Splunk rules: 02

id: '13733.20161'
title: AnyDesk Command Line Execution
description: 'For most users, normal AnyDesk activity is executed via the GUI. This
  use case detects anydesk.exe calls from cmd.exe or PowerShell.exe. Install commands
  have been filtered out by default. - Threat Actor Association: Alloy Taurus/Gallium,
  Gamaredon (aka. Armageddon, UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus,
  UNC3944), Scatter Swine, UNC2659 - Software Association: Akira, ALPHV/BlackCat,
  AvosLocker, BianLian, BlackByte, BumbleBee, Clop, Conti, Diavol, Rhysida, Royal'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(AnyDesk) (TERM(cmd) OR TERM(powershell)) | regex process!="(?i)(install)"|
  where match(process, "(?i)anydesk.exe") | table _time, host, user, process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html

name: Azure AD Multiple Users Failing To Authenticate From Ip
id: 94481a6a-8f59-4c86-957f-55a71e3612a6
version: 13
creation_date: '2022-07-11'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects a single source IP failing to authenticate with 30 unique valid users within 5 minutes in Azure Active Directory. It leverages Azure AD SignInLogs with error code 50126, indicating invalid passwords. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or privilege escalation within the Azure AD environment.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
      | rename properties.* as *
      | bucket span=5m _time
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime dc(user) as unique_user values(dest) as dest values(user) as user values(user_agent) as user_agent values(vendor_account) as vendor_account values(vendor_product) as vendor_product
        BY src signature
      | where unique_user > 30
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
    - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Source Ip $src$ failed to authenticate with 30 users within 5 minutes.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Active Directory
mitre_attack_id:
    - T1110.003
    - T1110.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Azure AD User Consent Denied for OAuth Application
id: bb093c30-d860-4858-a56e-cd0895d5b49c
version: 14
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Azure AD environment. This detection leverages Azure AD's audit logs, specifically focusing on user consent actions with error code 65004. Monitoring denied consent actions is significant as it can indicate users recognizing potentially suspicious or untrusted applications. If confirmed malicious, this activity could suggest attempts by unauthorized applications to gain access, potentially leading to data breaches or unauthorized actions within the environment. Understanding these denials helps refine security policies and enhance user awareness.
data_source:
    - Azure Active Directory Sign-in activity
search: |-
    `azure_monitor_aad` operationName="Sign-in activity" properties.status.errorCode=65004
      | rename properties.* as *
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product appDisplayName
           status.failureReason signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_user_consent_denied_for_oauth_application_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: Users may deny consent for legitimate applications by mistake, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1528/
    - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
    - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
    - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
    - https://www.alteredsecurity.com/post/introduction-to-365-stealer
    - https://github.com/AlteredSecurity/365-Stealer
finding:
    title: User $user$ denied consent for an OAuth application.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1528
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco Duo Policy Allow Devices Without Screen Lock
id: 114c616b-c793-465d-a80d-758c9fe8a704
version: 6
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: |
    The following analytic detects when a Duo policy is created or updated to allow devices without a screen lock requirement. It identifies this behavior
    by searching Duo administrator activity logs for policy creation or update events where the 'require_lock' setting is set to false. This action may indicate
    a weakening of device security controls, potentially exposing the organization to unauthorized access if devices are lost or stolen. For a Security Operations
    Center (SOC), identifying such policy changes is critical, as attackers or malicious insiders may attempt to lower authentication standards to facilitate
    unauthorized access. The impact of this attack could include increased risk of credential compromise, data breaches, or lateral movement within the
    environment due to reduced device security requirements.
data_source:
    - Cisco Duo Administrator
search: |-
    `cisco_duo_administrator` action=policy_update OR action=policy_create
      | spath input=description
      | search require_lock=false
      | rename object as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action actionlabel description
           user admin_email
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `cisco_duo_policy_allow_devices_without_screen_lock_filter`
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A policy has been created or updated to allow devices without screen lock by user $user$ with email $admin_email$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Cloud Provisioning Activity From Previously Unseen Country
id: 94994255-3acf-4213-9b3f-0494df03bb31
version: 9
creation_date: '2020-12-01'
modification_date: '2026-05-13'
author: Rico Valdez, Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects cloud provisioning activities originating from previously unseen countries. It leverages cloud infrastructure logs and compares the geographic location of the source IP address against a baseline of known locations. This activity is significant as it may indicate unauthorized access or potential compromise of cloud resources. If confirmed malicious, an attacker could gain control over cloud assets, leading to data breaches, service disruptions, or further infiltration into the network.
data_source:
    - AWS CloudTrail
search: |-
    | tstats earliest(_time) as firstTime, latest(_time) as lastTime FROM datamodel=Change
      WHERE (
            All_Changes.action=started
            OR
            All_Changes.action=created
        )
        All_Changes.status=success
      BY All_Changes.src, All_Changes.user, All_Changes.object,
         All_Changes.command
    | `drop_dm_object_name("All_Changes")`
    | iplocation src
    | where isnotnull(Country)
    | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data
    | eventstats max(enough_data) as enough_data
    | where enough_data=1
    | eval firstTimeSeenCountry=min(firstTimeSeen)
    | where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry > relative_time(now(), "-24h@h")
    | `security_content_ctime(firstTime)`
    | table firstTime, src, Country, user, object, command
    | `cloud_provisioning_activity_from_previously_unseen_country_filter`
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
known_false_positives: "This is a strictly behavioral search, so we define \"false positive\" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no \"false positives\" in a traditional sense, there is definitely lots of noise.\nThis search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you."
references: []
intermediate_findings:
    entities:
        - field: object
          type: system
          score: 20
          message: User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$
        - field: user
          type: user
          score: 20
          message: User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious Cloud Provisioning Activities
asset_type: AWS Instance
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Cloud Provisioning Activity Sources - Initial
    - Previously Seen Cloud Provisioning Activity Sources - Update

id: '39292.71028'
title: Control_RunDLL Call from Command Line
description: rundll32.exe can be used to invoke Control_RunDLL, commonly used to execute
  control panel applets (*.cpl) or DLLs via command-line arguments. Threat actors
  can abuse this to run malicious DLLs or load persistence mechanisms by hiding payloads
  behind legitimate-looking control panel functions as observed in attacks associated
  with CVE-2021-40444. This use case detects when Control_RunDLL is called from the
  command line, accounting for instances where rundll32.exe has been renamed.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(Control_RunDLL) | regex process="(?i)Control_RunDLL"
  | table _time, host, user signature_id, process, process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- defense-evasion:system binary proxy execution:control panel
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218
- T1218.011
- T1218.002
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://research.splunk.com/endpoint/c8e7ced0-10c5-11ec-8b03-acde48001122/
- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://attack.mitre.org/techniques/T1218/011/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
- https://redcanary.com/blog/intelligence-insights-december-2021/

name: Crowdstrike Admin Weak Password Policy
id: bb1481fd-23c0-4195-b6a0-94d746c9637c
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects CrowdStrike alerts for admin weak password policy violations, identifying instances where administrative passwords do not meet security standards. These alerts highlight significant vulnerabilities that could be exploited by attackers to gain unauthorized access. Promptly addressing these alerts is crucial for maintaining robust security and protecting critical systems and data from potential threats.
data_source: []
search: |-
    `crowdstrike_identities` primaryDisplayName = "*admin*"
      | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY domain dn primaryDisplayName
           risk_type severity riskScore
           riskScoreSeverity user role_type
      | where risk_type = "WEAK_PASSWORD_POLICY"
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_admin_weak_password_policy_filter`
how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
finding:
    title: Weak Password for Admin User found on $domain$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '38391.69031'
title: Executable Running as NT AUTHORITY_SYSTEM Registered in BAM
description: Adversaries may exploit software vulnerabilities in an attempt to elevate
  privileges. Exploitation of a software vulnerability occurs when an adversary takes
  advantage of a programming error in a program, service, or within the operating
  system software or kernel itself to execute adversary-controlled code. Security
  constructs such as permission levels will often hinder access to information and
  use of certain techniques, so adversaries will likely need to perform privilege
  escalation to include use of software exploitation to circumvent those restrictions.
  Background Activity Moderator is a Windows service that controls activity of background
  applications. The service was first introduced on Windows 10, specifically, after
  the Fall Creators Update (version 1709). BAM provides the full path of the executable
  files that was run on the system as well as the last execution date and time of
  these files. BAM provides evidence of program execution by listing executables under
  the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>"
  registry key. Each user specific executable is stored under the corresponding SID
  entry. BAM entries are only populated for locally run executables. Launching executables
  on network shares or removable media will not generate BAM entries. Similarly, console
  applications aren't stored on the BAM entry. In addition, BAM entries are removed
  if an executable is removed from its original location; and entries older than 7
  days are removed when Windows boots. This use case detects when an executable running
  as NT AUTHORITY\SYSTEM was registered in BAM registry key. This behavior was observed
  in CVE-2024-30088, but it is not specific only to this issue, rather used only as
  a reference.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4657) OR
  "<EventID>4657<") "SYSTEM\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-18"
  | rex field=_raw "<Data Name=\"NewValueType\">(?<new_value_type>[^<]+)</Data>"|
  rex field=_raw "<Data Name=\"NewValue\">(?<new_value>[^<]+)</Data>" | where match(new_value_type,
  "(?i)REG_BINARY") and match(new_value, "(?i)\.exe$") | table _time, host, user,
  process, process_*, registry_*, parent_*, new_value_type, new_value | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:exploitation for privilege escalation
technique_id: 
- T1068
data_category:
- Windows event logs
- Windows Registry
references:
- https://github.com/tykawaii98/CVE-2024-30088/tree/main
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088
- https://attack.mitre.org/techniques/T1068/
- https://dfir.ru/2020/04/08/bam-internals/

name: GCP Unusual Number of Failed Authentications From Ip
id: bd8097ed-958a-4873-87d9-44f2b4d85705
version: 11
creation_date: '2022-09-26'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies a single source IP failing to authenticate into Google Workspace with multiple valid users, potentially indicating a Password Spraying attack. It uses Google Workspace login failure events and calculates the standard deviation for source IPs, applying the 3-sigma rule to detect unusual failed authentication attempts. This activity is significant as it may signal an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access, data breaches, or further exploitation within the environment.
data_source:
    - Google Workspace
search: |-
    `gws_reports_login` event.type = login event.name = login_failure
      | bucket span=5m _time
      | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts values(authentication_method) AS authentication_method
        BY _time, src
      | eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std
        BY _time
      | eval  upperBound=(ip_avg+ip_std*3)
      | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
      | where isOutlier =1
      | `gcp_unusual_number_of_failed_authentications_from_ip_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. Specifically, this analytic leverages the User log events.
known_false_positives: No known false positives for this detection. Please review this alert
references:
    - https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks
    - https://www.slideshare.net/dafthack/ok-google-how-do-i-red-team-gsuite
    - https://attack.mitre.org/techniques/T1110/003/
    - https://www.blackhillsinfosec.com/wp-content/uploads/2020/05/Breaching-the-Cloud-Perimeter-Slides.pdf
intermediate_findings:
    entities:
        - field: tried_accounts
          type: user
          score: 20
          message: 'Unusual number of failed console login attempts (Count: $unique_accounts$) against users from IP Address - $src$'
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - GCP Account Takeover
asset_type: Google Cloud Platform tenant
mitre_attack_id:
    - T1110.003
    - T1110.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Kubernetes Create or Update Privileged Pod
id: 3c6bd734-334d-4818-ae7c-5234313fc5da
version: 10
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation or update of privileged pods in Kubernetes. It identifies this activity by monitoring Kubernetes Audit logs for pod configurations that include root privileges. This behavior is significant for a SOC as it could indicate an attempt to escalate privileges, exploit the kernel, and gain full access to the host's namespace and devices. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, data breaches, and service disruptions, posing a severe threat to the environment.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` objectRef.resource=pods verb=create OR verb=update requestObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration=*\"privileged\":true*
      | fillnull
      | stats count values(user.groups{}) as user_groups
        BY kind objectRef.name objectRef.namespace
           objectRef.resource requestObject.kind responseStatus.code
           sourceIPs{} stage user.username
           userAgent verb requestObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_create_or_update_privileged_pod_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Kubernetes privileged pod created by user $user$.
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Auditd Preload Hijack Via Preload File
id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f
version: 12
creation_date: '2022-01-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: |
    The following analytic detects suspicious preload hijacking via the `preload` file, which may indicate an attacker's attempt to intercept or manipulate library loading processes.
    The `preload` file can be used to force the loading of specific libraries before others, potentially allowing malicious code to execute or alter application behavior.
    By monitoring for unusual or unauthorized modifications to the `preload` file, this analytic helps identify attempts to hijack preload mechanisms, enabling security teams to investigate and address potential threats to system integrity and security.
    Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
data_source:
    - Linux Auditd Path
    - Linux Auditd Cwd
search: |
    `linux_auditd`
    (type=PATH OR type=CWD)
    | rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"

    | stats
      values(type) as types
      values(name) as names
      values(nametype) as nametype
      values(cwd) as cwd_list
      values(_time) as event_times
      by audit_id, host

    | eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
    | eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
    | eval matched_paths = mvfilter(match(candidate_paths, "/etc/ld.so.preload.*"))
    | eval match_count = mvcount(matched_paths)
    | eval reconstructed_path = mvindex(matched_paths, 0)
    | eval e_time = mvindex(event_times, 0)
    | where match_count > 0
    | rename host as dest

    | stats count min(e_time) as firstTime max(e_time) as lastTime
      values(nametype) as nametype
      by current_working_directory
         reconstructed_path
         match_count
         dest
         audit_id

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_auditd_preload_hijack_via_preload_file_filter`
how_to_implement: |
    To implement this detection, the process begins by ingesting auditd
    data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
    executions and process details on Unix/Linux systems. These logs should be ingested
    and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
    which is essential for correctly parsing and categorizing the data. The next step
    involves normalizing the field names  to match the field names set by the Splunk
    Common Information Model (CIM) to ensure consistency across different data sources
    and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
    Administrator or network operator can use this application for automation purposes.
    Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
finding:
    title: A [$nametype$] event has occurred on host - [$dest$] to modify the preload file.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - VoidLink Cloud-Native Linux Malware
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1574.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Log4Shell CVE-2021-44228 Exploitation
id: 9be30d80-3a39-4df9-9102-64a467b24eac
version: 11
creation_date: '2022-01-27'
modification_date: '2026-05-13'
author: Jose Hernandez, Splunk
status: production
type: Correlation
description: The following analytic identifies potential exploitation of Log4Shell CVE-2021-44228 by correlating multiple MITRE ATT&CK tactics detected in risk events. It leverages Splunk's risk data model to calculate the distinct count of MITRE ATT&CK tactics from Log4Shell-related detections. This activity is significant because it indicates a high probability of exploitation if two or more distinct tactics are observed. If confirmed malicious, this activity could lead to initial payload delivery, callback to a malicious server, and post-exploitation activities, potentially resulting in unauthorized access, lateral movement, and further compromise of the affected systems.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
      WHERE All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system"
      BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >= 2
    | `log4shell_cve_2021_44228_exploitation_filter`
how_to_implement: To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.
known_false_positives: There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation.
references:
    - https://research.splunk.com/stories/log4shell_cve-2021-44228/
    - https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
finding:
    title: Log4Shell CVE-2021-44228 Exploitation detected - $risk_object$
    entity:
        field: risk_object
        type: system
        score: 0
analytic_story:
    - Log4Shell CVE-2021-44228
    - CISA AA22-320A
asset_type: Endpoint
mitre_attack_id:
    - T1105
    - T1190
    - T1059
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20543.36407'
title: ntds.dit Command Line
description: 'Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information, as well as obtain other
  information about domain members such as devices, users, and access rights. This
  use case specifically looks for command line argument executions with ntds.dit.
  -- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon - Software Association: Akira -- Atomics
  T1003.003 Test #2 Atomics T1003.003 Test #3 Atomics T1003.003 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") "ntds.dit" | regex process="(?i)ntds\.dit" | table _time, host,
  user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration

name: O365 BEC Email Hiding Rule Created
id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
version: 8
creation_date: '2025-02-14'
modification_date: '2026-05-13'
author: '0xC0FFEEEE, Github Community'
status: production
type: TTP
description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account.
data_source: []
search: |-
    `o365_management_activity` Workload=Exchange Operation IN ("New-InboxRule", "Set-InboxRule")
    | stats min(_time) as firstTime, max(_time) as lastTime, values(Operation) as Operation, latest(Name) as Name, latest(MarkAsRead) as MarkAsRead, latest(MoveToFolder) as MoveToFolder by object_id user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup ut_shannon_lookup word as Name
    | eval entropy_score=if(ut_shannon<=2, 1, 0)
    | eval len_score=if(len(Name)<=3, 1,0)
    | eval read_score=if(MarkAsRead="True", 1, 0)
    | eval folder_score=if(match(MoveToFolder, "^(RSS|Conversation History|Archive)"), 1, 0)
    | eval suspicious_score=entropy_score+len_score+read_score+folder_score
    | where suspicious_score>2
    | `o365_bec_email_hiding_rule_created_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed.
known_false_positives: Short rule names may trigger false positives. Adjust the entropy and length thresholds as needed.
references:
    - https://attack.mitre.org/techniques/T1564/008/
finding:
    title: Potential BEC mailbox rule - $Name$ was created by user - $user$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: Name
      type: signature
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1564.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: PowerShell WebRequest Using Memory Stream
id: 103affa6-924a-4b53-aff4-1d5075342aab
version: 11
creation_date: '2023-07-11'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects the use of .NET classes in PowerShell to download a URL payload directly into memory, a common fileless malware staging technique. It leverages PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell commands involving `system.net.webclient`, `system.net.webrequest`, and `IO.MemoryStream`. This activity is significant as it indicates potential fileless malware execution, which is harder to detect and can bypass traditional file-based defenses. If confirmed malicious, this technique could allow attackers to execute code in memory, evade detection, and maintain persistence in the environment.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104  ScriptBlockText IN ("*system.net.webclient*","*system.net.webrequest*") AND ScriptBlockText="*IO.MemoryStream*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_webrequest_using_memory_stream_filter`
how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
    - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
    - https://attack.mitre.org/techniques/T1059/001/
finding:
    title: Powershell webrequest to memory stream behavior. Possible fileless malware staging on $dest$ by $user_id$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Powershell webrequest to memory stream behavior. Possible fileless malware staging on $dest$ by $user_id$.
analytic_story:
    - MoonPeak
    - Medusa Ransomware
    - Malicious PowerShell
    - PHP-CGI RCE Attack on Japanese Organizations
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1105
    - T1027.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '13705.20072'
title: Remote Access Software Execution
description: 'Remote access tools are commonly used as legitimate technical support
  software and may be allowed by application control within a target environment.
  Adversaries may install and use these tools post-compromise as alternate communications
  channels for redundant access or as a way to establish an interactive remote desktop
  session with the target system. They may also be used as a component of malware
  to establish a reverse connection or back-connect to a service or adversary controlled
  system. Installation of many remote access tools may also include persistence (ex:
  the tool''s installation routine creates a Windows Service). This use case detects
  the execution of remote access software known to be used by threat actors. - Threat
  Actor Association: Andariel, APT43, FIN7, Muddled Libra, Scattered Spider (aka.
  0ktapus, UNC3944), Scatter Swine - Software Association: ALPHV/BlackCat, AvosLocker,
  BianLian, Black Basta, Clop, Hive, LockBit, Royal, Trigona - Atomics T1219 Test
  #1 Atomics T1219 Test #2 Atomics T1219 Test #3 Atomics T1219 Test #4 Atomics T1219
  Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("TeamViewer.exe" OR "AnyDesk.exe" OR "LMIIgnition.exe"
  OR "GoToAssist.exe" OR "ScreenConnect.exe" OR "ammyy.exe" OR "RemotePC.exe" OR "NetSupport.exe"
  OR "UltraViewer_Desktop.exe" OR "vncviewer.exe" OR "Splashtop.exe" OR "Supremo.exe"
  OR "PCICTLUI.exe" OR "QuickAssist.exe") | where match(process_name, "(?i)^(TeamViewer\.exe|AnyDesk\.exe|LMIIgnition\.exe|GoToAssist\.exe|ScreenConnect\.exe|ammyy\.exe|RemotePC\.exe|NetSupport\.exe|UltraViewer_Desktop\.exe|vncviewer\.exe|Splashtop\.exe|Supremo\.exe|PCICTLUI\.exe|QuickAssist\.exe)$")
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md

id: '8106.10012'
title: System Shutdown or Reboot
description: 'Adversaries may shutdown/reboot systems to interrupt access to, or aid
  in the destruction of, those systems. Operating systems may contain commands to
  initiate a shutdown/reboot of a machine. -- Software Association: Blackbyte, Conti,
  DirtyMoe'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=1074) OR
  "<EventID>1074<") | rex field=Message "(?i)process\s+(?<process_name>.*?\.(exe|dll|\w{2,4}))"|
  rex field=Message "user\s+(?<user>.*?\x5c\S+)" | eval shutdown_type=Shutdown_Type
  | table _time, host, user process_name, shutdown_type, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- impact:system shutdown/reboot
technique_id: 
- T1529
data_category:
- Windows event logs
references:
- https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/

id: '1139.1216'
title: Tunneling Process Created
description: 'Adversaries may tunnel network communications to and from a victim system
  within a separate protocol to avoid detection/network filtering and/or enable access
  to otherwise unreachable systems. Common tools include Iodine, DNSCat, and Plink
  -- Threat Actor Association: Agrius, Alloy Taurus/Gallium, APT34, FIN6, Lazarus,
  Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Magnat,
  Memento Team, OilRig, TRACER KITTEN -- Software Association: BadHatch, Lockbit,
  LV, Royal, Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4104 (TERM(--dns)
  OR TERM(server) OR TERM(host) OR TERM(com) OR TERM(org) OR TERM(net) OR TERM(info)
  OR TERM(listen) OR TERM(host) OR ("@" AND (TERM(-D) OR TERM(-R) OR TERM(-L)))) |
  rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock ID.+)|^(Creating
  Scriptblock.+)//g"| rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"| regex process="(?i)(\-\-dns)?((\s+)|(\=))?((server\=)|(host\=))?((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\,port\=\d{1,5}.+)|(\w+\.((com)|(org)|(net)|(info)))$)|(\w+\.((com)|(org)|(net)|(info))\:\d{1,5})|(\w+\@(\d{1,3}\.){3}\d{1,3}.+\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5})|(\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5}.+\w+\@(\d{1,3}\.){3}\d{1,3})|(\d{1,5}\s+?(\d{1,3}\.){3}\d{1,3}\:\d{1,5})"
  | table _time, host, user, signature_id, process_name, process, user | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id: 
- T1572
- T1095
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/yarrick/iodine
- https://github.com/iagox86/dnscat2
- https://github.com/kdsnice/Invoke-Plink

name: Windows Audit Policy Security Descriptor Tampering via Auditpol
id: 5628e0b7-73dc-4f1b-b37a-6e68efc2225f
version: 8
creation_date: '2025-02-19'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic identifies the execution of `auditpol.exe` with the "/set" flag, and "/sd" command-line arguments used to modify the security descriptor of the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. An attacker, can disable certain policy categories from logging and then change the security descriptor in order to restrict access to certain users or application from reverting their changes. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_auditpol` Processes.process="*/set*" Processes.process="*/sd:*"
        AND
        NOT Processes.process="*/?*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_audit_policy_security_descriptor_tampering_via_auditpol_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be rare to non existent. Any activity detected by this analytic should be investigated and approved or denied.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ with commandline $process$ was identified attempting to modify the audit policy security descriptor on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ with commandline $process$ was identified attempting to modify the audit policy security descriptor on endpoint $dest$ by user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows Audit Policy Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint