Splunk rules: 08

id: '20033.35682'
title: Advanced IP Scanner Execution
description: 'Advanced IP Scanner is a legitimate utility that can perform network
  scanning. Several threat actors, including UNC2465, Conti, Pysa ransomware and FIN12,
  have been reported to use Advanced IP Scanner during reconnaissance activities.
  -- Threat Actor Association: FIN12, UNC2465 - Software Association: Akira, AvosLocker,
  Conti, Pysa'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "advanced_ip_scanner" OR (TERM(/portable) TERM(/lng))
  | where match(process_name, "(?i)advanced_ip_scanner") OR match(process, "(?i)\sportable/s.+\slng")
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox
- https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-destructive-pysa-ransomware
- https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
- https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/
- https://www.mandiant.com/resources/blog/shining-a-light-on-darkside-ransomware-operations

name: Certutil exe certificate extraction
id: 337a46be-600f-11eb-ae93-0242ac130002
version: 16
creation_date: '2021-01-26'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: TTP
description: |-
    The following analytic identifies the use of certutil.exe with arguments indicating the manipulation or extraction of certificates.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
    This activity is significant because extracting certificates can allow attackers to sign new authentication tokens, particularly in federated environments like Windows ADFS.
    If confirmed malicious, this could enable attackers to forge authentication tokens, potentially leading to unauthorized access and privilege escalation within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    FROM datamodel=Endpoint.Processes
    WHERE
    (
        Processes.process_name=certutil.exe
        OR
        Processes.original_file_name=certutil.exe
    )
    Processes.process = "*-exportPFX*"

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `certutil_exe_certificate_extraction_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
references:
    - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack
    - https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Windows Persistence Techniques
    - Living Off The Land
    - Cloud Federated Credential Abuse
    - Compromised Windows Host
    - Windows Certificate Services
    - Storm-2460 CLFS Zero Day Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1649
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco NVM - Suspicious Network Connection From Process With No Args
id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173
version: 6
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects system binaries that are commonly abused in process injection techniques but are observed without any command-line arguments.
    It leverages Cisco Network Visibility Module (NVM) flow data and process arguments
    to identify outbound connections initiated by curl where TLS checks were explicitly disabled.
    Binaries such as `rundll32.exe`, `regsvr32.exe`, `dllhost.exe`, `svchost.exe`, and others are legitimate Windows processes that are often injected into by malware or post-exploitation frameworks (e.g., Cobalt Strike) to hide execution.
    When these processes are seen initiating a network connection with an empty or missing command line, it can indicate
    potential injection and communication with a command and control server.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    process_name IN (
      "backgroundtaskhost.exe", "svchost.exe", "dllhost.exe", "werfault.exe",
      "searchprotocolhost.exe", "wuauclt.exe", "spoolsv.exe", "rundll32.exe",
      "regasm.exe", "regsvr32.exe", "regsvcs.exe"
    )
    NOT process_arguments="*"
    NOT dest IN (
            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
            )
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___suspicious_network_connection_from_process_with_no_args_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Some system binaries may execute without arguments in rare legitimate scenarios (e.g., certain service launches), and initiate
    a network connection to microsoft servers for telemetry or update purposes. Apply additional filters as needed.
    However, binaries such as `rundll32.exe` or `dllhost.exe` running with no command-line context are highly suspicious and warrant investigation.
references:
    - https://redcanary.com/threat-detection-report/techniques/process-injection/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The $process_name$ was seen on host $src$ executing without any command-line arguments and initiating a network connection towards $dest$. This might indicate a potential communication with a C&C server.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1055
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Citrix ADC Exploitation CVE-2023-3519
id: 76ac2dcb-333c-4a77-8ae9-2720cfae47a8
version: 10
creation_date: '2023-07-21'
modification_date: '2026-09-01'
author: Michael Haag, Splunk
status: production
type: Hunting
description: |
    The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel.
    This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk.
    If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.
data_source:
    - Palo Alto Network Threat
search: |-
    | tstats `security_content_summariesonly`
             count min(_time) as firstTime
                   max(_time) as lastTime
    FROM datamodel=Web WHERE

    Web.http_method=POST
    Web.url IN (
        "*/cgi/logout",
        "*/cgi/samlart?samlart=*",
        "*/cgi/samlauth",
        "*/gwtest/formssso?event=start&target=*",
        "*/netscaler/ns_gui/vpn/*",
        "*/saml/activelogin",
        "*/saml/login"
    )

    BY Web.http_user_agent Web.status
       Web.http_method Web.url Web.url_length
       Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `citrix_adc_exploitation_cve_2023_3519_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
known_false_positives: False positives may be present based on organization use of SAML utilities. Filter, or restrict the analytic to Citrix devices only.
references:
    - https://blog.assetnote.io/2023/07/21/citrix-CVE-2023-3519-analysis/
    - https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
    - https://securityintelligence.com/x-force/x-force-uncovers-global-netscaler-gateway-credential-harvesting-campaign/
    - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
analytic_story:
    - Citrix Netscaler ADC CVE-2023-3519
    - CISA AA24-241A
asset_type: Network
cve:
    - CVE-2023-3519
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: endpoint

name: Cloud API Calls From Previously Unseen User Roles
id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
version: 11
creation_date: '2020-10-27'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: Anomaly
description: The following analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
data_source:
    - AWS CloudTrail
search: |-
    | tstats earliest(_time) as firstTime, latest(_time) as lastTime FROM datamodel=Change
      WHERE All_Changes.user_type=AssumedRole
        AND
        All_Changes.status=success
      BY All_Changes.user, All_Changes.command All_Changes.object
    | `drop_dm_object_name("All_Changes")`
    | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data
    | eventstats max(enough_data) as enough_data
    | where enough_data=1
    | eval firstTimeSeenUserApiCall=min(firstTimeSeen)
    | where isnull(firstTimeSeenUserApiCall) OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h")
    | table firstTime, user, object, command
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cloud_api_calls_from_previously_unseen_user_roles_filter`
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud API Calls Per User Role - Initial` to build the initial table of user roles, commands, and times. You must also enable the second baseline search `Previously Seen Cloud API Calls Per User Role - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_api_calls_from_previously_unseen_user_roles_filter`
known_false_positives: No false positives have been identified at this time.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before
analytic_story:
    - Suspicious Cloud User Activities
asset_type: AWS Instance
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Cloud API Calls Per User Role - Update
    - Previously Seen Cloud API Calls Per User Role - Initial

id: '21846.38507'
title: CMD execution with _c
description: 'The cmd.exe /c command is used to execute a specific command and then
  terminate the command prompt (CMD) window and is commonly seen in both legitimate
  and malicious scripted processes. Attackers may use /c after commands to avoid detection.
  -- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon - Software Association: DarkGate, Snatch
  -- Atomics T1036 Test #2 Atomics T1059.003 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "cmd.exe" "/c" | regex process="(?i)cmd(\.exe(\"?))?\s+\/c\s+"
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.003
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md#atomic-test-2---malware-masquerading-and-execution-from-zip-file
- https://twitter.com/ffforward/status/1481672378639912960

id: '6088.18332'
title: Command Line lsass request
description: 'The memory of lsass.exe is often dumped for credential theft attacks.
  This use case looks for instances of when lsass.exe has been called by powershell.exe
  or cmd.exe -- Threat Actor Association: Alloy Taurus/Gallium, Cadet Blizzard, Flax
  Typhoon, Redfly, Witchetty - Software Association: Blackcat/ALPHV, Clop, Quantum,
  Vice Society -- Atomics T1003.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(lsass) (TERM(cmd)
  OR TERM(powershell)) | table _time, host, user parent_*, process, process_*, signature_id
  | bin span=5s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping
technique_id: 
- T1003
data_category:
- PowerShell logs
references:
- https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1

name: Disabling Windows Local Security Authority Defences via Registry
id: 45cd08f8-a2c9-4f4e-baab-e1a0c624b0ab
version: 11
creation_date: '2022-09-08'
modification_date: '2026-05-13'
author: Dean Luxton,Teoderick Contreras Splunk
status: production
type: TTP
description: The following analytic identifies the deletion of registry keys that disable Local Security Authority (LSA) protection and Microsoft Defender Device Guard. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry actions and paths associated with LSA and Device Guard settings. This activity is significant because disabling these defenses can leave a system vulnerable to various attacks, including credential theft and unauthorized code execution. If confirmed malicious, this action could allow attackers to bypass critical security mechanisms, leading to potential system compromise and persistent access.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Lsa\\LsaCfgFlags", "*\\Lsa\\RunAsPPL", "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\*") AND ((Registry.action = deleted) OR (Registry.action = modified AND Registry.registry_value_data IN(0x00000000, 0))) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_windows_local_security_authority_defences_via_registry_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Potential to be triggered by an administrator disabling protections for troubleshooting purposes.
references:
    - https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
    - https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage
finding:
    title: An attempt to disable Windows LSA defences was detected on $dest$. The reg key $registry_path$ was deleted by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An attempt to disable Windows LSA defences was detected on $dest$. The reg key $registry_path$ was deleted by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi Account Modified
id: b5e3b024-a7bb-4019-8975-46cf54485e78
version: 4
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. This activity may indicate unauthorized access, indicator removal, or persistence attempts by an attacker seeking to establish or maintain control of the host.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*esxcli system account*" Message IN ("*-i *","*--id*") NOT Message="*[shell*" | rex field=_raw "Z (?<dest>[\w\.]+)\s.*: \[(?<initial_user>\w+)]:\s.+-i[d]*\s(?<modified_user>[\w_\-0-9]+)" | stats min(_time) as firstTime max(_time) as lastTime count by dest initial_user modified_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_account_modified_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: New local accounts being created in ESXi is rare in most environments. Tune as needed.
references:
    - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Local account created, deleted, or modified on ESXi $dest$.
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1136.001
    - T1078
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: GetWmiObject DS User with PowerShell
id: 22d3b118-04df-11ec-8fa3-acde48001122
version: 11
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of `powershell.exe` with command-line arguments used to query domain users via the `Get-WmiObject` cmdlet and `-class ds_user` parameter.
    This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
    This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain users, which is a common step in Active Directory Discovery.
    If confirmed malicious, this could lead to further attacks, including privilege escalation and lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        `process_powershell`
        OR
        `process_cmd`
    )
    AND
    Processes.process = "*get-wmiobject*"
    Processes.process = "*ds_user*"
    Processes.process = "*root\\directory\\ldap*"
    Processes.process = "*-namespace*"

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getwmiobject_ds_user_with_powershell_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Administrators or power users may use this command for troubleshooting.
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: an instance of process $process_name$ with commandline $process$ on $dest$
        - field: dest
          type: system
          score: 20
          message: an instance of process $process_name$ with commandline $process$ on $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082
id: e03edeba-4942-470c-a664-27253f3ad351
version: 10
creation_date: '2023-08-08'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |-
    The following analytic detects potential unauthorized access attempts exploiting CVE-2023-35082 within Ivanti's software products.
    It identifies access to the specific URI path /mifs/asfV3/api/v2/ with an HTTP 200 response code in web access logs, indicating successful unauthorized access.
    This activity is significant for a SOC as it highlights potential security breaches that could lead to unauthorized data access or system modifications.
    If confirmed malicious, an attacker could gain unbridled access to sensitive organizational data or modify systems maliciously, posing severe security risks.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url="*/mifs/asfV3/api/v2/*"
    Web.status=200

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082_filter`
how_to_implement: |-
    To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products.
known_false_positives: |-
    Similar to CVE-2023-35078, the path for exploitation indicates that status=200 is required for successful exploitation of the vulnerability.
    False positives may be present if status=200 is removed from the search.
    If it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts.
    Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.
references:
    - https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
    - https://github.com/vchan-in/CVE-2023-35078-Exploit-POC/blob/main/cve_2023_35078_poc.py
    - https://www.rapid7.com/blog/post/2023/08/02/cve-2023-35082-mobileiron-core-unauthenticated-api-access-vulnerability/
finding:
    title: Potential CVE-2023-35082 against an Ivanti EPMM appliance on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ivanti EPMM Remote Unauthenticated Access
asset_type: Web Server
cve:
    - CVE-2023-35082
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Binary Executed from Shared Memory Directory
id: 2e954190-d547-447c-94d7-d8acac97873b
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic identifies the execution of a binary by root from Linux shared memory directories (/dev/shm/ and /run/shm/). Threat actors place executables in these directories to persist on high-uptime servers as system backdoors. Both /dev/shm and /run/shm are tmpfs-backed directories that exist only in virtual memory with no persistent storage, making them attractive for staging fileless or semi-fileless malware while avoiding disk forensics.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_path IN (
        "/dev/shm/*",
        "/run/shm/*"
    )
    Processes.user=root

    by Processes.process Processes.process_path Processes.process_name Processes.user
       Processes.user_id Processes.process_hash Processes.parent_process_name
       Processes.parent_process_path Processes.parent_process Processes.parent_process_guid
       Processes.parent_process_id Processes.process_guid Processes.process_id
       Processes.vendor_product Processes.action Processes.dest
       Processes.process_current_directory Processes.process_integrity_level
       Processes.original_file_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_binary_executed_from_shared_memory_directory_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate applications may use shared memory directories for temporary file storage or inter-process communication. Verify any flagged activity against known software behavior and filter accordingly.
references:
    - https://linuxsecurity.com/features/fileless-malware-on-linux
    - https://twitter.com/GossiTheDog/status/1522964028284411907
    - https://github.com/elastic/detection-rules/blob/main/rules/linux/execution_process_started_in_shared_memory_directory.toml
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Linux binary executed from shared memory directory [$process$] - activity observed on [$dest$].
        - field: user
          type: user
          score: 20
          message: Linux binary executed from shared memory directory [$process$] - activity observed on [$dest$].
threat_objects:
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Post-Exploitation
    - Linux Persistence Techniques
    - Linux Privilege Escalation
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Edit Cron Table Parameter
id: 0d370304-5f26-11ec-a4bb-acde48001122
version: 9
creation_date: '2021-12-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = crontab Processes.process = "*crontab *" Processes.process = "* -e*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_edit_cron_table_parameter_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1053/003/
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
    - Scheduled Tasks
asset_type: Endpoint
mitre_attack_id:
    - T1053.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux File Creation In System Generator Directory
id: 06c23568-e05b-4fff-95cd-8b0303b6d032
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects potential persistence using a systemd generator on Linux, which involves creating a malicious script or binary that is typically executed during the system's boot process.
    Systemd generators are typically placed in directories like /lib/systemd/system-generators/, where they are run early in the boot sequence to dynamically generate or modify unit files that control system services.
    By placing a custom generator in this directory, an attacker can ensure their code is executed each time the system starts, allowing them to maintain access or control even after reboots.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.action IN ("created", "modified")
    Filesystem.file_path="*/lib/systemd/system-generators/*"

    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
       Filesystem.action Filesystem.process_guid Filesystem.process_id

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_file_creation_in_system_generator_directory_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators or software packages may place custom generators in systemd generator directories during system configuration or application deployment. Filter based on known software installations and verified administrative activity.
references:
    - https://github.com/Aegrah/PANIX
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The file [$file_name$] was created in the system generator directory [$file_path$] on [$dest$] by [$user$].
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1037.005
    - T1547
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '12575.17924'
title: Msxsl Execution
description: 'To support complex operations, the XSL standard includes support for
  embedded scripting in various languages. Adversaries may abuse this functionality
  to execute arbitrary files while potentially bypassing application control. Similar
  to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation
  utility binary (msxsl.exe) and can be installed and used to execute malicious JavaScript
  embedded within local or remote (URL referenced) XSL files. Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN) Atomics T1220 Test #1 Atomics T1220 Test #2 '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("msxsl.exe") OR ((".xml" ".xsl") OR (".xsl" ".xsl"))
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host | where match(process_name, "(?i)msxsl") OR
  match(process, "(?i)\S+\.x[ms]l\s+.*\.xsl") '
techniques:
- defense-evasion:xsl script processing
technique_id: 
- T1220
data_category:
- Windows event logs
references:
- https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/

id: '5525.17084'
title: Native Archive Commands
description: 'An adversary may compress and/or encrypt data that is collected prior
  to exfiltration. Compressing the data can help to obfuscate the collected data and
  minimize the amount of data sent over the network. - Threat Actor Association: APT28
  (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM),
  APT29/Nobelium/Cozy Bear, APT33, Conti, DarkSide, BlackMatter, FIN7, Karakurt, MuddyWater,
  TA428, Volt Typhoon, Witchetty - Software Association: Black Basta, NanoCore, Ransom
  Cartel, SquirrelWaffle - Atomics T1074.001 Test#3 Atomics T1560 Test#1 Atomics T1560.001
  Test #5 Atomics T1560.001 Test #6 Atomics T1560.001 Test #7 Atomics T1560.001 Test
  #8 Atomics T1560.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  (TERM(Compress-Archive) OR TERM(tar) OR TERM(makecab) OR TERM(compact.exe) OR TERM(compact))
  | table _time, host, user signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
- collection:archive collected data
technique_id:
- T1074.001
- T1560
data_category:
- Windows Sysmon
references:
- https://liberty-shell.com/sec/2019/11/06/living-off-the-land-pt2/

name: Process Execution via WMI
id: 24869767-8579-485d-9a4f-d9ddfd8f0cac
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a process by `WmiPrvSE.exe`, indicating potential use of WMI (Windows Management Instrumentation) for process creation. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant as WMI can be used for lateral movement, remote code execution, or persistence by attackers. If confirmed malicious, this could allow an attacker to execute arbitrary commands or scripts, potentially leading to further compromise of the affected system or network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe NOT (Processes.process IN ("*\\dismhost.exe*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, administrators may use wmi to execute commands for legitimate purposes.
references: []
finding:
    title: A remote instance execution of wmic.exe by WmiPrvSE.exe detected on host - $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A remote instance execution of wmic.exe by WmiPrvSE.exe detected on host - $dest$
analytic_story:
    - Suspicious WMI Use
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '30388.54741'
title: Suspicious PowerShell Parameter Substring
description: Threat actors may use obfuscated and truncated PowerShell execution arguments
  to evade detection, leveraging PowerShell's parameter binding functionality that
  allows partial matching of command-line arguments. This use case detects process
  executions containing substrings for commonly abused PowerShell parameters.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") " -windowstyl " OR " -windowsty " OR " -windowst " OR " -windows
  " OR " -windo " OR " -wind " OR " -win " OR " -wi" OR ((" -executionpolic " OR "
  -executionpoli " OR " -executionpol " OR " -executionpo " OR " -executionp " OR
  " -execution " OR " -executio " OR " -executi " OR " -execut " OR " -execu " OR
  " -exec " OR " -exe " OR " -ex") "bypass") OR " -NoPr " OR " -NoPro " OR " -NoProf
  " OR " -NoProfi " OR " -NoProfil " OR " -nonin " OR " -nonint " OR " -noninte "
  OR " -noninter " OR " -nonintera " OR " -noninterac " OR " -noninteract " OR " -noninteracti
  " OR " -noninteractiv " OR " -ec " OR " -encodedComman " OR " -encodedComma " OR
  " -encodedComm " OR " -encodedCom " OR " -encodedCo " OR " -encodedC " OR " -encoded
  " OR " -encode " OR " -encod " OR " -enco " OR " -en " OR (" /windowstyle " OR "
  /windowstyl " OR " /windowsty " OR " /windowst " OR " /windows " OR " /windo " OR
  " /wind " OR " /win " OR " /wi") OR ((" /executionpolic " OR " /executionpoli "
  OR " /executionpol " OR " /executionpo " OR " /executionp " OR " /execution " OR
  " /executio " OR " /executi " OR " /execut " OR " /execu " OR " /exec " OR " /exe
  " OR " /ex") "bypass") OR " /NoPr " OR " /NoPro " OR " /NoProf " OR " /NoProfi "
  OR " /NoProfil " OR " /nonin " OR " /nonint " OR " /noninte " OR " /noninter " OR
  " /nonintera " OR " /noninterac " OR " /noninteract " OR " /noninteracti " OR "
  /noninteractiv " OR " /ec " OR " /encodedComman " OR " /encodedComma " OR " /encodedComm
  " OR " /encodedCom " OR " /encodedCo " OR " /encodedC " OR " /encoded " OR " /encode
  " OR " /encod " OR " /enco " OR " /en" | regex process="(?i)\s(-|\/)(win?d?o?w?s?t?y?l?\s+hi?d?d?e?|windowstyle\s+h\s|NoPro?f?i?l?\s|nonint?e?r?a?c?t?i?v?\s|enc?o?d?e?d?C?o?m?m?a?n?\s|((exe?c?u?t?i?o?n?p?o?l?i?c?)|ep)\s+(bypass)?|ec\s)"
  | table _time, host, user process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
references:
- http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml

name: Windows Devtunnels Execution
id: b2630bb6-97df-405a-88b5-de6bb2c12cc3
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects the execution of Microsoft devtunnels.exe.
    Microsoft Devtunnels is a feature within Visual Studio that allows developers to expose their local development environment to the internet via secure, temporary tunnels, enabling external access for testing webhooks, APIs, and other services.
    While designed for legitimate development purposes, an attacker could exploit this feature to expose a compromised system or service to the internet, creating a covert communication channel that bypasses network security measures.
    By using Dev Tunnels, the attacker can establish a remote connection to the compromised environment, facilitate data exfiltration, or maintain command-and-control communications while avoiding detection by blending their activities with legitimate development traffic.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.original_file_name="devtunnel.dll"
    OR
    Processes.process_name="devtunnel.exe"

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_devtunnels_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate developers may use Microsoft Devtunnels for testing and debugging their applications. Filter alerts for approved development environments and users.
references:
    - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential Devtunnels execution observed on $dest$ via $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Reverse Network Proxy
asset_type: Endpoint
mitre_attack_id:
    - T1090
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DISM Install PowerShell Web Access
id: fa6142a7-c364-4d11-9954-895dd9efb2d4
version: 11
creation_date: '2024-09-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the installation of PowerShell Web Access using the Deployment Image Servicing and Management (DISM) tool. It leverages Sysmon EventID 1 to identify the execution of `dism.exe` with specific parameters related to enabling the WindowsPowerShellWebAccess feature. This activity is significant because enabling PowerShell Web Access can facilitate remote execution of PowerShell commands, potentially allowing an attacker to gain unauthorized access to systems and networks. If confirmed malicious, this action could lead to further exploitation and compromise of the affected system.
data_source:
    - Windows Event Log Security 4688
    - Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=dism.exe (Processes.process="*WindowsPowerShellWebAccess*"
        AND
        Processes.process="*/online*"
        AND
        Processes.process="*/enable-feature*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_dism_install_powershell_web_access_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators using the DISM tool to update and install Windows features may cause false positives that can be filtered with `windows_dism_install_powershell_web_access_filter`.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
    - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
finding:
    title: PowerShell Web Access has been installed on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - CISA AA24-241A
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Hijack Execution Flow Version Dll Side Load
id: 8351340b-ac0e-41ec-8b07-dd01bf32d6ea
version: 14
creation_date: '2022-08-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a process loading a version.dll file from a directory other than %windir%\system32 or %windir%\syswow64. This detection leverages Sysmon EventCode 7 to identify instances where an unsigned or improperly located version.dll is loaded. This activity is significant as it is a common technique used in ransomware and APT malware campaigns, including Brute Ratel C4, to execute malicious code via DLL side loading. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and potentially compromise the target host.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7 ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*",  "*\\windows\\syswow64\\*"))) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hijack_execution_flow_version_dll_side_load_filter`'
how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a process $Image$ loading $ImageLoaded$ as a side load dll on $dest$
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - Brute Ratel C4
    - XWorm
    - Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint