Splunk rules: 09

name: ASL AWS Create Access Key
id: 81a9f2fe-1697-473c-af1d-086b0d8b63c8
version: 7
creation_date: '2021-03-02'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Hunting
description: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=CreateAccessKey
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_create_access_key_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
references:
    - https://bishopfox.com/blog/privilege-escalation-in-aws
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
analytic_story:
    - AWS IAM Privilege Escalation
    - Scattered Lapsus$ Hunters
asset_type: AWS Account
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '13810.20276'
title: Cmstp Execution
description: 'Adversaries may abuse CMSTP to proxy execution of malicious code. The
  Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program
  used to install Connection Manager service profiles. CMSTP.exe accepts an installation
  information file (INF) as a parameter and installs a service profile leveraged for
  remote access connections. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
  Atomics T1218.003 Test #1 Atomics T1218.003 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  OR Type=Process) ("cmstp.exe") OR ("/s" "/.inf") OR "/ni" OR "/ns" | regex process="(?i)cmstp|\s+\/s\s+.+\.inf|\s+\/ni\s+.{4,}|\s+\/ns\s+.{4,}"
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:cmstp
technique_id:
- T1218.003
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Cmstp/

name: Detect HTML Help Renamed
id: 62fed254-513b-460e-953d-79771493a9f3
version: 14
creation_date: '2021-02-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects instances where hh.exe (HTML Help) has been renamed and is executing a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because attackers can use renamed hh.exe to execute malicious scripts embedded in CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow attackers to run arbitrary scripts, escalate privileges, or persist within the environment, posing a significant security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name!=hh.exe
        AND
        Processes.original_file_name=HH.EXE
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_html_help_renamed_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1218/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
    - https://lolbas-project.github.io/lolbas/Binaries/Hh/
analytic_story:
    - Suspicious Compiled HTML Activity
    - Living Off The Land
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disabling Remote User Account Control
id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic identifies modifications to the registry key that controls the enforcement of Windows User Account Control (UAC). It detects changes to the registry path `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA` where the value is set to `0x00000000`. This activity is significant because disabling UAC can allow unauthorized changes to the system without user consent, potentially leading to privilege escalation. If confirmed malicious, an attacker could gain elevated privileges, making it easier to execute further attacks or maintain persistence within the environment.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications.
known_false_positives: This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence.
references: []
finding:
    title: The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - Suspicious Windows Registry Activities
    - Remcos
    - Windows Registry Abuse
    - Azorult
    - AgentTesla
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Domain Controller Discovery with Wmic
id: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc
version: 8
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because it is commonly used by adversaries and Red Teams for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out the network, identify key systems, and plan further attacks, potentially leading to unauthorized access and data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="wmic.exe"
        )
        (Processes.process="" OR Processes.process="*DomainControllerAddress*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `domain_controller_discovery_with_wmic_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi User Granted Admin Role
id: b0c64d6e-cfdf-441a-b6ce-d956e202563e
version: 4
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*esxcli system permission set*" AND Message="*role Admin*" | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "--id (?<target_user>\w+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command target_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_user_granted_admin_role_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments after initial setup, however tune as needed.
finding:
    title: $target_user$ granted Admin role on ESXi host $dest$ by $user$.
    entity:
        field: target_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: $target_user$ granted Admin role on ESXi host $dest$ by $user$.
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1098
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: First Time Seen Running Windows Service
id: 823136f2-d755-4b6d-ae04-372b486a5808
version: 12
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
description: The following analytic detects the first occurrence of a Windows service running in your environment. It leverages Windows system event logs, specifically EventCode 7036, to identify services entering the "running" state. This activity is significant because the appearance of a new or previously unseen service could indicate the installation of unauthorized or malicious software. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, maintain persistence, or escalate privileges within the environment. Monitoring for new services helps in early detection of potential threats.
data_source:
    - Windows Event Log System 7036
search: |-
    `wineventlog_system` EventCode=7036
      | rex field=Message "The (?<service>[-\(\)\s\w]+) service entered the (?<state>\w+) state"
      | where state="running"
      | lookup previously_seen_running_windows_services service as service OUTPUT firstTimeSeen
      | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), `previously_seen_windows_services_window`)
      | table _time dest service
      | `first_time_seen_running_windows_service_filter`
how_to_implement: While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows system event logs in order for this search to execute successfully. You should run the baseline search `Previously Seen Running Windows Services - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Running Windows Services - Update` to keep this table up to date and to age out old Windows Services. Please update the `previously_seen_windows_services_window` macro to adjust the time window. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
known_false_positives: A previously unseen service is not necessarily malicious. Verify that the service is legitimate and that was installed by a legitimate process.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Windows Service observed running for first time on $dest$
analytic_story:
    - Windows Service Abuse
    - Orangeworm Attack Group
    - NOBELIUM Group
asset_type: Endpoint
mitre_attack_id:
    - T1569.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
baselines:
    - Previously Seen Running Windows Services - Update
    - Previously Seen Running Windows Services - Initial

id: '32312.57468'
title: Git Spawns System32 Process
description: 'Adversaries may abuse command and script interpreters to execute commands,
  scripts, or binaries with the help of Git hooks. These interfaces and languages
  provide ways of interacting with computer systems and are a common feature across
  many different platforms. Most systems come with some built-in command-line interface
  and scripting capabilities, for example, Windows installations include the Windows
  Command Shell and PowerShell. This use case detects Git hooks spawning a System32
  process. Note: for best rule fidelity, Windows Event or Sysmon process creation
  logs are recommended due to their detailed parent process path information. Vulnerability
  reference: CVE-2024-32002'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(git) OR TERM(gh)) "C:\\Windows\\system32" | where match(process, "(?i)C:\x5cWindows\x5csystem32")
  and match(parent_process_path, "(?i)\x5c(git|gh)\x5c") and not match(process, "(?i)\x5c\?\?\x5cC:\x5cWindows\x5csystem32\x5cconhost\.exe\s+0xffffffff\s+-ForceV1")
  | table _time, host, user, parent_process_name, parent_process_path, process_path,
  process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows Sysmon
references:
- https://amalmurali.me/posts/git-rce/
- https://github.com/amalmurali47/git_rce/tree/main
- https://nvd.nist.gov/vuln/detail/CVE-2024-32002

id: '33319.58976'
title: Impacket Lateral Movement Activity
description: Impacket is a collection of Python classes for working with network protocols,
  primarily focused on providing tools and scripts that facilitate the interaction
  with network services and protocols commonly used in network penetration testing
  and red teaming. wmiexec, smbexec, and dcomexec are specific tools within the Impacket
  suite that use various protocols to execute commands on remote systems. This use
  case detects specific behavior patterns associated with Impacket tools wmiexec,
  smbexec, and dcomexec.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("&1" OR "&amp;1") (("wmiprvse.exe" OR "mmc.exe" OR "explorer.exe" OR "services.exe")
  ("cmd.exe" "/Q" "/c")) OR ("svchost" "-k" "netsvcs" "taskeng.exe" "cmd" "/C" "Windows\\Temp")
  | where (match(parent_process_name, "(?i)(wmiprvse|mmc|explorer|services)\.exe")
  and match(process, "(?i)cmd\.exe\s\/Q\s\/c\s")) or (match(parent_process, "(?i)svchost\.exe\s-k\snetsvcs.+taskeng\.exe")
  and match(process, "(?i)cmd\.exe\s\/c\s.+Windows\x5cTemp\x5c")) | table _time, host,
  user, parent_*, process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
- lateral-movement:exploitation of remote services
technique_id:
- T1021.002
- T1210
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1047/
- https://attack.mitre.org/techniques/T1021/003/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement/?query=10c14723-61c7-4c75-92ca-9af245723ad2
- https://github.com/fortra/impacket/tree/master

id: '15997.23933'
title: Known Process Injection Commands
description: Adversaries may inject code into processes in order to evade process-based
  defenses as well as possibly elevate privileges. Process injection is a method of
  executing arbitrary code in the address space of a separate live process. Running
  code in the context of another process may allow access to the process's memory,
  system/network resources, and possibly elevated privileges. Execution via process
  injection may also evade detection from security products since the execution is
  masked under a legitimate process. This use case detects PowerShell commands associated
  with process injection.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("VirtualAlloc" OR
  "VirtualAllocEx" OR "VirtualProtect" OR "LdrLoadDll" OR "LoadLibrary" OR "LoadLibraryA"
  OR "LoadLibraryEx" OR "GetProcAddress" OR "OpenProcess" OR "OpenProcessToken" OR
  "AdjustTokenPrivileges" OR "WriteProcessMemory" OR "CreateRemoteThread" OR "NtCreateThreadEx"
  OR "CreateThread" OR "QueueUserAPC" OR "SuspendThread" OR "ResumeThread" OR "GetDelegateForFunctionPointer")
  | table _time, host, user process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- privilege-escalation:process injection
technique_id: 
- T1055
data_category:
- PowerShell logs
references: null

name: Linux NOPASSWD Entry In Sudoers File
id: ab1e0d52-624a-11ec-8e0b-acde48001122
version: 13
creation_date: '2022-01-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the addition of NOPASSWD entries to the /etc/sudoers file on Linux systems. It leverages Endpoint Detection and Response (EDR) telemetry to identify command lines containing "NOPASSWD:". This activity is significant because it allows users to execute commands with elevated privileges without requiring a password, which can be exploited by adversaries to maintain persistent, privileged access. If confirmed malicious, this could lead to unauthorized privilege escalation, persistent access, and potential compromise of sensitive data and system integrity.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process = "*NOPASSWD:*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_nopasswd_entry_in_sudoers_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
    - https://help.ubuntu.com/community/Sudoers
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a commandline $process$ executed on $dest$
analytic_story:
    - Linux Persistence Techniques
    - China-Nexus Threat Activity
    - Salt Typhoon
    - Linux Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Possible GSM Privilege Escalation
id: ae13064b-72ea-41fb-9d29-716c27e01208
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the commands used in a race condition found in the GSM 0710 tty multiplexor in the Linux kernel.
    This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled.
    This could allow a local unprivileged user to escalate their privileges on the system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process="*rmmod *"
    Processes.process="*n_gsm*"
    Processes.process="*exec *"
    Processes.process IN (
        "*/bin/bash*",
        "*/bin/dash*",
        "*/bin/sh*",
        "*/bin/zsh*"
    )

    by Processes.process Processes.vendor_product
       Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_gsm_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate system administrators or developers testing GSM multiplexor configurations may trigger this detection. Filter based on known authorized users or testing environments.
references:
    - https://access.redhat.com/security/cve/cve-2023-6546
    - https://github.com/Nassim-Asrir/ZDI-24-020/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential GSM Privilege Escalation via [$process$] by [$user$] on [$dest$].
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2023-6546
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '26010.48109'
title: Microsoft SQL Server Suspicious Child Process - Windows
description: 'sqlservr.exe is the primary executable for Microsoft SQL Server. Compromised
  SQL databases may be leveraged to gain footholds for further network exploitation.
  This use case detects executions of commonly abused binaries with parent process
  sqlservr.exe. Unexpected executions can indicate SQL injection or RCE. -- Threat
  Actor Association: FIN7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(sqlservr) OR "sqlservr.exe") (TERM(bash) OR TERM(bitsadmin) OR TERM(cmd) OR
  TERM(net) OR TERM(netstat) OR TERM(nltest) OR TERM(mshta) OR TERM(ping) OR TERM(powershell)
  OR TERM(pwsh) OR TERM(regsvr32) OR TERM(rundll32) OR TERM(sh) OR TERM(systeminfo)
  OR TERM(tasklist) OR TERM(ps) OR TERM(at) OR TERM(schtasks) OR TERM(wsl) OR "bash.exe"
  OR "bitsadmin.exe" OR "cmd.exe" OR "net.exe" OR "netstat.exe" OR "nltest.exe" OR
  "mshta.exe" OR "ping.exe" OR "powershell.exe" OR "pwsh.exe" OR "regsvr32.exe" OR
  "rundll32.exe" OR "sh.exe" OR "systeminfo.exe" OR "tasklist.exe" OR "ps.exe" OR
  "at.exe" OR "schtasks.exe" OR "wsl.exe") | where match(parent_process_name, "(?i)sqlservr\.exe")
  and match(process_path, "(?i)\x5c(bash|bitsadmin|cmd|net|netstat|nltest|mshta|ping|powershell|pwsh|regsvr32|rundll32|sh|systeminfo|tasklist|ps|at|schtasks|wsl)\.exe")
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- persistence:server software component:sql stored procedures
- initial-access:exploit public-facing application
technique_id:
- T1505.001
- T1190
data_category:
- Windows Sysmon
references:
- https://www.securonix.com/blog/securonix-threat-research-security-advisory-new-returgence-attack-campaign-turkish-hackers-target-mssql-servers-to-deliver-domain-wide-mimic-ransomware/

id: '1042.1067'
title: New AutoRun Registry Key
description: 'Detects when common autorun scripts in the Windows registry are modified.
  -- Threat Actor Association: APT27/Emissary Panda, APT28, APT29/Nobelium/Cozy Bear,
  APT33, APT37, APT40, APT43, Blind Eagle/APT-C-36, Carbanak, FIN6, FIN7, FIN13, Lazarus,
  MuddyWater, Mustang Panda, NewsPenguin, RedEyes, RomCom, SaintBear (aka UAC-0056,
  UNC2589, TA471), Sandworm Team, TA2541, TA505, UAC-0056, UNC4990 - Software Association:
  ALPHV/BlackCat, Bazarloader, Blackbyte, Havex, LockBit, MirrorBlast, NanoCore, Phosphorus/Magic
  Hound/APT35, Prometheus / Spook, Sodinokibi/REvil, Ransom Cartel, Remcos RAT, Trigona,
  Vice Society, Zloader -- Atomics T1547.001 Test#3 Atomics T1547.001 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") AND ("Windows\\CurrentVersion\\RunOnce" OR "Windows\\CurrentVersion\\Run"
  OR "Windows\\CurrentVersion\\RunServices" OR "Windows\\CurrentVersion\\RunServicesOnce"
  OR "Windows\\CurrentVersion\\RunOnceEx") | table _time, host, user parent_*, process,
  process_*, signature_id, src_*, dest_* | bin span=1s | stats values(*) as * by _time,
  host | rex field=process max_match=0 (?<registry_path>"[^\"\s]+Windows\\\CurrentVersion\\\Run[^\"\s]{0,}")
  | eventstats values(registry_path) as registry_path by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
technique_id:
- T1547.001
data_category:
- Windows event logs
references: null

id: '33791.59819'
title: Process Execution From Suspicious Folder
description: Threat actors may attempt to manipulate features of their artifacts to
  make them appear legitimate or benign to users and security tools. Masquerading
  involves altering the name or location of an object, whether legitimate or malicious,
  to evade defenses and avoid detection. This technique can include modifying file
  metadata, misleading users about the file type, and using names that resemble legitimate
  tasks or services. This use case detects processes executed from a suspicious folder.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("\\$Recycle.bin\\" OR "\\config\\systemprofile\\" OR "\\Intel\\Logs\\" OR "\\RSA\\MachineKeys\\"
  OR ("\\Users\\" ("\\Public\\" OR "\\All Users\\" OR "\\Default\\" OR "\\NetworkService\\"))
  OR ("\\Windows\\" ("\\addins\\" OR "\\debug\\" OR "\\Fonts\\" OR "\\Help\\" OR "\\IME\\"
  OR "\\Media\\" OR "\\repair\\" OR "\\security\\" OR "\\System32\\Tasks\\" OR "\\Tasks\\"))
  OR "C:\\Perflogs\\") | regex process_path="(?i)(\x5c\$Recycle\.bin\x5c|\x5cconfig\x5csystemprofile\x5c|\x5cIntel\x5cLogs\x5c|\x5cRSA\x5cMachineKeys\x5c)|(\x5cUsers\x5c(Public|All\s+Users|Default|NetworkService)\x5c)|(\x5cWindows\x5c(addins|debug|Fonts|Help|IME|Media|repair|security|System32\x5cTasks|Tasks)\x5c)|^C:\x5cPerflogs\x5c"|
  regex parent_process_path!="(?i)(^C:\x5cUsers\x5cPublic\x5cIBM\x5cClientSolutions\x5cStart_Programs\x5c)"|
  regex parent_process_path!="(?i)(^C:\x5cWindows\x5cSysWOW64\x5cconfig\x5csystemprofile\x5cCitrix\x5cUpdaterBinaries\x5c\S+\CitrixReceiverUpdater\.exe)"
  | table _time, host, user, process, parent_*, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:masquerading
technique_id: 
- T1036
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1036/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml
- https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection

name: Remote System Discovery with Dsquery
id: 9fb562f4-42f8-4139-8e11-a82edf7ed718
version: 11
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of `dsquery.exe` with the `computer` argument, which is used to discover remote systems within a domain. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Remote system discovery is significant as it indicates potential reconnaissance activities by adversaries or Red Teams to map out network resources and Active Directory structures. If confirmed malicious, this activity could lead to further exploitation, lateral movement, and unauthorized access to critical systems within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="dsquery.exe"
        )
        (Processes.process="*computer*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_system_discovery_with_dsquery_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Discovery
    - LAMEHUG
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Shim Database Installation With Suspicious Parameters
id: 404620de-46d8-48b6-90cc-8a8d7b0876a3
version: 15
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: TTP
description: The following analytic detects the execution of sdbinst.exe with parameters indicative of silently creating a shim database. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line arguments. This activity is significant because shim databases can be used to intercept and manipulate API calls, potentially allowing attackers to bypass security controls or achieve persistence. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: A process $process_name$ that possibly creates a shim db silently in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A process $process_name$ that possibly creates a shim db silently in host $dest$
analytic_story:
    - Windows Persistence Techniques
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1546.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Spoolsv Suspicious Loaded Modules
id: a5e451f8-da81-11eb-b245-acde48001122
version: 13
creation_date: '2021-07-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the suspicious loading of DLLs by spoolsv.exe, potentially indicating PrintNightmare exploitation. It leverages Sysmon EventCode 7 to identify instances where spoolsv.exe loads multiple DLLs from the Windows System32 spool drivers x64 directory. This activity is significant as it may signify an attacker exploiting the PrintNightmare vulnerability to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, and persistent access within the environment, posing a severe security risk.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImageLoaded values(loaded_file) as loaded_file values(loaded_file_path) as loaded_file_path values(original_file_name) as original_file_name values(process_exec) as process_exec values(process_guid) as process_guid values(process_hash) as process_hash values(process_name) as process_name values(service_dll_signature_exists) as service_dll_signature_exists values(service_dll_signature_verified) as service_dll_signature_verified values(signature) as signature values(signature_id) as signature_id values(user_id) as user_id values(vendor_product) as vendor_product values(Image) as Image count min(_time) as firstTime max(_time) as lastTime by process_path dest process_id | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml
finding:
    title: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - PrintNightmare CVE-2021-34527
    - Black Basta Ransomware
asset_type: Endpoint
cve:
    - CVE-2021-34527
mitre_attack_id:
    - T1547.012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '24482.45160'
title: WDigest Forced Credential Caching
description: 'WDigest is a legacy authentication protocol used by Windows, primarily
  for backward compatibility, that stores credentials in memory, potentially allowing
  plaintext password access if enabled. Threat actors may adjust wdigest registry
  values to facilitate credential harvesting. This use case detects commands to modify
  the WDigest registry value. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "add" "\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest"
  "UseLogonCredential" | table _time, host, user signature_id, process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- credential-access:os credential dumping:cached domain credentials
technique_id:
- T1112
- T1003.005
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- https://blog.talosintelligence.com/lazarus-three-rats/
- https://www.huntress.com/blog/third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack
- https://twitter.com/Purp1eW0lf/status/1735588467092922707/photo/1

name: Windows AD DCShadow Privileges ACL Addition
id: ae915743-1aa8-4a94-975c-8062ebc8b723
version: 11
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack.
data_source:
    - Windows Event Log Security 5136
search: |-
    `wineventlog_security` EventCode=5136 ObjectClass=domainDNS
      | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest
        BY ObjectClass ObjectDN OpCorrelationID
           src_user SubjectLogonId
      | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
      | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
      | mvexpand new_ace
      | where NOT new_ace IN (old_values)
      | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
      | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")
      | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
      | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
      | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
      | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
      | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value
      | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups
      | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
      | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
      | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
      | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
      | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId
        BY ObjectClass ObjectDN src_user
           user
      | search (aceControlAccessRights="Add/Remove Replica In Domain" AND aceControlAccessRights="Manage Replication Topology" AND aceControlAccessRights="Replication Synchronization") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")
      | `windows_ad_dcshadow_privileges_acl_addition_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.labofapenetrationtester.com/2018/04/dcshadow.html
    - https://github.com/samratashok/nishang/blob/master/ActiveDirectory/Set-DCShadowPermissions.ps1
    - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
    - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
finding:
    title: ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack.
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack.
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1484
    - T1207
    - T1222.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint