Splunk rules: 0b

name: Azure AD Service Principal New Client Credentials
id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a
version: 14
creation_date: '2022-08-18'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the addition of new credentials to Service Principals and Applications in Azure AD. It leverages Azure AD AuditLogs, specifically monitoring the "Update application*Certificates and secrets management" operation. This activity is significant as it may indicate an adversary attempting to maintain persistent access or escalate privileges within the Azure environment. If confirmed malicious, attackers could use these new credentials to log in as the service principal, potentially compromising sensitive accounts and resources, leading to unauthorized access and control over the Azure environment.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` category=AuditLogs operationName="Update application*Certificates and secrets management "
      | rename properties.* as *
      | rename targetResources{}.* as *
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product modifiedProperties{}.newValue
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_service_principal_new_client_credentials_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
known_false_positives: Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/001/
    - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/
    - https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/
    - https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
    - https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft
    - https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT405/AZT405-3/
finding:
    title: New credentials added for Service Principal by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
    - Azure Active Directory Privilege Escalation
    - NOBELIUM Group
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Azure AD User ImmutableId Attribute Updated
id: 0c0badad-4536-4a84-a561-5ff760f3c00e
version: 13
creation_date: '2022-09-02'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic identifies the modification of the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user. This detection leverages Azure AD audit logs, specifically monitoring the "Update user" operation and changes to the SourceAnchor attribute. This activity is significant as it is a step in setting up an Azure AD identity federation backdoor, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, leading to unauthorized access and potential data breaches.
data_source:
    - Azure Active Directory Update user
search: |-
    `azure_monitor_aad` operationName="Update user" properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename targetResources{}.modifiedProperties{}.newValue as modifiedProperties
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product initiatedBy
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_user_immutableid_attribute_updated_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: The SourceAnchor (also called ImmutableId) Azure AD attribute has legitimate uses for directory synchronization. Investigate and filter as needed.
references:
    - https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-design-concepts
    - https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13
    - https://o365blog.com/post/federation-vulnerability/
    - https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html
    - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
    - https://attack.mitre.org/techniques/T1098/
finding:
    title: The SourceAnchor or ImmutableID attribute has been modified for user $user$ by $initiatedBy$
    entity:
        field: initiatedBy
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: The SourceAnchor or ImmutableID attribute has been modified for user $user$ by $initiatedBy$
analytic_story:
    - Azure Active Directory Persistence
    - Hellcat Ransomware
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Detect PsExec With accepteula Flag
id: 27c3a83d-cada-47c6-9042-67baf19d2574
version: 19
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of `PsExec.exe` with the `accepteula` flag in the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because PsExec is commonly used by threat actors to execute code on remote systems, and the `accepteula` flag indicates first-time usage, which could signify initial compromise. If confirmed malicious, this activity could allow attackers to gain remote code execution capabilities, potentially leading to further system compromise and lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name IN ("psexec.exe", "psexec64.exe")
            OR
            Processes.original_file_name="psexec.c"
        )
        Processes.process=*accepteula*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_psexec_with_accepteula_flag_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine
references:
    - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - DHS Report TA18-074A
    - Active Directory Lateral Movement
    - HAFNIUM Group
    - Rhysida Ransomware
    - Medusa Ransomware
    - DarkSide Ransomware
    - SamSam Ransomware
    - CISA AA22-320A
    - Sandworm Tools
    - IcedID
    - BlackByte Ransomware
    - DarkGate Malware
    - Cactus Ransomware
    - Volt Typhoon
    - Seashell Blizzard
    - VanHelsing Ransomware
    - Storm-0501 Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1021.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect WMI Event Subscription Persistence
id: 01d9a0c2-cece-11eb-ab46-acde48001122
version: 12
creation_date: '2021-06-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and EventID 21 (FilterToConsumerBinding creation) from Sysmon logs. This activity is significant because WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making it a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.
data_source:
    - Sysmon EventID 20
search: |-
    `sysmon` EventID=20
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest dvc object
           object_category object_path signature
           signature_id src status
           user user_id vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_wmi_event_subscription_persistence_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
known_false_positives: It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
    - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md
    - https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
finding:
    title: Possible malicious WMI Subscription created on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Suspicious WMI Use
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1546.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detection of tools built by NirSoft
id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0
version: 11
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process="* /stext *"
            OR
            Processes.process="* /scomma *"
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detection_of_tools_built_by_nirsoft_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You should verify that the tool was used for a legitimate purpose.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: NirSoft tool detected on $dest$
        - field: dest
          type: system
          score: 20
          message: NirSoft tool detected on $dest$
analytic_story:
    - Emotet Malware DHS Report TA18-201A
asset_type: Endpoint
mitre_attack_id:
    - T1072
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1001.1001'
title: Encoded Powershell Command
description: 'PowerShell is a powerful interactive command-line interface and scripting
  environment included in the Windows operating system. Adversaries can use PowerShell
  to perform a number of actions, including discovery of information and execution
  of code. Encoded commands could be a way for an attacker to obfuscate malicious
  scripts they are executing on the victim machine. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422,
  STRONTIUM), APT29/Nobelium, APT35/Phosphorus/Magic Hound, BlackByte, DarkSide, BlackMatter,
  FIN7, Memento Team, MuddyWater, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003),
  Vice Society, Volt Typhoon - Software Attribution: ALPHV/BlackCat, Bazarloader,
  Black Basta, Conti, Emotet, LV, MirrorBlast, Prestige, PYSA/Mespinoza, Ransom Cartel,
  TargetCompany, TrickBot, XingLocker, Yellow Cocaktoo/Jupiter Infostealer, WhisperGate
  - #TrendingThreat #Russia #Ukraine - Atomics T1027 Test #2 Atomics T1027 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "EventID>4103<" OR TERM(EventCode=4104) OR "EventID>4104<") (("-e" OR "-en" OR "-ec"
  OR "-enco" OR "-encodedcommand" OR "-encod" OR "-encode" OR "-encoded" OR "-encodedc*")
  OR ("/e" OR "/en" OR "/ec" OR "/enco" OR "/encodedcommand" OR "/encod" OR "/encode"
  OR "/encoded" OR "/encodedc*") OR "frombase64string") | rex field=Message "(?i)powershell.exe\"?(?<trun_cmd>.{60})"
  | regex process="(?i)(powershell.*\s+(\-|\/)(e|en|ec|enc|enco|encod|encode|ecode[dcoman]+)\s+\S+)|frombase64string"
  | table _time, host, user process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information
- execution:command and scripting interpreter:powershell
technique_id:
- T1027
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ

id: '13615.19724'
title: Hidden User Created - Windows
description: 'Adversaries may hide user accounts in Windows by setting the HKLM\SOFTWARE\Microsoft\Windows
  NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Registry key value to 0 for
  a specific user to prevent that user from being listed on the logon screen. -- Threat
  Actor Association: Unfading Sea Haze - Software Association: Dagon Locker, IcedID
  -- Atomics T1564.002 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR TERM(EventCode=4657) OR "<EventID>4657<" OR Type=Process) (TERM(ADD)
  AND "UserList" AND "/d" AND "0") OR (HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist)
  | regex process="(?i)(REG\s+?ADD).*\x5cCurrentVersion\x5cWinlogon\x5cSpecialAccounts\x5cUserlist.*0"
  | table _time, host, user signature_id, process, process_*, parent_*, signature,
  user_id | bin span=1s | stats values(*) as * by _time, host | where match(process,
  "(?i)(\s+ADD\s+.*\/d.*0)") OR match(signature_id, "4657") '
techniques:
- defense-evasion:hide artifacts:hidden users
- defense-evasion:hide artifacts
technique_id:
- T1564.002
- T1564
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry

name: Linux System Network Discovery
id: 535cb214-8b47-11ec-a2c7-acde48001122
version: 11
creation_date: '2022-02-14'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic identifies potential enumeration of local network configuration on Linux systems.
    It detects this activity by monitoring processes such as "arp," "ifconfig," "ip," "netstat," "firewall-cmd," "ufw," "iptables," "ss," and "route" within a 30-minute window.
    This behavior is significant as it often indicates reconnaissance efforts by adversaries to gather network information for subsequent attacks.
    If confirmed malicious, this activity could enable attackers to map the network, identify vulnerabilities, and plan further exploitation or lateral movement within the environment.
data_source:
    - Sysmon for Linux EventID 1
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(Processes.action) as action
            values(Processes.original_file_name) as original_file_name
            values(Processes.parent_process_exec) as parent_process_exec
            values(Processes.parent_process_guid) as parent_process_guid
            values(Processes.parent_process_id) as parent_process_id
            values(Processes.parent_process_name) as parent_process_name
            values(Processes.parent_process_path) as parent_process_path
            values(Processes.parent_process) as parent_process
            values(Processes.process_exec) as process_exec
            values(Processes.process_guid) as process_guid
            values(Processes.process_hash) as process_hash
            values(Processes.process_id) as process_id
            values(Processes.process_integrity_level) as process_integrity_level
            values(Processes.process_name) as process_name
            values(Processes.process_path) as process_path
            values(Processes.process) as process
            values(Processes.user_id) as user_id
            values(Processes.vendor_product) as vendor_product
            dc(Processes.process_name) as process_name_count
    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name IN (
        "arp",
        "firewall-cmd",
        "ifconfig",
        "ip",
        "iptables",
        "netstat",
        "route",
        "ss",
        "ufw"
    )

    BY _time span=30m Processes.dest Processes.user

    | where process_name_count>=4

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_system_network_discovery_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Network discovery process $process$ executed on $dest$
threat_objects:
    - field: process
      type: command
    - field: process_name
      type: process_name
analytic_story:
    - Data Destruction
    - Network Discovery
    - Industroyer2
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1016
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 External Guest User Invited
id: 8c6d52ec-d5f2-4b2f-8ba1-f32c047a71fa
version: 9
creation_date: '2024-04-13'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`. This detection leverages the Universal Audit Log (UAL)/o365:management:activity sourcetype as a detection data source.
data_source:
    - Office 365 Universal Audit Log
search: "`o365_management_activity` Workload=AzureActiveDirectory AND Operation=\"Add user*\" AND ModifiedProperties{}.NewValue=\"[*Guest*]\" AND ModifiedProperties{}.NewValue=\"[*Invitation*]\" | eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | rex field=user \"(?<user> [ \\w\\.-]+@ [ \\w-]+\\. [ \\w-]{2,4})\" | rename Operation as signature, Id as signature_id | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id src_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_external_guest_user_invited_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Administrator may legitimately invite external guest users. Filter as needed.
references:
    - https://dirkjanm.io/assets/raw/US-22-Mollema-Backdooring-and-hijacking-Azure-AD-accounts_final.pdf
    - https://www.blackhat.com/us-22/briefings/schedule/#backdooring-and-hijacking-azure-ad-accounts-by-abusing-external-identities-26999
    - https://attack.mitre.org/techniques/T1136/003/
    - https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal
finding:
    title: Azure Guest User $user$ invited by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Azure Guest User $user$ invited by $src_user$
analytic_story:
    - Azure Active Directory Persistence
asset_type: O365 Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '15890.23710'
title: PowerShell XML Retrieval
description: 'This use case detects PowerShell commands attempting to retrieve data
  from XML files via http or https. Atomics T1059.001 Test #7 Atomics T1059.001 Test
  #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("MsXml2.ServerXmlHttp"
  OR TERM(ComObject) OR "xml") | table _time, host, user process, process_*, signature_id
  | bin span=1s | stats values(*) as * by _time, host | where match(process, "(?i)http(s?):\/\/")
  and match (process, "(?i)xml") '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
technique_id:
- T1059.001
- T1059
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt

id: '23910.44204'
title: Suspicious Child Process for mshta.exe
description: This use case detects when mshta.exe spawns an unexpected child process.
  This can indicate process injection/hollowing, masquerading, application allowlist
  bypass, or other suspicious activity.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "mshta.exe" ("powershell.exe" OR "pwsh.exe" OR "cmd.exe" OR "rundll32.exe" OR "cscript.exe"
  OR "wscript.exe") | regex parent_process_name="(?i)(mshta\.exe)" | regex process_path="(?i)(cmd|services|powershell|pwsh|(c|w)script)|rundll32\.exe"
  | table _time, host, user process, process_*, parent_process_name, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1059
- T1218.005
data_category:
- Windows Sysmon
references:
- https://blog.talosintelligence.com/gamaredon-apt-targets-ukrainian-agencies/

name: Suspicious Rundll32 StartW
id: 9319dda5-73f2-4d43-a85a-67ce961bddb7
version: 15
creation_date: '2021-02-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of rundll32.exe with the DLL function names "Start" and "StartW," commonly associated with Cobalt Strike payloads. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. This activity is significant as it often indicates the presence of malicious payloads, such as Cobalt Strike, which can lead to unauthorized code execution. If confirmed malicious, this activity could allow attackers to inject shellcode, escalate privileges, and maintain persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_rundll32` Processes.process IN ("*startw", "*startw *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_rundll32_startw_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1218/011/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
    - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1036
    - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
    - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
finding:
    title: rundll32.exe running with suspicious StartW parameters on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: rundll32.exe running with suspicious StartW parameters on $dest$
analytic_story:
    - Trickbot
    - Suspicious Rundll32 Activity
    - Cobalt Strike
    - BlackByte Ransomware
    - Graceful Wipe Out Attack
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chrome Extension Allowed Registry Modification
id: 2846089a-ffe9-4881-a2a2-43f3be2b8cc7
version: 4
creation_date: '2026-01-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows registry keys that control the Chrome Extension Install Allowlist. Unauthorized changes to these keys may indicate attempts to bypass Chrome extension restrictions or install unapproved extensions. This detection helps identify potential security policy violations or malicious activity targeting Chrome extension settings.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path = "*\\Google\\Chrome\\ExtensionInstallAllowlist*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chrome_extension_allowed_registry_modification_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Legitimate IT admin updates to Chrome extension allowlist via Group Policy or enterprise management tools. Filtering is needed.
references:
    - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Chrome ExtensionInstallAllowlist Policy in $registry_path$ was modified on $dest$
analytic_story:
    - Browser Hijacking
asset_type: Endpoint
mitre_attack_id:
    - T1185
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chromium Browser Launched with Small Window Size
id: 88103f56-8f5c-411f-a87f-71bee776f140
version: 5
creation_date: '2026-02-02'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects instances where a Chromium-based browser process, including Chrome, Edge, Brave, Opera, or Vivaldi, is launched with an unusually small window size, typically less than 100 pixels in width or height. Such configurations render the browser effectively invisible to the user and are uncommon in normal user activity. When observed on endpoints, especially in combination with automation, off-screen positioning, or suppression flags, this behavior may indicate attempts to execute web content or automated actions stealthily, bypassing user interaction and security controls. This analytic highlights potential malicious automation or covert browser-based activity.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
    where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
    Processes.process = "*--window-size*"
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | rex field=Processes.process "--window-size=(?<window_width>\d+)\s*,\s*(?<window_height>\d+)"
    | eval window_width=tonumber(window_width), window_height=tonumber(window_height)
    | where window_height < 100 AND window_width < 100
    | `drop_dm_object_name(Processes)`
    | fields * window_width window_height
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_chromium_browser_launched_with_small_window_size_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.trendmicro.com/en_us/research/26/a/analysis-of-the-evelyn-stealer-campaign.html
    - https://peter.sh/experiments/chromium-command-line-switches/
finding:
    title: A Chromium-based browser process was launched on $dest$ by user $user$ with an unusually small window size ($window_width$ x $window_height$ pixels). The process was spawned by $parent_process_name$ and included the following command-line parameters $process$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A Chromium-based browser process was launched on $dest$ by user $user$ with an unusually small window size ($window_width$ x $window_height$ pixels). The process was spawned by $parent_process_name$ and included the following command-line parameters $process$.
threat_objects:
    - field: parent_process
      type: parent_process
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
analytic_story:
    - Browser Hijacking
asset_type: Endpoint
mitre_attack_id:
    - T1497
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Entra User Management Via Azure CLI
id: f6332409-abeb-42f8-b6a7-76201bdc7a0a
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user.
    Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
    While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process IN (
        "*az.cmd*",
        "*azure.cli*"
    )
    Processes.process="*ad *"
    Processes.process="* user*"

    by Processes.process Processes.vendor_product Processes.user_id
       Processes.process_hash Processes.parent_process_name
       Processes.parent_process_exec Processes.action Processes.dest
       Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name
       Processes.parent_process Processes.parent_process_path
       Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id
       Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_entra_user_management_via_azure_cli_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate IT administrators commonly use the Azure CLI for managing user accounts. Filter alerts to exclude approved administrative or automated user management activities.
references:
    - https://atomicredteam.io/persistence/T1136.003/#atomic-test-3---azure-ad---create-a-new-user-via-azure-cli
    - https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Azure user management activity observed on $dest$ executed by $parent_process_name$ via commandline $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Azure Active Directory Persistence
asset_type: Endpoint
mitre_attack_id:
    - T1136
    - T1078.004
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Disable Win Defender Network Protection
id: 8b6c15c7-5556-463d-83c7-986326c21f12
version: 12
creation_date: '2024-01-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that disable Windows Defender Network Protection. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the EnableNetworkProtection registry entry. This activity is significant because disabling Network Protection can leave the system vulnerable to network-based threats by preventing Windows Defender from analyzing and blocking malicious network activity. If confirmed malicious, this action could allow attackers to bypass security measures, potentially leading to unauthorized access, data exfiltration, or further compromise of the network.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_network_protection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender Exploit Guard network protection set to disable on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - Scattered Lapsus$ Hunters
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Known Abused DLL Loaded Suspiciously
id: dd6d1f16-adc0-4e87-9c34-06189516b803
version: 12
creation_date: '2024-04-06'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system. This detection relies on Sysmon EID7 and is compatible with all Officla Sysmon TA versions.
data_source:
    - Sysmon EventID 7
search: '`sysmon` ImageLoaded EventCode=7 NOT ImageLoaded IN ("*\\Program Files*","*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest process_exec process_guid process_hash process_id process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product loaded_file | rename Image as process | eval process_name = case(isnotnull(process),replace(process,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), loaded_file_path = case(isnotnull(loaded_file), replace(loaded_file, "(:[\w\. ]+)", "")), loaded_file = case(isnotnull(loaded_file),replace(loaded_file,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), user = case(NOT user IN ("-"), replace(user, "(.*)\\\(.+)$","\2")) | lookup hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as desc | lookup hijacklibs_loaded library AS loaded_file excludes as loaded_file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded = false | stats count min(_time) as firstTime max(_time) as lastTime by dest loaded_file loaded_file_path process process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_loaded_suspiciously_filter`'
how_to_implement: The following analytic requires Sysmon operational logs to be imported, with EID7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index.
known_false_positives: DLLs being loaded by user mode programs for legitimate reasons.
references:
    - https://attack.mitre.org/techniques/T1574/002/
    - https://hijacklibs.net/api/
    - https://wietze.github.io/blog/hijacking-dlls-in-windows
    - https://github.com/olafhartong/sysmon-modular/pull/195/files
finding:
    title: The module [$loaded_file$] was loaded from an unusual location.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - Windows Defense Evasion Tactics
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry on Smart Card Group Policy
id: 1522145a-8e86-4f83-89a8-baf62a8f489d
version: 9
creation_date: '2024-07-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic is developed to detect suspicious registry modifications targeting the "scforceoption" key. Altering this key enforces smart card login for all users, potentially disrupting normal access methods. Unauthorized changes to this setting could indicate an attempt to restrict access or force a specific authentication method, possibly signifying malicious intent to manipulate system security protocols.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\Policies\\System\\scforceoption*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_on_smart_card_group_policy_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: administrators may enable or disable this feature that may cause some false positive.
references:
    - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A registry modification in Windows Smart Card Group Policy registry settings on $dest$
analytic_story:
    - ShrinkLocker
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Suspicious Burst of Password Changes
id: 0dcfcab9-e936-43bc-8203-005e17dc0744
version: 1
creation_date: '2026-04-29'
modification_date: '2026-04-29'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window.
    This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
data_source:
    - Windows Event Log Security 4723
    - Windows Event Log Security 4724
search: |-
    `wineventlog_security`
    (
        EventCode=4723
        OR
        EventCode=4724
    )
    | eval log_time = strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%6NZ")
    | eval log_time = coalesce(log_time, _time)
    | eval time_bucket = floor(log_time / 2) * 2
    | eval SubjectRID = tonumber(replace(SubjectUserSid, ".*-(\d+)$", "\1"))
    | where SubjectRID >= 1000
    | stats count AS EventsForAccount
            min(log_time) AS firstTime
            max(log_time) AS lastTime
      by Computer TargetUserName SubjectUserName time_bucket

    | where EventsForAccount >= 4
    | eval DurationSecs = round(lastTime - firstTime, 3), DurationSecs = if(DurationSecs = 0, 0.001, DurationSecs), ChangeRatePerSec = round(EventsForAccount / DurationSecs, 2)
    | rename Computer as dest

    | stats dc(TargetUserName) AS AffectedAccounts
            values(TargetUserName) AS Accounts
            values(SubjectUserName) AS InitiatingAccounts
            sum(EventsForAccount) AS TotalEvents
            max(ChangeRatePerSec) AS PeakChangeRatePerSec
            min(DurationSecs) AS FastestBurstSecs
            min(firstTime) AS firstTime
            max(lastTime) AS lastTime
      by dest time_bucket

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_suspicious_burst_of_password_changes_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting EventID 4723 and EventID 4724 events with the Windows TA.
known_false_positives: |-
    Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
references:
    - https://github.com/Nightmare-Eclipse/BlueHammer
finding:
    title: Rapid burst of password changes of local accounts by $InitiatingAccounts$ on $dest$
    entity:
        field: dest
        type: system
        score: 20
analytic_story:
    - Windows Privilege Escalation
    - BlueHammer
asset_type: Endpoint
cve:
    - CVE-2026-33825
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint