Splunk rules: 05

name: Azure AD Privileged Authentication Administrator Role Assigned
id: a7da845d-6fae-41cf-b823-6c0b8c55814a
version: 14
creation_date: '2023-04-25'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of the Privileged Authentication Administrator role to an Azure AD user. It leverages Azure Active Directory audit logs to identify when this specific role is assigned. This activity is significant because users in this role can set or reset authentication methods for any user, including those in privileged roles like Global Administrators. If confirmed malicious, an attacker could change credentials and assume the identity and permissions of high-privilege users, potentially leading to unauthorized access to sensitive information and critical configurations.
data_source:
    - Azure Active Directory Add member to role
search: |-
    `azure_monitor_aad` "operationName"="Add member to role" "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\""
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product initiatedBy
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_privileged_authentication_administrator_role_assigned_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Administrators may legitimately assign the Privileged Authentication Administrator role as part of administrative tasks. Filter as needed.
references:
    - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-authentication-administrator
    - https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48
    - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
finding:
    title: The privileged Azure AD role Privileged Authentication Administrator was assigned for User $user$ initiated by $initiatedBy$
    entity:
        field: initiatedBy
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: The privileged Azure AD role Privileged Authentication Administrator was assigned for User $user$ initiated by $initiatedBy$
analytic_story:
    - Azure Active Directory Privilege Escalation
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1003.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: CrushFTP Authentication Bypass Exploitation
id: 82eb7f64-d219-4e21-acfe-956de84c1a35
version: 6
creation_date: '2025-04-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). This detection identifies suspicious command execution patterns associated with exploitation of this vulnerability, such as executing mesch.exe with specific arguments like b64exec or fullinstall. This activity is indicative of an attacker exploiting CVE-2025-31161 to gain unauthorized access to the CrushFTP server and perform post-exploitation activities.
data_source:
    - CrushFTP
search: '`crushftp` | rex field=_raw "\\[HTTP:[^:]+:(?<user>[^:]+):(?<src_ip>[^\\]]+)\\]" | rex field=_raw "cmd:(?<process>[^\\*\\r\\n]+)" | where isnotnull(process) AND (match(process, "mesch\.exe") OR match(process, "b64exec") OR match(process, "fullinstall") OR match(process, "run")) | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, user, process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_authentication_bypass_exploitation_filter`'
how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. This detection searches for CrushFTP logs containing suspicious command execution patterns commonly associated with exploitation of the CVE-2025-31161 vulnerability.
known_false_positives: False positives may occur if there are legitimate administrative commands being executed on the CrushFTP server that match the suspicious patterns. Review the commands being executed to determine if the activity is legitimate administrative work or potential malicious activity.
references:
    - https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
    - https://nvd.nist.gov/vuln/detail/CVE-2025-31161
    - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
finding:
    title: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src_ip
          type: system
          score: 50
          message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$
analytic_story:
    - CrushFTP Vulnerabilities
    - Hellcat Ransomware
asset_type: Web Server
cve:
    - CVE-2025-31161
mitre_attack_id:
    - T1190
    - T1059.003
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: GetDomainGroup with PowerShell
id: 93c94be3-bead-4a60-860f-77ca3fe59903
version: 11
creation_date: '2021-08-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `powershell.exe` with command-line arguments that query for domain groups using `Get-DomainGroup`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions mapped to the `Processes` node of the `Endpoint` data model. Monitoring this activity is crucial as `Get-DomainGroup` is part of PowerView, a tool often used by adversaries for domain enumeration and situational awareness. If confirmed malicious, this activity could allow attackers to gain insights into domain group structures, aiding in further exploitation and privilege escalation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="powershell.exe"
        )
        (Processes.process=*Get-DomainGroup*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getdomaingroup_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/
finding:
    title: Domain group discovery with PowerView on $dest$ by $user$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5971.6315'
title: Indirect Command Execution
description: 'An adversary may use default tools, usually not restricted, to gain
  execution without using cmd. Threat Actor Association: Andariel, APT28 - Software
  Association: IcedId - Atomics T1548.002 Test#3 Atomics T1202 Test #1 Atomics T1202
  Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM(forfiles) OR TERM(fodhelper) OR TERM(ftp) OR TERM(pcalua))
  | regex parent_process_name="(?i)(forfiles|fodhelper|ftp|pcalua)\.exe" | table _time,
  host, user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:indirect command execution
- privilege-escalation:abuse elevation control mechanism
technique_id: 
- T1202
- T1548
data_category:
- Windows event logs
references:
- https://pentestlab.blog/tag/pcalua-exe/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1202/T1202.md#atomic-test-1---indirect-command-execution---pcaluaexe

name: Linux Possible Ssh Key File Creation
id: c04ef40c-72da-11ec-8eac-acde48001122
version: 12
creation_date: '2022-01-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of SSH key files in the ~/.ssh/ directory. It leverages filesystem data to identify new files in this specific path. This activity is significant because threat actors often create SSH keys to gain persistent access and escalate privileges on a compromised host. If confirmed malicious, this could allow attackers to remotely access the machine using the OpenSSH daemon service, leading to potential unauthorized control and data exfiltration.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_path IN ("*/.ssh*")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `linux_possible_ssh_key_file_creation_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can create file in ~/.ssh folders for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.hackingarticles.in/ssh-penetration-testing-port-22/
    - https://attack.mitre.org/techniques/T1098/004/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A file $file_name$ is created in $file_path$ on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1098.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: No Windows Updates in a time frame
id: 1a77c08c-2f56-409c-a2d3-7d64617edd4f
version: 8
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Hunting
description: The following analytic identifies Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. It leverages the 'Update' data model in Splunk, specifically looking for the latest 'Installed' status events from Microsoft Windows. This activity is significant for a SOC because endpoints that are not regularly patched are vulnerable to known exploits and security vulnerabilities. If confirmed malicious, this could indicate a compromised endpoint that is intentionally being kept unpatched, potentially allowing attackers to exploit unpatched vulnerabilities and gain unauthorized access or control.
data_source: []
search: |-
    | tstats `security_content_summariesonly` max(_time) as lastTime FROM datamodel=Updates
      WHERE Updates.status=Installed Updates.vendor_product="Microsoft Windows"
      BY Updates.dest Updates.status Updates.vendor_product
    | rename Updates.dest as Host
    | rename Updates.status as "Update Status"
    | rename Updates.vendor_product as Product
    | eval isOutlier=if(lastTime <= relative_time(now(), "-60d@d"), 1, 0)
    | `security_content_ctime(lastTime)`
    | search isOutlier=1
    | rename lastTime as "Last Update Time",
    | table Host, "Update Status", Product, "Last Update Time"
    | `no_windows_updates_in_a_time_frame_filter`
how_to_implement: To successfully implement this search, it requires that the 'Update' data model is being populated. This can be accomplished by ingesting Windows events or the Windows Update log via a universal forwarder on the Windows endpoints you wish to monitor. The Windows add-on should be also be installed and configured to properly parse Windows events in Splunk. There may be other data sources which can populate this data model, including vulnerability management systems.
known_false_positives: No false positives have been identified at this time.
references: []
analytic_story:
    - Monitor for Updates
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint
baselines:
    - Windows Updates Install Successes
    - Windows Updates Install Failures

id: '17159.27778'
title: PowerShell Download Activity
description: 'This use case detects PowerShell commands used to download files or
  strings, indicating possible attempts to execute a script hosted on the internet.
  -- Threat Actor Association: Alloy Taurus/Gallium, APT28 (aka.Fancy Bear, Fighting
  Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29, APT40, FIN7, FIN8,
  FIN11, Gamaredon Group/Shuckworm, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003),
  Sandworm Team - Software Association: ALPHV/Blackcat, Clop, LockBit, Quantum, Raspberry
  Robin, Remcos RAT, TargetCompany, Ursnif, Vice Society -- Atomics T1087.002 Test
  #15 Atomics T1135 Test #8 Atomics T1518 Test #4 Atomics T1518 Test #5 Atomics T1518
  Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ((TERM(Invoke-Expression)
  OR TERM(iex)) AND (TERM(Invoke-WebRequest) OR TERM(iwr))) OR ("New-Object" "Net.Webclient"
  "Download") | table _time, host, user, user, process | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1059
- T1105
data_category:
- PowerShell logs
references:
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.3
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.3
- https://blog.talosintelligence.com/prometei-botnet-improves/
- https://blog.talosintelligence.com/lazarus-three-rats/

name: Randomly Generated Scheduled Task Name
id: 9d22a780-5165-11ec-ad4f-3e22fbd008af
version: 10
creation_date: '2021-11-30'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: experimental
type: Hunting
description: The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the `ut_shannon` function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.
data_source:
    - Windows Event Log Security 4698
search: |-
    `wineventlog_security` EventCode=4698
      | xmlkv Message
      | lookup ut_shannon_lookup word as Task_Name
      | where ut_shannon > 3
      | table  _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden
      | `randomly_generated_scheduled_task_name_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required.
known_false_positives: Legitimate applications may use random Scheduled Task names.
references:
    - https://attack.mitre.org/techniques/T1053/005/
    - https://splunkbase.splunk.com/app/2734/
    - https://en.wikipedia.org/wiki/Entropy_(information_theory)
analytic_story:
    - Active Directory Lateral Movement
    - CISA AA22-257A
    - Scheduled Tasks
    - 0bj3ctivity Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5367.5470'
title: Service Stop Commands
description: 'Adversaries may stop or disable services on a system to render those
  services unavailable to legitimate users. Stopping critical services can inhibit
  or stop response to an incident or aid in the adversary''s overall objectives to
  cause damage to the environment. Threat Actor Association: APT29/Nobelium/Cozy Bear,
  FIN6, Kimsuky, Lapsus$, Lazarus, TA2541, Traveling Spider - Software Association:
  BlackByte, Blackcat/ALPHV, Black Basta, Conti, Cring, Cuba, GhostShell, Lockbit,
  Nefilim, Prometheus / Spook, Ryuk, TeamTNT, WatchDog, WhisperGate, XingLocker --
  Atomics T1489 #Test1 Atomics T1489 #Test2 Atomics T1489 #Test3 -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=4656 OR EventCode=4688
  OR "EventID>4688<" OR "EventID>4656<") ((TERM(sc.exe) OR TERM(sc) OR TERM(net) OR
  TERM(net.exe) ) AND TERM(stop) AND (TERM(ShellHWDetection) OR TERM(AVPSUS) OR TERM(McAfeeDLPAgentService)
  OR TERM(mfewc) OR TERM(eventlog) OR (TERM(BMR) AND TERM(SERVICE)))) OR ( TERM(taskkill)
  AND ( TERM(/IM) OR TERM(/PID) OR TERM(/T) ) AND TERM(/F)) OR ((TERM(sc.exe) OR TERM(sc))
  AND TERM(CONFIG) AND TERM(START=) AND TERM(DISABLED)) | eval process2=mvappend(Object_Server,
  Accesses, Object_Name), process=mvappend(process,process2) | regex process="(?i)(stop.*(ShellHWDetection|AVPSUS|McAfeeDLPAgentService|mfewc|eventlog|BMR.*service))|(taskkill)|(start=.*disabled)"
  | table _time, host, user event_id, parent_process, parent_process_id, parent_process_name,
  parent_process_path, process, process_current_directory, process_id, process_name,
  process_path, signature_id, user_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lockergoga-ransomware-family-used-in-targeted-attacks/
- https://kcm.trellix.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/91000/KB91373/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20LockerGoga.pdf

name: Suspicious Curl Network Connection
id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
version: 12
creation_date: '2021-02-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic detects the use of the curl command contacting suspicious remote domains, such as s3.amazonaws.com, which is indicative of Command and Control (C2) activity or downloading further implants. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate the presence of MacOS adware or other malicious software attempting to establish persistence or exfiltrate data. If confirmed malicious, this could allow attackers to maintain control over the compromised system and deploy additional payloads.
data_source:
    - Sysmon EventID 1
    - Sysmon for Linux EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("curl", "curl.exe")
    Processes.process IN ("*s3.amazonaws.com*")
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id
       Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_curl_network_connection_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://redcanary.com/blog/clipping-silver-sparrows-wings/
finding:
    title: Suspicious usage of curl on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious usage of curl on $dest$
analytic_story:
    - Silver Sparrow
    - Ingress Tool Transfer
    - Linux Living Off The Land
    - APT37 Rustonotto and FadeStealer
    - GhostRedirector IIS Module and Rungan Backdoor
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious MSBuild Spawn
id: a115fba6-5514-11eb-ae93-0242ac130002
version: 14
creation_date: '2021-01-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies instances where wmiprvse.exe spawns msbuild.exe, which is unusual and indicative of potential misuse of a COM object. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process relationships and command-line executions. This activity is significant because msbuild.exe is typically spawned by devenv.exe during legitimate Visual Studio use, not by wmiprvse.exe. If confirmed malicious, this behavior could indicate an attacker executing arbitrary code or scripts, potentially leading to system compromise or further malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=wmiprvse.exe
        AND
        `process_msbuild`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_msbuild_spawn_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
finding:
    title: Suspicious msbuild.exe process executed on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious msbuild.exe process executed on $dest$ by $user$
analytic_story:
    - Trusted Developer Utilities Proxy Execution MSBuild
    - Living Off The Land
    - Storm-2460 CLFS Zero Day Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1127.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Web Remote ShellServlet Access
id: c2a332c3-24a2-4e24-9455-0e80332e6746
version: 11
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies attempts to access the Remote ShellServlet on a web server, specifically targeting Confluence servers vulnerable to CVE-2023-22518 and CVE-2023-22515. It leverages web data to detect URLs containing "*plugins/servlet/com.jsos.shell/*" with a status code of 200. This activity is significant as it is commonly associated with web shells and other malicious behaviors, potentially leading to unauthorized command execution. If confirmed malicious, attackers could gain remote code execution capabilities, compromising the server and potentially the entire network.
data_source:
    - Nginx Access
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url IN ("*plugins/servlet/com.jsos.shell/*") Web.status=200
      BY Web.http_user_agent, Web.status Web.http_method,
         Web.url, Web.url_length, Web.src,
         Web.dest, sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `web_remote_shellservlet_access_filter`
how_to_implement: This analytic necessitates the collection of web data, which can be achieved through Splunk Stream or by utilizing the Splunk Add-on for Apache Web Server. No additional configuration is required for this analytic.
known_false_positives: False positives may occur depending on the web server's configuration. If the web server is intentionally configured to utilize the Remote ShellServlet, then the detections by this analytic would not be considered true positives.
references:
    - http://www.servletsuite.com/servlets/shell.htm
finding:
    title: An attempt to access the Remote ShellServlet on a web server was detected. The source IP is $src$ and the destination hostname is $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
    - GhostRedirector IIS Module and Rungan Backdoor
asset_type: Web Server
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Windows Audit Policy Excluded Category via Auditpol
id: 083708d4-d763-4ba2-87ac-105b526de81a
version: 8
creation_date: '2025-02-19'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic identifies the execution of `auditpol.exe` with the "/set" and "/exclude" command-line arguments which indicates that the user's per-user policy will cause audit to be suppressed regardless of the system audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to exclude specific users events from log data. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_auditpol` Processes.process="*/set*" Processes.process="*/exclude*"
        AND
        NOT Processes.process="*/?*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_audit_policy_excluded_category_via_auditpol_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be rare, investigate the activity, and apply additional filters when necessary.
references:
    - https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
    - https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
    - https://attack.mitre.org/techniques/T1562/002/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified attempting to exclude a specific user events on $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified attempting to exclude a specific user events on $dest$ by user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows Audit Policy Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Disable Defender Firewall And Network
id: 8467d8cd-b0f9-46fa-ac84-a30ad138983e
version: 12
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications in the Windows registry to disable firewall and network protection settings within Windows Defender Security Center. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the UILockdown registry value. This activity is significant as it may indicate an attempt to impair system defenses, potentially restricting users from modifying firewall or network protection settings. If confirmed malicious, this could allow an attacker to weaken the system's security posture, making it more vulnerable to further attacks and unauthorized access.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender Security Center\\Firewall and network protection\\UILockdown" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_defender_firewall_and_network_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender firewall and network protection section feature set to disable on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Level RMM PowerShell Script Installer
id: 1abf472a-88c9-41bb-9002-3272037531b7
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects the PowerShell installer for the Level tool.
    Level is a commercial remote management tool from Level.io.
    Remote management tools, when used for legitimate purposes, can help IT professionals and system administrators remotely access and manage computer systems.
    However, threat actors may exploit these tools for malicious purposes.
    It can be used to maintain persistence and execution on a host by a malicious actor.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventID="4104"
    ScriptBlockText IN (
        "*$env:LEVEL_API_KEY *",
        "*https://downloads.level.io/install_windows.ps1*"
    )
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
         Opcode Name Path ProcessID ScriptBlockId

    | rename Computer as dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_level_rmm_powershell_script_installer_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate IT and system administrators may use the Level PowerShell installer for remote management and maintenance. Filter alerts for authorized use within managed environments.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential Level PowerShell installer activity observed on $dest$ via script block $ScriptBlockId$.
analytic_story:
    - Remote Monitoring and Management Software
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Show Compress Color And Info Tip Registry
id: b7548c2e-9a10-11ec-99e3-acde48001122
version: 15
creation_date: '2022-03-02'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects suspicious modifications to the Windows registry keys related to file compression color and information tips. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "ShowCompColor" and "ShowInfoTip" values under the "Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" path. This activity is significant as it was observed in the Hermetic Wiper malware, indicating potential malicious intent to alter file attributes and user interface elements. If confirmed malicious, this could signify an attempt to manipulate file visibility and deceive users, potentially aiding in further malicious activities.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
finding:
    title: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Data Destruction
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - Hermetic Wiper
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
id: 98f22d82-9d62-11eb-9fcf-acde48001122
version: 12
creation_date: '2021-04-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects a single source endpoint failing to authenticate with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. It leverages Windows Security Event 4768, focusing on failure code `0x12`, indicating revoked credentials. This activity is significant as it may indicate a Password Spraying attack targeting disabled accounts, a tactic used by adversaries to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access or privilege escalation within the Active Directory environment, posing a severe security risk.
data_source:
    - Windows Event Log Security 4768
search: |-
    `wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
      | bucket span=5m _time
      | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
        BY _time, IpAddress
      | where unique_accounts > 30
      | `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
references:
    - https://attack.mitre.org/techniques/T1110/003/
finding:
    title: Potential Kerberos based password spraying attack from $IpAddress$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: IpAddress
      type: ip_address
analytic_story:
    - Active Directory Password Spraying
    - Active Directory Kerberos Attacks
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Non-System Process Querying Definition Update
id: 9d375cfd-c9a5-48ff-b875-9bcaf6b63265
version: 1
creation_date: '2026-04-27'
modification_date: '2026-04-27'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain.
data_source:
    - Sysmon EventID 22
search: |-
    `sysmon`
    EventID="22"
    QueryName="*definitionupdates.microsoft.com*"
    NOT Image IN (
        "*:\\Program Files\\Microsoft Office\\*",
        "*:\\Program Files\\Windows Defender\\*",
        "*:\\ProgramData\\Microsoft\\Windows Defender\\*",
        "*:\\Windows\\System32\\*",
        "*:\\Windows\\SysWOW64\\*"
    )
    | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | rename Computer as dest
    | `windows_non_system_process_querying_definition_update_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate third-party applications or security tools may query these update domains for Windows Defender updates. Filter alerts for trusted software and verified update mechanisms.
references:
    - https://github.com/Nightmare-Eclipse/BlueHammer
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Non-System process $Image$ queried Windows Defender Definition Updates domain $QueryName$ on $dest$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows Privilege Escalation
    - BlueHammer
    - RedSun
asset_type: Endpoint
cve:
    - CVE-2026-33825
mitre_attack_id:
    - T1068
    - T1071.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Odbcconf Load DLL
id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b
version: 12
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of odbcconf.exe with the regsvr action to load a DLL. This is identified by monitoring command-line arguments in process creation logs from Endpoint Detection and Response (EDR) agents. This activity is significant as it may indicate an attempt to execute arbitrary code via DLL loading, a common technique used in various attack vectors. If confirmed malicious, this could allow an attacker to execute code with the privileges of the odbcconf.exe process, potentially leading to system compromise or further lateral movement.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=odbcconf.exe Processes.process IN ("*/a *",  "*-a*") Processes.process="*regsvr*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_odbcconf_load_dll_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
references:
    - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
    - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1218.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Potential AppDomainManager Hijack Artifacts Creation
id: be19b369-fd0c-42be-ae97-c10b6c01638f
version: 5
creation_date: '2026-01-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of an .exe file along with its corresponding .exe.config and a .dll in the same directory, which is a common pattern indicative of potential AppDomain hijacking or CLR code injection attempts. This behavior may signal that a malicious actor is attempting to load a rogue assembly into a legitimate application's AppDomain, allowing code execution under the context of a trusted process.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime from datamodel=Endpoint.Filesystem
    where Filesystem.file_name IN ("*.exe", "*.exe.config", "*.dll") AND Filesystem.file_path IN
      ("*\\windows\\fonts\\*", "*\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*","*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\PerfLogs\\*")
    AND Filesystem.action = "created"
    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name("Filesystem")`
    | stats values(file_name) AS file_name
            values(file_path) AS file_path
            values(user) AS user
            min(firstTime) AS firstTime max(lastTime) AS lastTime
            BY dest process_guid
    | eval exe_present = if(mvcount(mvfilter(match(file_name, "\.exe$"))) > 0, 1, 0)
    | eval config_present = if(mvcount(mvfilter(match(file_name, "\.exe\.config$"))) > 0, 1, 0)
    | eval dll_present = if(mvcount(mvfilter(match(file_name, "\.dll$"))) > 0, 1, 0)

    | eval exe_files = mvfilter(match(file_name, "\.exe$") AND NOT match(file_name, "\.exe\.config$"))
    | eval config_files = mvfilter(match(file_name, "\.exe\.config$"))
    | eval exe_base_names = mvmap(exe_files, replace(exe_files, "\.exe$", ""))
    | eval config_base_names = mvmap(config_files, replace(config_files, "\.exe\.config$", ""))

    | mvexpand exe_base_names
    | mvexpand config_base_names

    | eval file_count = mvcount(file_name)

    | where file_count >= 3 AND exe_present = 1 AND config_present = 1 AND dll_present = 1 AND exe_base_names = config_base_names
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_potential_appdomainmanager_hijack_artifacts_creation_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: This detection may still produce false positives, so additional filtering is recommended. To validate potential alerts, verify that the executable’s original file name matches its current file name, and also review the associated .config file to confirm which DLLs are expected to load during execution. This helps distinguish legitimate activity from suspicious behavior.
references:
    - https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control/
    - https://attack.mitre.org/techniques/T1574/014/
    - https://gist.github.com/djhohnstein/afb93a114b848e16facf0b98cd7cb57b
    - https://www.scworld.com/brief/appdomain-manager-injection-exploited-for-cobalt-strike-beacon-delivery
    - https://jp.security.ntt/insights_resources/tech_blog/appdomainmanager-injection-en/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential Windows AppDomainManager hijack artifact files created on [$dest$]
threat_objects:
    - field: file_name
      type: file_name
    - field: file_path
      type: file_path
analytic_story:
    - SesameOp
asset_type: Endpoint
mitre_attack_id:
    - T1574.014
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint