Splunk rules: 07

name: Azure AD Service Principal Privilege Escalation
id: 29eb39d3-2bc8-49cc-99b3-35593191a588
version: 10
creation_date: '2025-01-05'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This detection identifies when an Azure Service Principal elevates privileges by adding themself to a new app role assignment.
data_source:
    - Azure Active Directory Add app role assignment to service principal
search: >-
    `azure_monitor_aad` category=AuditLogs operationName="Add app role assignment to service principal" properties.initiatedBy.app.displayName=* properties.result=Success
    | spath path=properties{}.targetResources{}.modifiedProperties{} output=targetResources
    | rename properties.* as *
    | eval user="NA"
    | eval src="NA"
    | stats min(_time) as firstTime max(_time) as lastTime values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(eval(mvindex('properties.targetResources{}.displayName',0))) as targetAppContext
    values(user_agent) as user_agent values(identity) as servicePrincipal values(properties.initiatedBy.app.servicePrincipalId) as servicePrincipalId by dest user src vendor_account vendor_product signature
    | spath input=appRole path=newValue output=appRole
    | spath input=targetServicePrincipal path=newValue output=targetServicePrincipal
    | eval appRole=trim(replace(appRole, "\"", "")), targetServicePrincipal=trim(replace(targetServicePrincipal, "\"", ""))
    | where servicePrincipal=targetServicePrincipal
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `azure_ad_service_principal_privilege_escalation_filter`
how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest EntraID audit logs via Azure EventHub. See reference for links for further details on how to onboard this log source.
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/3110
    - https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Install/
    - https://github.com/mvelazc0/BadZure
    - https://www.splunk.com/en_us/blog/security/hunting-m365-invaders-navigating-the-shadows-of-midnight-blizzard.html
    - https://posts.specterops.io/microsoft-breach-what-happened-what-should-azure-admins-do-da2b7e674ebc
finding:
    title: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
    entity:
        field: servicePrincipal
        type: user
        score: 50
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - Azure Active Directory Privilege Escalation
asset_type: Azure Tenant
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '6158.23984'
title: Certutil Obfuscate_Encode Files
description: 'Certutil can be used to encode files to evade defensive measures. --
  Threat Actor Association: APT29/Nobelium/Cozy Bear, Arid Viper/APT C-23, BlackTech
  - Software Association: Conti'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("certutil" (TERM(-encode) OR TERM(-encodehex))) OR (TERM(-encode) OR TERM(-encodehex))
  | table _time, host, user, signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host | where match(process, "(?i)-encode") '
techniques:
- command-and-control:data encoding
- defense-evasion:obfuscated files or information
technique_id: 
- T1027
- T1132
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/

name: Detect HTML Help Spawn Child Process
id: 723716de-ee55-4cd4-9759-c44e7e55ba4b
version: 16
creation_date: '2021-02-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of hh.exe (HTML Help) spawning a child process, indicating the use of a Compiled HTML Help (CHM) file to execute Windows script code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where hh.exe is the parent process. This activity is significant as it may indicate an attempt to execute malicious scripts via CHM files, a known technique for bypassing security controls. If confirmed malicious, this could lead to unauthorized code execution, potentially compromising the system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=hh.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_html_help_spawn_child_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1218/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
    - https://lolbas-project.github.io/lolbas/Binaries/Hh/
    - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
    - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Compiled HTML Activity
    - AgentTesla
    - Living Off The Land
    - Compromised Windows Host
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Detect Outbound LDAP Traffic
id: 5e06e262-d7cd-4216-b2f8-27b437e18458
version: 13
creation_date: '2021-12-14'
modification_date: '2026-05-13'
author: Bhavin Patel, Johan Bjerke, Splunk
status: production
type: Hunting
description: The following analytic identifies outbound LDAP traffic to external IP addresses. It leverages the Network_Traffic data model to detect connections on ports 389 or 636 that are not directed to private IP ranges (RFC1918). This activity is significant because outbound LDAP traffic can indicate potential data exfiltration or unauthorized access attempts. If confirmed malicious, attackers could exploit this to access sensitive directory information, leading to data breaches or further network compromise.
data_source:
    - Palo Alto Network Traffic
    - Cisco Secure Firewall Threat Defense Connection Event
    - Cisco Secure Access Firewall
search: |-
    | tstats `security_content_summariesonly`
             count min(_time) as firstTime
                   max(_time) as lastTime
                   values(All_Traffic.dest_ip) as dest_ip
    FROM datamodel=Network_Traffic.All_Traffic WHERE

    All_Traffic.dest_port IN (
        389,
        636
    )
    NOT ( All_Traffic.dest_ip IN `non_public_ip_blocks`
    OR All_Traffic.dest IN `non_public_ip_blocks`
    )
    by All_Traffic.action All_Traffic.app All_Traffic.bytes
       All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest
       All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc
       All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
       All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport
       All_Traffic.user All_Traffic.vendor_product All_Traffic.rule
    | `drop_dm_object_name("All_Traffic")`
    | where src_ip != dest_ip OR src != dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_outbound_ldap_traffic_filter`
how_to_implement: |
    In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like, Cisco Secure Firewall Threat Defense, Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. The search requires the Network_Traffic data model to be populated.
known_false_positives: |
    No false positives have been identified at this time. allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate.
references:
    - https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
analytic_story:
    - Log4Shell CVE-2021-44228
    - Cisco Secure Firewall Threat Defense Analytics
    - Cisco Secure Access Analytics
asset_type: Endpoint
cve:
    - CVE-2021-44228
mitre_attack_id:
    - T1190
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Detect Path Interception By Creation Of program exe
id: cbef820c-e1ff-407f-887f-0a9240a2d477
version: 18
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of a program executable in an unquoted service path, a common technique for privilege escalation. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is 'services.exe'. This activity is significant because unquoted service paths can be exploited by attackers to execute arbitrary code with elevated privileges. If confirmed malicious, this could allow an attacker to gain higher-level access, potentially leading to full system compromise and persistent control over the affected endpoint.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?<service_process>[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Windows Persistence Techniques
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1574.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi Download Errors
id: 515cccd0-c4d8-4427-92d9-8a8f8b5a71dc
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: This detection identifies failed file download attempts on ESXi hosts by looking for specific error messages in the system logs. These failures may indicate unauthorized or malicious attempts to install or update components—such as VIBs or scripts
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message IN ("*Download failed*", "*Failed to download file*", "*File download error*", "*Could not download*") | rex field=_raw "Z (?<dest>[\w\.]*)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_download_errors_filter` '
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Download Errors on ESXi host $dest$.
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1601.001
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: FodHelper UAC Bypass
id: 909f8fd8-7ac8-11eb-a1f3-acde48001122
version: 15
creation_date: '2021-03-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of fodhelper.exe, which is known to exploit a User Account Control (UAC) bypass by leveraging specific registry keys. The detection method uses Endpoint Detection and Response (EDR) telemetry to identify when fodhelper.exe spawns a child process and accesses the registry keys. This activity is significant because it indicates a potential privilege escalation attempt by an attacker. If confirmed malicious, the attacker could execute commands with elevated privileges, leading to unauthorized system changes and potential full system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=fodhelper.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `fodhelper_uac_bypass_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited to no false positives are expected.
references:
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
    - https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1
    - https://attack.mitre.org/techniques/T1548/002/
finding:
    title: Suspicious registry keys added by process fodhelper.exe with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious registry keys added by process fodhelper.exe with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - IcedID
    - ValleyRAT
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5443.5592'
title: Invoke-WebRequest Command
description: 'Detects when typical download commands are executed -- Threat Actor
  Association: APT28/Fancy Bear, FIN13, Flax Typhoon, Kimsuky, Memento Team, NewsPenguin,
  Prophet Spider, TA2541, TA505, WinterVivern/UAC-0114, Wizard Spider -- Software
  Association: ALPHV/BlackCat, Alchimist, Bazar, Babuk, Clop, Cuba, DarkGate, LV,
  Qakbot/Qbot, TargetCompany, Trickbot, Remcos RAT, XingLocker, Yanluowang, Zloader
  -- Atomics T1041 Test#1 Atomics T1074.001 Test#1 Atomics T1572 Test#1 Atomics T1566.001
  #Test1 Atomics T1087.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (EventCode=4103 OR EventCode=4104)
  AND (TERM(IWR) OR TERM(Invoke-WebRequest) OR TERM("Invoke-RestMethod") OR TERM(curl)
  OR TERM(wget)) | rex field=process (?<uri>"(?i)(https?\:|ftp(\:|\.)|(\d{1,3}\.){3}\d{1,3})[A-Za-z0-9\x5c\/\_\+\-\%\.\:]+")
  | rex field=process "(?i)(?<cmd>invoke-webrequest|invoke-restmethod|wget|iwr|curl)"
  | where isnotnull(cmd) | table _time, host, user cmd, process, process_name, shell,
  signature_id, user, user_id, uri | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:command and scripting interpreter:powershell
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1105
data_category:
- PowerShell logs
- Process command-line parameters
references: null

name: Kubernetes Process with Resource Ratio Anomalies
id: 0d42b295-0f1f-4183-b75e-377975f47c65
version: 9
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic detects anomalous changes in resource utilization ratios for processes running on a Kubernetes node. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, analyzed through Splunk Observability Cloud. The detection uses a lookup table containing average and standard deviation values for various resource ratios (e.g., CPU:memory, CPU:disk operations). Significant deviations from these baselines may indicate compromised processes, malicious activity, or misconfigurations. If confirmed malicious, this could signify a security breach, allowing attackers to manipulate workloads, potentially leading to data exfiltration or service disruption.
data_source: []
search: "| mstats avg(process.*) as process.* where `kubernetes_metrics` by host.name k8s.cluster.name k8s.node.name process.executable.name span=10s | eval cpu:mem = 'process.cpu.utilization'/'process.memory.utilization' | eval cpu:disk = 'process.cpu.utilization'/'process.disk.operations' | eval mem:disk = 'process.memory.utilization'/'process.disk.operations' | eval cpu:threads = 'process.cpu.utilization'/'process.threads' | eval disk:threads = 'process.disk.operations'/'process.threads' | eval key = 'k8s.cluster.name' + \":\" + 'host.name' + \":\" + 'process.executable.name' | lookup k8s_process_resource_ratio_baseline key | fillnull | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> ratio higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | eval anomalies = replace(anomalies, \",\\s$\", \"\") | where anomalies!=\"\" | stats count values(anomalies) as anomalies by host.name k8s.cluster.name k8s.node.name process.executable.name | where count > 5 | rename host.name as host | `kubernetes_process_with_resource_ratio_anomalies_filter`"
how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes Process with Resource Ratio Anomalies on host $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network
baselines:
    - Baseline Of Kubernetes Process Resource Ratio

name: Linux Proxy Socks Curl
id: bd596c22-ad1e-44fc-b242-817253ce8b08
version: 14
creation_date: '2022-07-29'
modification_date: '2026-06-04'
author: Michael Haag, Splunk, 0xC0FFEEEE, Github Community
status: production
type: TTP
description: |-
    The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`.
    This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details.
    This activity is significant as it may indicate an adversary attempting to use a proxy to evade network monitoring and obscure their actions.
    If confirmed malicious, this behavior could allow attackers to bypass security controls, making it difficult to track their activities and potentially leading to unauthorized data access or exfiltration.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name=curl
    Processes.process IN (
        "*--preproxy *",
        "*--proxy*",
        "*-x *",
        "*socks4://*",
        "*socks4a://*",
        "*socks5://*",
        "*socks5h://*"
    )

    BY Processes.action Processes.dest Processes.original_file_name
        Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
        Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
        Processes.process Processes.process_exec Processes.process_guid
        Processes.process_hash Processes.process_id Processes.process_integrity_level
        Processes.process_name Processes.process_path Processes.user
        Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where match(process, "-x\s") OR match(process, "(?i)(socks\d\w?:\/\/|--(pre)?proxy)")
    | `linux_proxy_socks_curl_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present based on proxy usage internally. Filter as needed.
references:
    - https://www.offensive-security.com/metasploit-unleashed/proxytunnels/
    - https://curl.se/docs/manpage.html
    - https://en.wikipedia.org/wiki/SOCKS
    - https://oxylabs.io/blog/curl-with-proxy
    - https://reqbin.com/req/c-ddxflki5/curl-proxy-server#:~:text=To%20use%20a%20proxy%20with,be%20URL%20decoded%20by%20Curl.
    - https://gtfobins.github.io/gtfobins/curl/
finding:
    title: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a proxy. Review activity for further details.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a proxy. Review activity for further details.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Linux Living Off The Land
    - Ingress Tool Transfer
asset_type: Endpoint
mitre_attack_id:
    - T1090
    - T1095
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: LOLBAS Network Connection On Uncommon Port
id: a6628e6d-be28-4278-b17d-6b5a32968eea
version: 1
creation_date: '2026-08-24'
modification_date: '2026-08-24'
author: Steven Dick, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports.
    It leverages the Network Traffic data model and applies per-binary common-port exclusions to reduce false positives while preserving suspicious non-standard communication.
    This behavior may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries.
    Join this detection with the Process Execution events to provide context and avoid false positives.
data_source:
    - Sysmon EventID 3
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Network_Traffic.All_Traffic where

    All_Traffic.app IN (
        "*\\bitsadmin.exe",
        "*\\certutil.exe",
        "*\\cmstp.exe",
        "*\\cscript.exe",
        "*\\ftp.exe",
        "*\\hh.exe",
        "*\\ie4uinit.exe",
        "*\\ieexec.exe",
        "*\\msbuild.exe",
        "*\\msdt.exe",
        "*\\mshta.exe",
        "*\\msiexec.exe",
        "*\\presentationhost.exe",
        "*\\settingsynchost.exe",
        "*\\syncappvpublishingserver.exe",
        "*\\workfolders.exe",
        "*\\wscript.exe",
        "*\\wuauclt.exe"
        )

    NOT All_Traffic.dest_ip IN (
            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
            "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
            "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
            "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
            "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
            "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24",
            "203.0.113.0/24", "240.0.0.0/4"
        )

    NOT (
            (
                All_Traffic.app IN (
                    "*\\cscript.exe",
                    "*\\wscript.exe"
                )
                All_Traffic.dest_port IN ("80", "443", "3128")
            )
            OR
            (
                All_Traffic.app="*\\ftp.exe"
                All_Traffic.dest_port IN ("20", "21", "989", "990")
            )
            OR
            (
                All_Traffic.app IN (
                    "*\\bitsadmin.exe",
                    "*\\certutil.exe",
                    "*\\cmstp.exe",
                    "*\\hh.exe",
                    "*\\ieexec.exe",
                    "*\\msbuild.exe",
                    "*\\msdt.exe",
                    "*\\mshta.exe",
                    "*\\msiexec.exe",
                    "*\\presentationhost.exe",
                    "*\\settingsynchost.exe",
                    "*\\syncappvpublishingserver.exe",
                    "*\\workfolders.exe",
                    "*\\wuauclt.exe"
                )
                All_Traffic.dest_port IN ("80", "443")
            )
            OR
            (
                All_Traffic.app IN (
                    "*\\certutil.exe",
                    "*\\ie4uinit.exe"
                )
                All_Traffic.dest_port IN ("389")
            )
        )

    by All_Traffic.action All_Traffic.app All_Traffic.dest
       All_Traffic.dest_ip All_Traffic.dest_port
       All_Traffic.direction All_Traffic.dvc All_Traffic.protocol
       All_Traffic.protocol_version All_Traffic.src
       All_Traffic.src_ip All_Traffic.src_port
       All_Traffic.transport All_Traffic.user
       All_Traffic.vendor_product

    | `drop_dm_object_name(All_Traffic)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `lolbas_network_connection_on_uncommon_port_filter`
how_to_implement: |-
    To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field.
    Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model.
known_false_positives: |-
    Legitimate software installation, support tooling, scripting, synchronization, or update workflows may still use uncommon ports in some environments.
    Tune approved destinations, ports, and process paths with the analytic filter macro.
references:
    - https://lolbas-project.github.io/#
    - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: LOLBAS process [$app$] on [$src$] connected to public destination [$dest_ip$] over uncommon port [$dest_port$].
threat_objects:
    - field: app
      type: process_name
    - field: dest_ip
      type: ip_address
analytic_story:
    - Fake CAPTCHA Campaigns
    - Living Off The Land
    - Malicious Inno Setup Loader
    - Water Gamayun
    - APT37 Rustonotto and FadeStealer
    - GhostRedirector IIS Module and Rungan Backdoor
    - Hellcat Ransomware
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1105
    - T1567
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: network

name: Notepad with no Command Line Arguments
id: 5adbc5f1-9a2f-41c1-a810-f37e015f8179
version: 12
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies instances where Notepad.exe is launched without any command line arguments, a behavior commonly associated with the SliverC2 framework. This detection leverages process creation events from Endpoint Detection and Response (EDR) agents, focusing on processes initiated by Notepad.exe within a short time frame. This activity is significant as it may indicate an attempt to inject malicious code into Notepad.exe, a known tactic for evading detection. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise and unauthorized access.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=notepad.exe
        AND
        Processes.action!="blocked"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | regex process="(?i)(notepad\.exe.{0,4}$)"
    | `notepad_with_no_command_line_arguments_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present and filtering may need to occur based on organization endpoint behavior.
references:
    - https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
    - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors#Purple-Team-Section
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ with no command line arguments.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - BishopFox Sliver Adversary Emulation Framework
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Okta Successful Single Factor Authentication
id: 98f6ad4f-4325-4096-9d69-45dc8e638e82
version: 11
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful authentication events where "Okta Verify" is not used. This behavior is significant as it may indicate a misconfiguration, policy violation, or potential account takeover. If confirmed malicious, an attacker could gain unauthorized access to the account, potentially leading to data breaches or further exploitation within the environment.
data_source:
    - Okta
search: |-
    `okta`  action=success src_user_type = User eventType = user.authentication.verify OR eventType = user.authentication.auth_via_mfa
      | stats dc(eventType) values(eventType) as eventType values(target{}.displayName) as targets values(debugContext.debugData.url) min(_time) as firstTime max(_time) as lastTime values(authentication_method)
        BY src_ip user action
           dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | search targets !="Okta Verify"
      | `okta_successful_single_factor_authentication_filter`
how_to_implement: This detection utilizes logs from Okta environments and requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: Although not recommended, certain users may be exempt from multi-factor authentication. Adjust the filter as necessary.
references:
    - https://sec.okta.com/everythingisyes
    - https://attack.mitre.org/techniques/T1078/004/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A user [$user$] has successfully logged in to Okta Dashboard with single factor authentication from IP Address - [$src_ip$].
analytic_story:
    - Okta Account Takeover
asset_type: Okta Tenant
mitre_attack_id:
    - T1078.004
    - T1586.003
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

id: '8301.10294'
title: pypykatz commands
description: 'pypykatz is a Mimikatz implementation in Python. This use case looks
  for command parameters associated with pypykatz. -- Threat Actor Association: APT15,
  Muddled Libra, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta)
  -- Software Association: BianLian, Vice Society, Yanluowang -- Atomics T1003.001
  Test #7 Atomics T1003.002 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM(live) (TERM(lsa) OR TERM(kerberos) OR TERM(smbapi) OR TERM(users)
  OR TERM(token) OR TERM(process) OR TERM(dpapi) OR TERM(smb) OR TERM(ldap) OR TERM(registry)))
  OR (TERM(lsa) (TERM(minidump) OR TERM(rekall))) OR TERM(registry) OR (TERM(crypto)
  (TERM(nt) OR TERM(lm) OR TERM(dcc) OR TERM(dcc2) OR TERM(gppass))) OR (TERM(kerberos)
  (TERM(tgt) OR TERM(tgs) OR TERM(brute) OR TERM(asreproast) OR TERM(spnroast) OR
  TERM(s4u) OR TERM(keytab) OR TERM(ccache) OR TERM(kirbi))) OR (TERM(dpapi) (TERM(prekey)
  OR TERM(minidump) OR TERM(masterkey) OR TERM(credential) OR TERM(vcred) OR TERM(vpol)
  OR TERM(securestring) OR TERM(blob))) OR (TERM(SMB) (TERM(client) OR TERM(lsassfile)
  OR TERM(lsassdump) OR TERM(regfile) OR TERM(regdump) OR TERM(dcsync) OR TERM(secretsdump)
  OR TERM(shareenum) OR TERM(printnightmare) OR TERM(parprintnightmare))) OR (TERM(ldap)
  (client)) | table _time, host, user, signature_id, signature, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host | where match(process,
  "(?i)\s+live\s+(lsa|registry|smb|kerberos|users|token|dpapi|process|ldap)") OR match(process,
  "(?i)\s+((lsa\s+(minidump|rekall|\-\-?\w))|(registry\s+(\-\-?\w|hk|\x5c).+)|(crypto\s+(nt|lm|dcc|gppass|\-\-?\w))|(kerberos\s+(tgt|tgs|brute|asreproast|spnroast|s4u|keytab|ccache|kirbi|\-\-?\w))|(dpapi\s+(prekey|minidump|masterkey|credential|vcred|vpol|securestring|blob|\-\-?\w))|(smb\s+(client|lsassfile|lsassdump|regfile|regdump|dcsync|secretsdump|shareenum|printnightmare|parprintnightmare|\-\-?\w))|(ldap\s+(client|\-\-?\w)))") '
techniques:
- credential-access:os credential dumping
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003
- T1003.001
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html
- https://github.com/skelsec/pypykatz/wiki
- https://github.com/redcanaryco/atomic-red-team/blob/717757d539c1e7d5b8a2ab05b029f4697fbcc978/atomics/T1003.002/T1003.002.md#atomic-test-2---registry-parse-with-pypykatz

id: '9036.12145'
title: Rare Remote Thread
description: 'Rare remote threads are anomalies within an organization and are normally
  worth looking at. Although these kinds of detections can be false positive prone,
  they can be utilized as supporting evidence or as a last resort to detect malicious
  activity your other detection content may be missing. -- Threat Actor Association:
  APT10/menuPass, APT35/Phosphorus/Magic Hound, APT43, FIN8 (Syssphinx), Lancefly,
  Lazarus, TA413, Traveling Spider, UAC-0057 (GhostWriter), Vice Society, Wizard Spider
  - Software Association: 3LOSH, ALPHV/BlackCat, AsyncRAT, Black Basta, Clop, Conti,
  Havex, LimeRAT, LOWZERO, Nefilim, Rhysida, Ryuk'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=8 OR "Event>ID>8<")
  | table _time, host, user event_id, eventtype, parent_*, process, process_*, user,
  user_id | bin span=1s | stats values(*) as * by _time, host | eventstats dc(host)
  as dc_host dc(process_path) as dc_process by parent_process_path | eventstats dc(parent_process_path)
  as dc_parent by process_path | where (dc_host < 3 AND dc_process < 3) OR dc_parent
  < 3 '
techniques:
- defense-evasion:process injection
- privilege-escalation:process injection
technique_id: 
- T1055
data_category:
- Process use of network
- Windows Sysmon
references:
- https://materials.rangeforce.com/tutorial/2020/06/10/Sysmon-Process-Injection/

name: Rubeus Command Line Parameters
id: cca37478-8377-11ec-b59a-acde48001122
version: 13
creation_date: '2022-02-07'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of Rubeus command line parameters, a toolset for Kerberos attacks within Active Directory environments. It leverages Endpoint Detection and Response (EDR) data to identify specific command-line arguments associated with actions like ticket manipulation, kerberoasting, and password spraying. This activity is significant as Rubeus is commonly used by adversaries to exploit Kerberos for privilege escalation and lateral movement. If confirmed malicious, this could lead to unauthorized access, persistence, and potential compromise of sensitive information within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" OR Processes.process = "* monitor /interval*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*" OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
references:
    - https://github.com/GhostPack/Rubeus
    - https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
    - https://attack.mitre.org/techniques/T1550/003/
    - https://en.hackndo.com/kerberos-silver-golden-tickets/
finding:
    title: Rubeus command line parameters were used on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Rubeus command line parameters were used on $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Active Directory Privilege Escalation
    - CISA AA23-347A
    - Active Directory Kerberos Attacks
    - BlackSuit Ransomware
    - Scattered Lapsus$ Hunters
    - ZOVWiper
asset_type: Endpoint
mitre_attack_id:
    - T1550.003
    - T1558.003
    - T1558.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27745.50435'
title: Suspicious File Created in Public Folder
description: 'Threat actors are increasingly utilizing the Public directory on Windows
  endpoints due to the ease of access and evasion. This use case detects file creation
  events for .dll, .exe, and .conf files in the Public directory. Note: if file writes
  to the \Users\Public directory are overly noisy, logic can be modified to the \Users\Public\Library
  directory.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=11) OR "<EventID>11<")
  "\\Users\\Public\\" (".dll" OR ".dll0" OR ".conf" OR ".exe") | rex field=_raw "<Data
  Name=''TargetFilename''>(?<target_filename>[^<]+)</Data>"| regex target_filename="(?i)\x5cUsers\x5cPublic\x5c.+\.(dll0?|conf|exe)"|
  table _time, host, user, process_*, parent_process_name, parent_process_*, target_filename
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading
- defense-evasion:masquerading:match legitimate name or location
technique_id:
- T1036
- T1036.005
data_category:
- Windows Sysmon
references:
- https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
- https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection

id: '15884.23699'
title: Suspicious PowerShell Clipboard Activity
description: 'Adversaries can use a variety of commands to obfuscate their activity.
  This use case detects PowerShell commands involving combinations of the SendKeys
  cmdlet, clipboard access, and native text editors. -- Software Association: BbyStealer
  -- Atomics T1059.001 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("[Windows.Forms.Clipboard]"
  TERM(sendkeys)) (TERM(notepad) OR TERM(wordpad)) | table _time, host, user, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- collection:clipboard data
- execution:command and scripting interpreter
technique_id:
- T1059.001
- T1115
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-5---mimikatz---cradlecraft-pssendkeys
- https://cyble.com/blog/bbystealer-malware-resurfaces-sets-sights-on-vpn-users/