Splunk rules: 0c

name: Cisco ASA - Logging Message Suppression
id: 4e6c9d2a-8f3b-4c7e-9a5f-2d8b6e1c4a9f
version: 6
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects suppression of specific logging messages on Cisco ASA devices using the "no logging message" command.
    Adversaries may suppress specific log message IDs to selectively disable logging of security-critical events such as authentication failures, configuration changes, or suspicious network activity. This targeted approach allows attackers to evade detection while maintaining normal logging operations that might otherwise alert administrators to complete logging disablement.
    The detection monitors for command execution events (message ID 111008 or 111010) containing the "no logging message" command, which is used to suppress specific message IDs from being logged regardless of the configured severity level.
    Investigate unauthorized message suppression, especially suppression of security-critical message IDs (authentication, authorization, configuration changes), suppression performed by non-administrative accounts, during unusual hours, or without documented justification.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111008, 111010)
    command = "no logging message *"
    | fillnull
    | stats count
            earliest(_time) as firstTime
            latest(_time) as lastTime
            values(user) as user
            values(action) as action
            values(message_id) as message_id
            values(command) as command
            values(src_ip) as src_ip
            values(process_name) as process_name
      by host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___logging_message_suppression_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
    If your logging level is set to 'notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Admins may suppress verbose messages to reduce log volume or manage storage.
    Verify against change management and logging policies. Establish baseline of
    approved suppressed message IDs.
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: User $user$ executed command $command$ to suppress specific logging message ID on Cisco ASA host $host$.
        - field: user
          type: user
          score: 20
          message: User $user$ executed command $command$ to suppress specific logging message ID on Cisco ASA host $host$.
threat_objects:
    - field: command
      type: process
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
    - ArcaneDoor
asset_type: Network
mitre_attack_id:
    - T1685.001
    - T1070
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Excessive Usage Of Taskkill
id: fe5bca48-accb-11eb-a67c-acde48001122
version: 14
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies excessive usage of `taskkill.exe`, a command-line utility used to terminate processes. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on instances where `taskkill.exe` is executed ten or more times within a one-minute span. This behavior is significant as adversaries often use `taskkill.exe` to disable security tools or other critical processes to evade detection. If confirmed malicious, this activity could allow attackers to bypass security defenses, maintain persistence, and further compromise the system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.dest) as dest values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user) as user  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "taskkill.exe"
      BY Processes.parent_process_name Processes.process_name Processes.dest
         Processes.user _time span=1m
    | where count >=10
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `excessive_usage_of_taskkill_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
    - https://www.joesandbox.com/analysis/702680/0/html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Excessive usage  of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Azorult
    - AgentTesla
    - CISA AA22-277A
    - NjRAT
    - CISA AA22-264A
    - XMRig
    - Crypto Stealer
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '17787.30037'
title: hh.exe Remote File Execution
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. This use case detects hh.exe executions accessing a
  remote compiled HTML file. LOLBAS Atomics T1218.001 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(hh) OR TERM(hh.exe))
  | where match(process_name, "(?i)hh\.exe") AND match(process, "(?i)\w+tps?://")
  | table _time, host, user process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-2---compiled-html-help-remote-payload
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/

id: '5443.5591'
title: Invoke-WebRequest Command
description: 'Detects when typical download commands are executed -- Threat Actor
  Association: APT28/Fancy Bear, FIN13, Flax Typhoon, Kimsuky, Memento Team, NewsPenguin,
  Prophet Spider, TA2541, TA505, WinterVivern/UAC-0114, Wizard Spider -- Software
  Association: ALPHV/BlackCat, Alchimist, Bazar, Babuk, Clop, Cuba, DarkGate, LV,
  Qakbot/Qbot, TargetCompany, Trickbot, Remcos RAT, XingLocker, Yanluowang, Zloader
  -- Atomics T1041 Test#1 Atomics T1074.001 Test#1 Atomics T1572 Test#1 Atomics T1566.001
  #Test1 Atomics T1087.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM(IWR) OR TERM(Invoke-WebRequest) OR TERM("Invoke-RestMethod")
  OR TERM(curl) OR TERM(wget)) | rex field=process (?<uri>"(?i)(https?\:|ftp(\:|\.)|(\d{1,3}\.){3}\d{1,3})[A-Za-z0-9\x5c\/\_\+\-\%\.\:]+")|
  rex field=process "(?i)(?<cmd>invoke-webrequest|invoke-restmethod|wget|iwr|curl)"
  | where isnotnull(cmd) | table _time, host, user cmd, signature_id, process, process_*,
  parent_process_*, uri | bin span=1s | stats values(*) as * by _time, host, process '
techniques:
- execution:command and scripting interpreter:powershell
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1105
data_category:
- Windows event logs
references: null

name: Kubernetes Anomalous Traffic on Network Edge
id: 886c7e51-2ea1-425d-8705-faaca5a64cc6
version: 9
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies anomalous network traffic volumes between Kubernetes workloads or between a workload and external sources. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent network metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days to identify significant deviations. This activity is significant as unexpected spikes may indicate unauthorized data transfers or lateral movement. If confirmed malicious, it could lead to data exfiltration or compromise of additional services, potentially resulting in data breaches.
data_source: []
search: "| mstats avg(tcp.*) as tcp.* avg(udp.*) as udp.* where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name source.workload.name dest.workload.name span=10s | eval key='source.workload.name' + \":\" + 'dest.workload.name' | join type=left key [ mstats avg(tcp.*) as avg_tcp.* avg(udp.*) as avg_udp.* stdev(tcp.*) as stdev_tcp.* avg(udp.*) as stdev_udp.* where `kubernetes_metrics` AND earliest=-30d latest=-1h by source.workload.name dest.workload.name | eval key='source.workload.name' + \":\" + 'dest.workload.name' ] | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 3 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | fillnull | eval anomalies = split(replace(anomalies, \",\\s$$$$\", \"\") ,\", \") | where anomalies!=\"\" | stats count(anomalies) as count values(anomalies) as anomalies by k8s.cluster.name source.workload.name dest.workload.name | rename service as k8s.service | where count > 5 | rename k8s.cluster.name as host | `kubernetes_anomalous_traffic_on_network_edge_filter`"
how_to_implement: "To gather NPM metrics the Open Telemetry to the Kubernetes Cluster and enable Network Performance Monitoring according to instructions found in Splunk Docs https://help.splunk.com/en/splunk-observability-cloud/monitor-infrastructure/network-explorer/set-up-network-explorer-in-kubernetes#network-explorer-setup In order to access those metrics from within Splunk Enterprise and ES, the Splunk Infrastructure Monitoring add-on must be installed and configured on a Splunk Search Head.  Once installed, first configure the add-on with your O11y Cloud Org ID and Access Token. Lastly set up the add-on to ingest metrics from O11y cloud using the following settings, and any other settings left at default:\n* Name sim_npm_metrics_to_metrics_index\n * Metric Resolution 10000"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes Anomalous Traffic on Network Edge in kubernetes cluster $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Possible Access To Credential Files
id: 16107e0e-71fc-11ec-b862-acde48001122
version: 14
creation_date: '2022-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects attempts to access or dump the contents of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these files. This activity is significant as it may indicate credential dumping, a technique used by adversaries to gain persistence or escalate privileges. If confirmed malicious, attackers could obtain hashed passwords for offline cracking, leading to unauthorized access and potential system compromise.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN("cat", "nano*","vim*", "vi*")
        AND
        Processes.process IN("*/etc/shadow*", "*/etc/passwd*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_access_to_credential_files_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd
    - https://attack.mitre.org/techniques/T1003/008/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A commandline $process$ executed on $dest$
analytic_story:
    - Linux Persistence Techniques
    - China-Nexus Threat Activity
    - XorDDos
    - Salt Typhoon
    - Linux Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1003.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 PST export alert
id: 5f694cc4-a678-4a60-9410-bffca1b647dc
version: 11
creation_date: '2020-12-16'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: TTP
description: The following analytic detects instances where a user has initiated an eDiscovery search or exported a PST file in an Office 365 environment. It leverages Office 365 management activity logs, specifically filtering for events under ThreatManagement with the name "eDiscovery search started or exported." This activity is significant as it may indicate data exfiltration attempts or unauthorized access to sensitive information. If confirmed malicious, it suggests an attacker or insider threat is attempting to gather or exfiltrate data, potentially leading to data breaches, loss of intellectual property, or unauthorized access to confidential communications. Immediate investigation is required.
data_source:
    - O365
search: |-
    `o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported"
      | fillnull
      | stats count earliest(_time) as firstTime latest(_time) as lastTime
        BY Source Severity AlertEntityId
           Name user src
           vendor_account vendor_product dest
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_pst_export_alert_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
references:
    - https://attack.mitre.org/techniques/T1114/
finding:
    title: User $user$ has exported a PST file from the search using this operation- $signature$ with a severity of $Severity$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
    - Data Exfiltration
asset_type: O365 Tenant
mitre_attack_id:
    - T1114
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '6935.8203'
title: Reg.exe Process Execution
description: 'Reg is a Windows utility used to interact with the Windows Registry.
  It can be used at the command-line interface to query, add, modify, and remove information.
  -- Threat Actor Association: Kimsuky -- Software Association: BlackByte, Clop, Snatch,
  Trickbot -- Atomics T1037.001 Test#1 Atomics T1137.004 Test#1 Atomics T1137.002
  Test#1 Atomics T1137 Test#1 Atomics T1547.001 Test#1 Atomics T1547.001 Test#2 Atomics
  T1546.002 Test#1 Atomics T1547.010 Test#1 Atomics T1546.010 Test#1 Atomics T1548.002
  Test#1 Atomics T1548.002 Test#8 Atomics T1574.011 Test#2 Atomics T1562.004 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "reg.exe" | table _time, host, user user, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- discovery:query registry
technique_id: 
- T1112
- T1012
data_category:
- Windows Sysmon
references:
- https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/

name: Short Lived Scheduled Task
id: 6fa31414-546e-11ec-adfa-acde48001122
version: 12
creation_date: '2021-12-03'
modification_date: '2026-07-07'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699.
    This behavior is identified by analyzing Windows Security Event Logs and leveraging the Windows TA for parsing.
    Such activity may indicate lateral movement or remote code execution attempts by adversaries.
    If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts.
data_source:
    - Windows Event Log Security 4698
    - Windows Event Log Security 4699
search: |-
    `wineventlog_security`
    EventCode IN (4698, 4699)
    | xmlkv object_attrs
    | transaction TaskName dest startswith=(EventCode=4698) endswith=(EventCode=4699) maxspan=30s
    | stats count min(_time) AS firstTime
                  max(_time) AS lastTime
        by Command TaskName user dest RunLevel
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `short_lived_scheduled_task_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
known_false_positives: |-
    Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1053/005/
    - https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A windows scheduled task [$TaskName$] with the command [$Command$] was created by [$user$] and deleted in less than 30 seconds on [$dest$]
analytic_story:
    - Active Directory Lateral Movement
    - CISA AA22-257A
    - CISA AA23-347A
    - Compromised Windows Host
    - Scheduled Tasks
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: SQL Injection with Long URLs
id: e0aad4cf-0790-423b-8328-7564d0d938f9
version: 11
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: The following analytic detects long URLs containing multiple SQL commands, indicating a potential SQL injection attack. This detection leverages web traffic data, specifically targeting web server destinations with URLs longer than 1024 characters or HTTP user agents longer than 200 characters. SQL injection is significant as it allows attackers to manipulate a web application's database, potentially leading to unauthorized data access or modification. If confirmed malicious, this activity could result in data breaches, unauthorized access, and complete system compromise. Immediate investigation and validation of alerts are crucial to mitigate these risks.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Web
      WHERE Web.dest_category=web_server
        AND
        (Web.url_length > 1024
        OR
        Web.http_user_agent_length > 200)
      BY Web.src Web.dest Web.url
         Web.url_length Web.http_user_agent
    | `drop_dm_object_name("Web")`
    | eval url=lower(url)
    | eval num_sql_cmds=mvcount(split(url, "alter%20table")) + mvcount(split(url, "between")) + mvcount(split(url, "create%20table")) + mvcount(split(url, "create%20database")) + mvcount(split(url, "create%20index")) + mvcount(split(url, "create%20view")) + mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database")) + mvcount(split(url, "drop%20index")) + mvcount(split(url, "drop%20table")) + mvcount(split(url, "exists")) + mvcount(split(url, "exec")) + mvcount(split(url, "group%20by")) + mvcount(split(url, "having")) + mvcount(split(url, "insert%20into")) + mvcount(split(url, "inner%20join")) + mvcount(split(url, "left%20join")) + mvcount(split(url, "right%20join")) + mvcount(split(url, "full%20join")) + mvcount(split(url, "select")) + mvcount(split(url, "distinct")) + mvcount(split(url, "select%20top")) + mvcount(split(url, "union")) + mvcount(split(url, "xp_cmdshell")) - 24
    | where num_sql_cmds > 3
    | `sql_injection_with_long_urls_filter`
how_to_implement: To successfully implement this search, you need to be monitoring network communications to your web servers or ingesting your HTTP logs and populating the Web data model. You must also identify your web servers in the Enterprise Security assets table.
known_false_positives: It's possible that legitimate traffic will have long URLs or long user agent strings and that common SQL commands may be found within the URL. Please investigate as appropriate.
references: []
finding:
    title: SQL injection attempt with url $url$ detected on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - SQL Injection
    - GhostRedirector IIS Module and Rungan Backdoor
asset_type: Database Server
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '32674.58081'
title: Suspicious csc.exe Source File Folder
description: 'Adversaries may attempt to make payloads difficult to discover and analyze
  by delivering files to victims as uncompiled code. Text-based source code files
  may subvert analysis and scrutiny from protections targeting executables/binaries.
  These payloads will need to be compiled before execution; typically via native utilities
  such as csc.exe or GCC/MinGW. This use case detects csc.exe executions compiling
  a .cs file from a suspicious folder. Note: Due to its extended logging capabilities
  on parent process information, Sysmon is recommended for best fidelity. -- Threat
  Actor Association: Alpha (STAC1248)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(csc) OR "csc.exe") ("\\AppData" OR "\\Windows\\Temp") | regex parent_process_path!="(?i)(^C:\x5cProgram\sFiles)|(sdiagnhost|w3wp|choco)\.exe"|
  regex parent_process!="(?i)\x5cProgramData\x5cMicrosoft\x5cWindows\sDefender\sAdvanced\sThreat\sProtection"|
  regex process="(?i)\x5cAppData\x5c|\x5cWindows\x5cTemp" | table _time, host, user,
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:compile after delivery
technique_id:
- T1027.004
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1027/004/
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072

id: '15884.23727'
title: Suspicious PowerShell Clipboard Activity
description: 'Adversaries can use a variety of commands to obfuscate their activity.
  This use case detects PowerShell commands involving combinations of the SendKeys
  cmdlet, clipboard access, and native text editors. -- Software Association: BbyStealer
  -- Atomics T1059.001 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("[Windows.Forms.Clipboard]" TERM(sendkeys)) (TERM(notepad)
  OR TERM(wordpad)) | table _time, host, user, process, process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- collection:clipboard data
- execution:command and scripting interpreter
technique_id:
- T1059.001
- T1115
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-5---mimikatz---cradlecraft-pssendkeys
- https://cyble.com/blog/bbystealer-malware-resurfaces-sets-sights-on-vpn-users/

id: '16272.24661'
title: System Network Connections Discovery - Windows
description: 'Adversaries may attempt to get a listing of network connections to or
  from the compromised system they are currently accessing or from remote systems
  by querying for information over the network. -- Threat Actor Association: Alloy
  Taurus/Gallium, Volt Typhoon -- Atomics T1049 Test #1 Atomics T1049 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "netstat" OR ("net" ("use" or "sessions")) OR TERM(Get-NetTCPConnection) | regex
  process="(?i)netstat(\.exe)?|net(\.exe)?\s+(use|sessions)|Get-TCPConnection" | table
  _time, host, user process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- discovery:system network connections discovery
technique_id: 
- T1049
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell

name: Windows Audit Policy Disabled via Legacy Auditpol
id: d2cef287-c2b7-4496-a609-7a548c1e27f9
version: 8
creation_date: '2025-02-19'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic identifies the execution of the legacy `auditpol.exe` included with the Windows 2000 Resource Kit Tools, with the "/disable" command-line argument or one of the allowed category flags and the "none" option, in order to disable a specific logging category from the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            `process_auditpol` Processes.process="*/disable"
        )
        OR Processes.process IN ("*/system:none*", "*/logon:none*", "*/object:none*", "*/privilege:none*", "*/process:none*", "*/policy:none*", "*/sam:none*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_audit_policy_disabled_via_legacy_auditpol_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be rare, investigate the activity, and apply additional filters when necessary.
references:
    - https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
    - https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
    - https://attack.mitre.org/techniques/T1562/002/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified attempting to disable and audit policy category/sub-category on $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified attempting to disable and audit policy category/sub-category on $dest$ by user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows Audit Policy Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Data Destruction Recursive Exec Files Deletion
id: 3596a799-6320-4a2f-8772-a9e98ddb2960
version: 13
creation_date: '2023-02-03'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic identifies a suspicious process that is recursively deleting executable files on a compromised host. It leverages Sysmon Event Codes 23 and 26 to detect this activity by monitoring for a high volume of deletions or overwrites of files with extensions like .exe, .sys, and .dll. This behavior is significant as it is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer, which aim to make file recovery impossible. If confirmed malicious, this activity could lead to significant data loss and system instability, severely impacting business operations.
data_source:
    - Sysmon EventID 23
    - Sysmon EventID 26
search: |-
    `sysmon` EventCode IN ("23","26") TargetFilename IN ("*.exe", "*.sys", "*.dll")
      | bin _time span=2m
      | stats count min(_time) as firstTime, max(_time) as lastTime values(file_path) as file_path values(file_hash) as file_hash values(file_name) as file_name values(file_modify_time) as file_modify_time values(process_name) as process_name values(process_path) as process_path values(process_guid) as process_guid values(process_id) as process_id values(process_exec) as process_exec
        BY action dest dvc
           signature signature_id user
           user_id vendor_product
      | where count >=100
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_data_destruction_recursive_exec_files_deletion_filter`
how_to_implement: To successfully implement this search, you need to ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
known_false_positives: The uninstallation of a large software application or the use of cleanmgr.exe may trigger this detection. A filter is necessary to reduce false positives.
references:
    - https://www.welivesecurity.com/2023/01/27/swiftslicer-new-destructive-wiper-malware-ukraine/
finding:
    title: The process $process_name$ has removed a significant quantity of executable files, totaling [$count$], from the destination $dest$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The process $process_name$ has removed a significant quantity of executable files, totaling [$count$], from the destination $dest$.
analytic_story:
    - Swift Slicer
    - Data Destruction
    - Handala Wiper
    - Disk Wiper
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Findstr GPP Discovery
id: 1631ac2d-f2a9-42fa-8a59-d6e210d472f5
version: 12
creation_date: '2023-03-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of the findstr command to search for unsecured credentials in Group Policy Preferences (GPP). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving findstr.exe with references to SYSVOL and cpassword. This activity is significant because it indicates an attempt to locate and potentially decrypt embedded credentials in GPP, which could lead to unauthorized access. If confirmed malicious, this could allow an attacker to escalate privileges or gain access to sensitive systems and data within the domain.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=findstr.exe
            AND
            Processes.process=*sysvol*
            AND
            Processes.process=*cpassword*
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_findstr_gpp_discovery_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1552/006/
    - https://pentestlab.blog/2017/03/20/group-policy-preferences/
    - https://adsecurity.org/?p=2288
    - https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/
    - https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30
finding:
    title: Findstr was executed to discover GPP credentials on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Findstr was executed to discover GPP credentials on $dest$
analytic_story:
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1552.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry MaxConnectionPerServer
id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec
version: 11
creation_date: '2023-07-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies a suspicious modification of the Windows registry setting for max connections per server. It detects changes to specific registry paths using data from the Endpoint.Registry datamodel. This activity is significant because altering this setting can be exploited by attackers to increase the number of concurrent connections to a remote server, potentially facilitating DDoS attacks or enabling more effective lateral movement within a compromised network. If confirmed malicious, this could lead to network disruption or further compromise of additional systems.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server*") Registry.registry_value_data = "0x0000000a" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_maxconnectionperserver_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
references:
    - https://asec.ahnlab.com/en/17692/
    - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A registry modification in max connection per server configuration on $dest$
analytic_story:
    - Warzone RAT
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows PowerShell FakeCAPTCHA Clipboard Execution
id: d81d4d3d-76b5-4f21-ab51-b17d5164c106
version: 9
creation_date: '2025-05-19'
modification_date: '2026-07-14'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_powershell`
        AND
        Processes.process="*-w*h*"
        AND
        ( (Processes.process IN ("*robot*", "*captcha*", "*verify*", "*security check*", "*complete verification*"))
        OR
        ( (Processes.process IN ("*iwr *", "*Invoke-WebRequest*", "*wget *", "*curl *", "*Net.WebClient*", "*DownloadString*", "*[Convert]::FromBase64String*"))
        AND
        (Processes.process IN ("*iex*", "*Invoke-Expression*"))
        AND
        (Processes.process IN ("*click*", "*verify*", "*check*", "*human*", "*bot*", "*token*", "*challenge*")) )
        OR
        ( Processes.process="*clipboard*"
        AND
        Processes.process="*iex*"
        AND
        (Processes.process="*FromBase64String*"
        OR
        Processes.process="*decode*") ) )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_powershell_fakecaptcha_clipboard_execution_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, process path, and command-line executions from your endpoints. If you are using Sysmon, you must have at least Sysmon version 6.0.4 with EventID 1 configured. The full command line arguments are necessary for proper detection.
known_false_positives: Legitimate PowerShell commands that use hidden windows for automation tasks may trigger this detection. The search specifically looks for patterns typical of FakeCAPTCHA campaigns. You may need to add additional exclusions for legitimate administrative activities in your environment by modifying the filter macro.
references:
    - https://urlhaus.abuse.ch/
    - https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape
    - https://reliaquest.com/blog/using-captcha-for-compromise/
    - https://attack.mitre.org/techniques/T1204/001/
    - https://github.com/MHaggis/ClickGrab
finding:
    title: A potential FakeCAPTCHA/ClickFix campaign execution was detected on $dest$ running a PowerShell command with hidden window and suspicious verification strings typical of social engineering attacks.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process
      type: process
analytic_story:
    - Scattered Lapsus$ Hunters
    - Fake CAPTCHA Campaigns
    - Cisco Network Visibility Module Analytics
    - Interlock Ransomware
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1204.001
    - T1059.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows PowerView Constrained Delegation Discovery
id: 86dc8176-6e6c-42d6-9684-5444c6557ab3
version: 11
creation_date: '2022-03-28'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of PowerView commandlets to discover Windows endpoints with Kerberos Constrained Delegation. It leverages PowerShell Script Block Logging (EventCode=4104) to identify specific commandlets like `Get-DomainComputer` or `Get-NetComputer` with the `-TrustedToAuth` parameter. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out privileged delegation settings in Active Directory. If confirmed malicious, this could allow attackers to identify high-value targets for further exploitation, potentially leading to privilege escalation or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*" OR ScriptBlockText = "*Get-NetComputer*") AND (ScriptBlockText = "*-TrustedToAuth*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_powerview_constrained_delegation_discovery_filter`
how_to_implement: The following  analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://adsecurity.org/?p=1667
    - https://docs.microsoft.com/en-us/defender-for-identity/cas-isp-unconstrained-kerberos
    - https://www.guidepointsecurity.com/blog/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/
    - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/constrained-delegation
    - https://www.cyberark.com/resources/threat-research-blog/weakness-within-kerberos-delegation
finding:
    title: Suspicious PowerShell Get-DomainComputer was identified on endpoint $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious PowerShell Get-DomainComputer was identified on endpoint $dest$
analytic_story:
    - CISA AA23-347A
    - Rhysida Ransomware
    - Active Directory Kerberos Attacks
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint