description: The following analytic identifies child processes spawned from "mshta.exe". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like "powershell.exe" and "cmd.exe". This activity is significant because "mshta.exe" is often exploited by attackers to execute malicious scripts or commands. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment. Monitoring this activity helps in early detection of potential threats leveraging "mshta.exe" for malicious purposes.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=mshta.exe
        AND
        Processes.process_name IN ("powershell.exe","colorcpl.exe", "msbuild.exe", "microsoft.workflow.compiler.exe", "searchprotocolhost.exe", "scrcons.exe", "cscript.exe", "wscript.exe", "cmd.exe", "bitsadmin.exe")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_mshta_child_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
references:
    - https://github.com/redcanaryco/AtomicTestHarnesses
    - https://redcanary.com/blog/introducing-atomictestharnesses/
finding:
    title: Suspicious mshta child process $process_name$ detected on host $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious mshta child process $process_name$ detected on host $dest$ by user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious MSHTA Activity
    - Living Off The Land
    - Lumma Stealer
    - MuddyWater
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows IIS Components Module Failed to Load
id: 40c2ba5b-dd6a-496b-9e6e-c9524d0be167
version: 10
creation_date: '2022-12-21'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects when an IIS Module DLL fails to load due to a configuration problem, identified by EventCode 2282. This detection leverages Windows Application event logs to identify repeated failures in loading IIS modules. Such failures can indicate misconfigurations or potential tampering with IIS components. If confirmed malicious, this activity could lead to service disruptions or provide an attacker with opportunities to exploit vulnerabilities within the IIS environment. Immediate investigation is required to determine the legitimacy of the failing module and to mitigate any potential security risks.
data_source:
    - Windows Event Log Application 2282
search: |-
    `wineventlog_application` EventCode=2282
      | stats  count min(_time) as firstTime max(_time) as lastTime
        BY EventCode dest Name
           ModuleDll
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_iis_components_module_failed_to_load_filter`
how_to_implement: IIS must be installed and Application event logs must be collected in order to utilize this analytic.
known_false_positives: False positives will be present until all module failures are resolved or reviewed.
references:
    - https://social.technet.microsoft.com/wiki/contents/articles/21757.event-id-2282-iis-worker-process-availability.aspx
    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
    - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
    - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
    - https://www.secureworks.com/research/bronze-union
    - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
    - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A new IIS Module has been loaded and should be reviewed on $dest$.
analytic_story:
    - IIS Components
asset_type: Endpoint
mitre_attack_id:
    - T1505.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows PowerShell Module File Created
id: ef018634-8999-4854-9344-bde9593468e7
version: 2
creation_date: '2021-09-02'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects the creation of a DLL within the various PowerShell module directories.
    This can indicate a new module being installed, attempts at ScriptBlock smuggling, or other malicious PowerShell activity utilizing modules.
    False positives could include installation of legitimate modules.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.action="created"
    Filesystem.file_path="*\\WindowsPowerShell\\Modules\\*.dll"
    Filesystem.file_name="*.dll"

    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name
       Filesystem.user Filesystem.vendor_product Filesystem.action

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_powershell_module_file_created_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate installation of approved PowerShell modules may trigger this detection. Verify module sources to reduce false positives.
references:
    - https://bc-security.org/scriptblock-smuggling/
    - https://github.com/BC-SECURITY/ScriptBlock-Smuggling
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: PowerShell module DLL created at $file_path$ on $dest$.
threat_objects:
    - field: file_path
      type: file_path
analytic_story:
    - Malicious PowerShell
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1129
    - T1059.001
    - T1574
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Remote Access Software RMS Registry
id: e5b7b5a9-e471-4be8-8c5d-4083983ba329
version: 10
creation_date: '2022-06-24'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation or modification of Windows registry entries related to the Remote Manipulator System (RMS) Remote Admin tool. It leverages data from the Endpoint.Registry datamodel, focusing on registry paths containing "SYSTEM\\Remote Manipulator System." This activity is significant because RMS, while legitimate, is often abused by adversaries, such as in the Azorult malware campaigns, to gain unauthorized remote access. If confirmed malicious, this could allow attackers to remotely control the targeted host, leading to potential data exfiltration, system manipulation, or further network compromise.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\Remote Manipulator System*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_rms_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: administrators may enable or disable this feature that may cause some false positive.
references:
    - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.rms
finding:
    title: the registry related to RMS tool is created on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows RMM Tool Execution
id: 4afbd373-b769-4f82-8375-41e0153e46f9
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects process creation events of various remote access tools.
    Remote management tools, when used for legitimate purposes, can help IT professionals and system administrators remotely access and manage computer systems.
    However, threat actors may exploit these tools for malicious purposes.
data_source:
    - Sysmon EventID 1
search: |-
    `sysmon`
    EventID = 1
    (
        Company IN (
            "AmidaWare*",
            "Ammyy LLC*",
            "AnyDesk Software*",
            "ATERA Networks*",
            "bomgar*",
            "FleetDeck*",
            "GoTo, Inc*",
            "IDrive Inc*",
            "LogMeIn, Inc*",
            "MMSOFT Design*",
            "N-able*",
            "NetSupport Ltd*",
            "NinjaRMM*",
            "Remote Utilities*",
            "SimpleHelp*",
            "Servably*",
            "ScreenConnect*",
            "Splashtop*",
            "TeamViewer Germany*",
            "ZOHO Corporation*"
        )

        OR Description IN (
            "Advanced Monitoring Agent*",
            "AnyDesk*",
            "Ammyy Admin*",
            "AteraAgent*",
            "BeyondTrust Remote Support*",
            "FleetDeck*",
            "GoToAssist*",
            "GoToMyPC*",
            "Kaseya Live Connect*",
            "N-able*",
            "NetSupport Client Application*",
            "NinjaRMM*",
            "Pulseway*",
            "RemotePC*",
            "Remote Utilities*",
            "ScreenConnect*",
            "SimpleHelp Remote*",
            "Splashtop*",
            "Tactical RMM Agentz*",
            "Take Control Agent*",
            "Zoho Assist*"
        )

        OR Product IN (
            "Advanced Monitoring Agent*",
            "AnyDesk*",
            "Ammyy Admin*",
            "AteraAgent*",
            "BeyondTrust Remote Support*",
            "FleetDeck*",
            "GoToAssist*",
            "GoToMyPC*",
            "Kaseya Live Connect*",
            "NetSupport Remote Control*",
            "NetSupport Manager*",
            "NinjaRMM*",
            "Pulseway*",
            "Remote Access*",
            "Remote Support*",
            "Remote Utilities*",
            "RemotePC*",
            "Syncro*",
            "ScreenConnect*",
            "Splashtop*",
            "Tactical RMM Agent*",
            "Take Control Agent*",
            "TeamViewer*",
            "Zoho Assist*"
        )

        OR Image IN (
            "*AgentPackage*",
            "*AnyDesk.exe*",
            "*AteraAgent.exe*",
            "*BASupSrvc*",
            "*fleetdeck*",
            "*level.exe*",
            "*MeshAgent*",
            "*MspPlatform\\PME\\Installers*",
            "*NableCommand*",
            "*N-able Technologies*",
            "*NinjaRMM*",
            "*nxexec.exe*",
            "*nxserv*",
            "*nxplayer*",
            "*PCMonitor*",
            "*Pulseway*",
            "*remcmdstub.exe*",
            "*rustdesk.exe*",
            "*ScreenConnect*",
            "*Splashtop*",
            "*SRAgent.exe*",
            "*tacticalrmm.exe*",
            "*TakeControlTechConsole*",
            "*tailscale*",
            "*TeamViewer*",
            "*ZA_Connect*",
            "*ZMAgent*",
            "*ZohoMeeting*"
        )
    )

    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by Computer Company Description Product Image action
         dest original_file_name parent_process
         parent_process_exec parent_process_guid
         parent_process_id parent_process_name
         parent_process_path process_hash
         process_integrity_level user user_id
         vendor_product

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_rmm_tool_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate IT staff often use remote management tools for system maintenance and troubleshooting. Filter alerts to exclude trusted administrative activities.
references:
    - https://github.com/LivingInSyn/RMML/tree/main/RMMs
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
    - https://www.synacktiv.com/en/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential RMM tool execution observed on $dest$ via $Image$.
threat_objects:
    - field: Image
      type: process_name
analytic_story:
    - NetSupport RMM Tool Abuse
    - Remote Monitoring and Management Software
    - Suspicious User Agents
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Sensitive Group Discovery With Net
id: d9eb7cda-5622-4722-bc88-7f2442f4b5af
version: 9
creation_date: '2021-08-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of `net.exe` with command-line arguments used to query elevated domain or sensitive groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within Active Directory. If confirmed malicious, this behavior could lead to further attacks aimed at compromising privileged accounts, escalating privileges, or gaining unauthorized access to sensitive systems and data.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_net` Processes.process="*group*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*", "*Domain Computers*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_sensitive_group_discovery_with_net_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
    - https://adsecurity.org/?p=3658
    - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Elevated domain group discovery enumeration on $dest$ by $user$
analytic_story:
    - Active Directory Discovery
    - Volt Typhoon
    - Rhysida Ransomware
    - BlackSuit Ransomware
    - IcedID
    - Microsoft WSUS CVE-2025-59287
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint