Splunk rules: 03

name: Cisco Secure Firewall - SSH Connection to Non-Standard Port
id: 9b0c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
version: 5
creation_date: '2026-01-12'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Michael Haag, Splunk
status: production
type: Anomaly
description: |
    This analytic detects inbound SSH connections to non-standard ports on network devices using Cisco Secure Firewall Intrusion Events. APT actors have been observed enabling SSH servers on high, non-default TCP ports to maintain encrypted remote access to compromised network infrastructure.
    This detection leverages Snort signature 65369 to identify SSH protocol traffic on unusual ports, which may indicate persistence mechanisms or backdoor access established by threat actors.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall`
    EventType=IntrusionEvent
    signature_id=65369
    | fillnull
    | stats dc(signature_id) as unique_signature_count
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(src) as src
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
            by dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___ssh_connection_to_non_standard_port_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: |
    No false positives have been identified yet.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Inbound SSH connection to non-standard port $dest_port$ detected from $src$ to network device $dest$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1021.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Detect Rogue DHCP Server
id: 6e1ada88-7a0d-4ac1-92c6-03d354686079
version: 10
creation_date: '2020-08-11'
modification_date: '2026-05-13'
author: Mikael Bjerkeland, Splunk
status: experimental
type: TTP
description: The following analytic identifies the presence of unauthorized DHCP servers on the network. It leverages logs from Cisco network devices with DHCP Snooping enabled, specifically looking for events where DHCP leases are issued from untrusted ports. This activity is significant because rogue DHCP servers can facilitate Man-in-the-Middle attacks, leading to potential data interception and network disruption. If confirmed malicious, this could allow attackers to redirect network traffic, capture sensitive information, and compromise the integrity of the network.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT"
      | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac
        BY host
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_rogue_dhcp_server_filter`
how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping enabled (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
known_false_positives: This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface.
references: []
finding:
    title: DHCP Snooping detected by $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Router and Infrastructure Security
    - Scattered Lapsus$ Hunters
asset_type: Infrastructure
mitre_attack_id:
    - T1200
    - T1498
    - T1557
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '1001.1055'
title: Encoded Powershell Command
description: 'PowerShell is a powerful interactive command-line interface and scripting
  environment included in the Windows operating system. Adversaries can use PowerShell
  to perform a number of actions, including discovery of information and execution
  of code. Encoded commands could be a way for an attacker to obfuscate malicious
  scripts they are executing on the victim machine. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422,
  STRONTIUM), APT29/Nobelium, APT35/Phosphorus/Magic Hound, BlackByte, DarkSide, BlackMatter,
  FIN7, Memento Team, MuddyWater, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003),
  Vice Society, Volt Typhoon - Software Attribution: ALPHV/BlackCat, Bazarloader,
  Black Basta, Conti, Emotet, LV, MirrorBlast, Prestige, PYSA/Mespinoza, Ransom Cartel,
  TargetCompany, TrickBot, XingLocker, Yellow Cocaktoo/Jupiter Infostealer, WhisperGate
  - #TrendingThreat #Russia #Ukraine - Atomics T1027 Test #2 Atomics T1027 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=1 OR "EventID>1<")
  "powershell" ((TERM(-e) OR TERM(-ec) OR TERM(-en) OR TERM(-enc) OR TERM(-enco) OR
  TERM(-encod) OR TERM(-encode) OR TERM(-encoded) OR TERM(-encodedc) OR TERM(-encodedco)
  OR TERM(-encodedcommand) OR "-encodedcom*") OR "[System.Convert]::FromBase64String()")
  | table _time, host, user event_id, process, process_id, process_name, process_path,
  signature_id, src_user, tag, user, user_id | rex field=process "(?<base64_cmd>\w{20,1000}=?)"
  | rex field=process "(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+(?<base64_cmd>[a-z0-9+\/=]+)"
  | avlbase64 type=decode field=base64_cmd | rename base64_base64_cmd as base64_decoded_cmd
  | rex field=base64_decoded_cmd "(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+(?<base64_cmd_2nd_level>[a-z0-9+\/=]+)"
  | avlbase64 type=decode field=base64_cmd_2nd_level | rename base64_base64_cmd_2nd_level
  as base64_decoded_cmd_2nd_level | eval base64_decoded_cmd=coalesce(base64_decoded_cmd_2nd_level,base64_decoded_cmd) '
techniques:
- defense-evasion:obfuscated files or information
- execution:command and scripting interpreter:powershell
technique_id:
- T1027
- T1059.001
data_category:
- Windows Sysmon
references:
- https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ

name: GetDomainComputer with PowerShell Script Block
id: f64da023-b988-4775-8d57-38e512beb56e
version: 12
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). This commandlet is part of PowerView, a tool often used for enumerating domain computers within Windows environments. The detection leverages script block text analysis to identify this specific command. Monitoring this activity is crucial as it can indicate an adversary's attempt to gather information about domain computers, which is a common step in Active Directory reconnaissance. If confirmed malicious, this activity could lead to further network enumeration and potential lateral movement within the domain.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `getdomaincomputer_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use PowerView for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/
finding:
    title: Remote system discovery with PowerView on $dest$ by $user_id$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '40510.73992'
title: LocalAccountTokenFilterPolicy Registry Value Modified
description: The HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
  key is responsible for controlling how local accounts are filtered when they are
  used to access a Windows system remotely. By setting the key to value '1', it effectively
  disables Remote UAC filtering for local accounts, allowing local admin accounts
  to use elevated tokens (with full admin rights when connecting remotely). This may
  leave a system vulnerable to Pass the Hash attacks. This use case detects registry
  modification events or process executions with registry modification commands targeting
  LocalAccountTokenFilterPolicy.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR
  "<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)))
  "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" "LocalAccountTokenFilterPolicy"
  "LocalAccountTokenFilterPolicy" | table _time, host, user user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- defense-evasion:use alternate authentication material:pass the hash
technique_id:
- T1112
- T1550.002
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.security.com/threat-intelligence/china-southeast-asia-espionage
- https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167
- https://kb.cybertecsecurity.com/knowledge/localaccounttokenfilterpolicy

id: '29435.53032'
title: PowerShell DownloadFile_DownloadString
description: Adversaries have the capability to move tools or files from an external
  system into a compromised environment. This involves copying tools or files from
  an external system controlled by the adversary to the victim network through the
  command and control channel. This use case detects PowerShell commands related to
  file downloads using DownloadFile and DownloadString methods. Executions involving
  Invoke-WebRequest and Invoke-Expression have been excluded as they are covered by
  other use cases.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("downloadfile" OR
  "downloadstring") "System.Net.WebClient" NOT ("Invoke-WebRequest" OR "Invoke-Expression")
  | regex process="(?i)System\.Net\.WebClient.+\.Download(file|string)"| regex process!="(?i)(^|\s|\;|\|)(iex|iwr)(\s|\;|\|)"|
  table _time, host, user, process, process_name, parent_process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1059
- T1105
data_category:
- PowerShell logs
references:
- https://blog.talosintelligence.com/lazarus-three-rats/
- https://blog.talosintelligence.com/prometei-botnet-improves/

id: '15890.23905'
title: PowerShell XML Retrieval
description: 'This use case detects PowerShell commands attempting to retrieve data
  from XML files via http or https. Atomics T1059.001 Test #7 Atomics T1059.001 Test
  #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("MsXml2.ServerXmlHttp" OR TERM(ComObject) OR "xml") | table _time, host, user process,
  process_*, signature_id | bin span=1s | stats values(*) as * by _time, host | where
  match(process, "(?i)http(s?):\/\/") and match (process, "(?i)xml") and match(process,
  "(?i)powershell|cmd\.exe") '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
technique_id:
- T1059.001
- T1059
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt

id: '16076.24078'
title: Process Executed with Null Command Line
description: Adversaries may inject code into processes in order to evade process-based
  defenses as well as possibly elevate privileges. Process injection is a method of
  executing arbitrary code in the address space of a separate live process. Running
  code in the context of another process may allow access to the process's memory,
  system/network resources, and possibly elevated privileges. Execution via process
  injection may also evade detection from security products since the execution is
  masked under a legitimate process. For some Windows processes, execution with a
  null command line is not expected activity and may be an indication of process injection.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("backgroundtaskhost.exe" OR "svchost.exe" OR
  "dllhost.exe" OR "werfault.exe" OR "searchprotocolhost.exe" OR "wuauclt.exe" OR
  "spoolsv.exe" OR "rundll32.exe" OR "regasm.exe" OR "regsvr32.exe" OR "regsvcs.exe")
  | regex process="(?i)((backgroundtaskhost|svchost|dllhost|werfault|searchprotocolhost|wuauclt|spoolsv|rundll32|regasm|regsvr32|regsvcs)\.exe\"?)$"
  | table _time, host, user process, process_*, parent_process_*, signature_id | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:process injection
technique_id: 
- T1055
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://redcanary.com/threat-detection-report/techniques/process-injection/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes/

name: Windows Compatibility Telemetry Tampering Through Registry
id: 43834687-cc48-4878-a2fa-f76e4271791f
version: 9
creation_date: '2025-02-13'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: This detection identifies suspicious modifications to the Windows Compatibility Telemetry registry settings, specifically within the "TelemetryController" registry key and "Command" registry value. It leverages data from the Endpoint.Registry data model, focusing on registry paths and values indicative of such changes. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
data_source:
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime, max(_time) as lastTime, count FROM datamodel=Endpoint.Registry
      WHERE (
            Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*"
            AND
            Registry.registry_value_name="Command" NOT Registry.registry_value_data IN ("(empty)")
        )
      BY Registry.action Registry.dest Registry.process_guid
         Registry.process_id Registry.registry_hive Registry.registry_path
         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
         Registry.registry_value_type Registry.status Registry.user
         Registry.vendor_product
    | `drop_dm_object_name(Registry)`
    | eval process = registry_value_data
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_compatibility_telemetry_tampering_through_registry_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://attack.mitre.org/techniques/T1546/
    - https://scythe.io/threat-thursday/windows-telemetry-persistence
    - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence
finding:
    title: The process $process$ was added to registry settings for the Compatibility Appraiser by $user$ on host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The process $process$ was added to registry settings for the Compatibility Appraiser by $user$ on host $dest$
threat_objects:
    - field: process
      type: process
analytic_story:
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1546
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1044.1070'
title: Windows Defender Disabled Detection
description: 'An attacker could disable security tools to avoid possible detection
  of their tools and activities. This can take the form of killing security software,
  real-time monitoring or Windows Defender Service. -- Threat Actor Association: FIN6,
  FIN11, Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm),
  Vice Society, Wizard Spider -- Software Association: Bazarloader, BianLian, Blackbyte,
  Black Basta, Clop, Conti, DirtyMoe, Lockbit, Sodinokibi/REvil, Vice Society, WhisperGates
  -- #TrendingThreat #Russia #Ukraine - Atomics T1588.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) AND
  ((TERM(-DisableRealtimeMonitoring) OR TERM(-drtm)) AND TERM(true)) OR ((TERM(REG)
  OR "reg.exe") TERM(ADD) "windows defender" TERM(DisableAntiSpyware) "/d 1") OR ((TERM(sc)
  OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service)) TERM(windows)
  TERM(defender)) | table _time, host, user process, process_*, singature_id | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
technique_id:
- T1562.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/swagkarna/Defeat-Defender

name: Windows DiskCryptor Usage
id: d56fe0c8-4650-11ec-a8fa-acde48001122
version: 9
creation_date: '2021-11-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of DiskCryptor, identified by the process names "dcrypt.exe" or "dcinst.exe". This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. DiskCryptor is significant because adversaries use it to manually encrypt disks during an operation, potentially leading to data inaccessibility. If confirmed malicious, this activity could result in complete disk encryption, causing data loss and operational disruption. Immediate investigation is required to mitigate potential ransomware attacks.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="dcrypt.exe"
            OR
            Processes.original_file_name=dcinst.exe
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_diskcryptor_usage_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name.
references:
    - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
    - https://github.com/DavidXanatos/DiskCryptor
analytic_story:
    - Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Process With NamedPipe CommandLine
id: e64399d4-94a8-11ec-a9da-acde48001122
version: 10
creation_date: '2022-02-23'
modification_date: '2026-07-08'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects processes with command lines containing named pipes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions.
    This behavior is significant as it is often used by adversaries, such as those behind the Olympic Destroyer malware, for inter-process communication post-injection, aiding in defense evasion and privilege escalation.
    If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process = "*\\\\.\\pipe\\*"
    (
        NOT Processes.parent_process_path IN (
            "*:\\Program Files (x86)\\*",
            "*:\\Program Files\\*",
            "*:\\Windows\\System32\\*",
            "*:\\Windows\\SysWOW64\\*"
        )
        OR
        NOT Processes.process_path IN (
            "*:\\Program Files (x86)\\*",
            "*:\\Program Files\\*",
            "*:\\Windows\\System32\\*",
            "*:\\Windows\\SysWOW64\\*"
        )
    )

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_process_with_namedpipe_commandline_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Normal browser application may use this technique. Please update the filter macros to remove false positives.
references:
    - https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The parent process $parent_process$ spawned a process with the CommandLine $process$ that contains a named pipe on $dest$
analytic_story:
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Steal Authentication Certificates Export Certificate
id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332
version: 12
creation_date: '2023-02-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the PowerShell cmdlet 'export-certificate' executed via the command line, indicating an attempt to export a certificate from the local Windows Certificate Store. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. Exporting certificates is significant as it may indicate credential theft or preparation for man-in-the-middle attacks. If confirmed malicious, this activity could allow an attacker to impersonate users, decrypt sensitive communications, or gain unauthorized access to systems and data.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*export-certificate*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_steal_authentication_certificates_export_certificate_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Filtering may be requried based on automated utilities and third party applications that may export certificates.
references:
    - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
    - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export a certificate from the local Windows Certificate Store.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export a certificate from the local Windows Certificate Store.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Windows Certificate Services
asset_type: Endpoint
mitre_attack_id:
    - T1649
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Time Based Evasion via Choice Exec
id: d5f54b38-10bf-4b3a-b6fc-85949862ed50
version: 13
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of choice.exe in batch files as a delay tactic, a technique observed in SnakeKeylogger malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential time-based evasion techniques used by malware to avoid detection. If confirmed malicious, this behavior could allow attackers to execute code stealthily, delete malicious files, and persist on compromised hosts, making it crucial for SOC analysts to investigate promptly.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name =choice.exe  Processes.process = "*/T*"  Processes.process = "*/N*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_time_based_evasion_via_choice_exec_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: administrator may use choice.exe to allow user to choose from and indexes of choices from a batch script.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/choice
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A $process_name$ has a choice time delay commandline on $dest$
analytic_story:
    - Snake Keylogger
    - 0bj3ctivity Stealer
    - VIP Keylogger
asset_type: Endpoint
mitre_attack_id:
    - T1497.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Unusual NTLM Authentication Users By Destination
id: 1120a204-8444-428b-8657-6ea4e1f3e840
version: 10
creation_date: '2024-03-16'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when a device is the target of numerous NTLM authentications using a null domain. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a domain joined Windows device from a non-domain device. This activity may also generate a large number of EventID 4776 events in tandem, however these events will not indicate the attacker or target device.
data_source:
    - NTLM Operational 8004
    - NTLM Operational 8005
    - NTLM Operational 8006
search: |
    `ntlm_audit`
    EventCode = 8004
    SChannelName=*
    WorkstationName=*
    ```CIM alignment, remove leading \\ from some auth attempts ```
    | eval src = replace(WorkstationName,"\\\\","")
    | eval dest = SChannelName, user = UserName

    ``` Remove NTLM auths to self, improves accuracy for certain applications ```
    | where SChannelName!=src

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  dc(eval(upper(user))) as unique_count by dest

    | eventstats avg(unique_count) as unique_avg
                 stdev(unique_count) as unique_std

    ```adjust formula for sensitivity```
    | eval upperBound_unique=(1+unique_avg+unique_std*3)

    | eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
    | where isOutlier==1
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_unusual_ntlm_authentication_users_by_destination_filter`
how_to_implement: The following analytic detects when an unusual number of NTLM authentications is attempted against the same destination. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a domain joined Windows device using an NTLM based process/attack. This same activity may also generate a large number of EventID 4776 events as well.
known_false_positives: Vulnerability scanners, print servers, and applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/ntlm-blocking-and-you-application-analysis-and-auditing/ba-p/397191
    - https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/enriched-ntlm-authentication-data-using-windows-event-8004/m-p/871827
    - https://www.varonis.com/blog/investigate-ntlm-brute-force
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/4d1235e3-2c96-4e9f-a147-3cb338a0d09f
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The device [$dest$] was the target of $count$ NTLM authentications using $unique_count$ unique user accounts.
analytic_story:
    - Active Directory Password Spraying
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Zscaler Behavior Analysis Threat Blocked
id: 289ad59f-8939-4331-b805-f2bd51d36fb8
version: 10
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Rod Soto, Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic identifies threats blocked by the Zscaler proxy based on behavior analysis. It leverages web proxy logs to detect entries where actions are blocked and threat names and classes are specified. This detection is significant as it highlights potential malicious activities that were intercepted by Zscaler's behavior analysis, providing early indicators of threats. If confirmed malicious, these blocked threats could indicate attempted breaches or malware infections, helping security teams to understand and mitigate potential risks in their environment.
data_source: []
search: |-
    `zscaler_proxy` action=blocked threatname!="None" threatclass="Behavior Analysis"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action deviceowner user
           threatname url src
           dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `zscaler_behavior_analysis_threat_blocked_filter`
how_to_implement: You must install the latest version of Zscaler Add-on from Splunkbase. You must be ingesting Zscaler events into your Splunk environment through an ingester. This analytic was written to be used with the "zscalernss-web" sourcetype leveraging the Zscaler proxy data. This enables the integration with Splunk Enterprise Security. Security teams are encouraged to adjust the detection parameters, ensuring the detection is tailored to their specific environment.
known_false_positives: False positives are limited to Zscalar configuration.
references:
    - https://help.zscaler.com/zia/nss-feed-output-format-web-logs
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Potential Adware Behavior Analysis Threat from dest -[$dest$] on $src$ for user-[$user$].
        - field: user
          type: user
          score: 20
          message: Potential Adware Behavior Analysis Threat from dest -[$dest$] on $src$ for user-[$user$].
threat_objects:
    - field: url
      type: url
analytic_story:
    - Zscaler Browser Proxy Threats
asset_type: Web Server
mitre_attack_id:
    - T1566
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: threat