Splunk rules: 0d

id: '30702.54835'
title: ADExplorer Snapshot Creation
description: Active Directory Explorer (AD Explorer) is a tool from the Sysinternals
  suite that allows users to view, search, and analyze objects within Active Directory,
  and it includes the capability to take snapshots of the AD database for offline
  analysis. A threat actor might leverage AD Explorer to gain detailed insights into
  the AD environment and use its snapshot capability to discreetly export and study
  the structure, user accounts, and security settings, potentially identifying vectors
  for privilege escalation or lateral movement within a network. This use case detects
  executions of ADExplorer with the snapshot command.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("ADExplorer64" OR "ADExplorer" OR "AdExp") "snapshot"
  | regex process_name="(?i)ADExplorer(64)?|AdExp"| regex process="(?i)snapshot\s"
  | table _time, host, user, parent_process_name, process, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
- T1003.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
- https://trustedsec.com/blog/adexplorer-on-engagements
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml
- https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html

name: ASL AWS Defense Evasion Stop Logging Cloudtrail
id: 0b78a8f9-1d31-4d23-85c8-56ad13d5b4c1
version: 12
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects `StopLogging` events within AWS CloudTrail logs, a critical action that adversaries may use to evade detection. By halting the logging of their malicious activities, attackers aim to operate undetected within a compromised AWS environment. This detection is achieved by monitoring for specific CloudTrail log entries that indicate the cessation of logging activities. Identifying such behavior is crucial for a Security Operations Center (SOC), as it signals an attempt to undermine the integrity of logging mechanisms, potentially allowing malicious activities to proceed without observation. The impact of this evasion tactic is significant, as it can severely hamper incident response and forensic investigations by obscuring the attacker's actions.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=StopLogging
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudtrail logging. Please investigate this activity.
references:
    - https://attack.mitre.org/techniques/T1562/008/
finding:
    title: User $user$ has stopped Cloudtrail logging for account id $vendor_account$ from IP $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Defense Evasion
asset_type: AWS Account
mitre_attack_id:
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '6076.6521'
title: ATBroker.exe Execution
description: Helper binary for Assistive Technology (AT), Executes code defined in
  registry for a new AT. Modifications must be made to the system registry to either
  register or modify an existing Assistive Technology (AT) service entry. Living Off
  the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "<EventID>4688<")
  "ATBroker.exe" TERM(/start) | table _time, host, user, signature_id, process, process_*,
  parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- Windows event logs
- Process command-line parameters
references:
- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
- https://oddvar.moe/2018/07/23/another-way-to-get-to-a-system-shell/

id: '5976.6321'
title: Attrib.exe Metasploit File Dropper
description: 'Using attrib.exe, an adversary may display or change file attributes
  in order to bypass UAC restrictions. Metasploits file_dropper.rb, which is include
  in some payloads uses this to assist in removing artifacts. -- Software Association:
  TargetCompany'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "<EventID>4688<")
  TERM(attrib) AND TERM(dll) | regex process="attrib.+?\.dll" | table _time, host,
  user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:hide artifacts
technique_id: 
- T1564
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/file_dropper.rb

name: AWS EC2 Snapshot Shared Externally
id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
version: 12
creation_date: '2021-07-20'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects when an EC2 snapshot is shared with an external AWS account by analyzing AWS CloudTrail events. This detection method leverages CloudTrail logs to identify modifications in snapshot permissions, specifically when the snapshot is shared outside the originating AWS account. This activity is significant as it may indicate an attempt to exfiltrate sensitive data stored in the snapshot. If confirmed malicious, an attacker could gain unauthorized access to the snapshot's data, potentially leading to data breaches or further exploitation of the compromised information.
data_source:
    - AWS CloudTrail ModifySnapshotAttribute
search: |-
    `cloudtrail` eventName=ModifySnapshotAttribute
      | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id
      | search requested_account_id != NULL
      | eval match=if(requested_account_id==aws_account_id,"Match","No Match")
      | where match = "No Match"
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product requested_account_id
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_ec2_snapshot_shared_externally_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
references:
    - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
    - https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
finding:
    title: AWS EC2 snapshot from account $vendor_account$ is shared with $requested_account_id$ by user $user$ from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious Cloud Instance Activities
    - Data Exfiltration
asset_type: EC2 Snapshot
mitre_attack_id:
    - T1537
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco NVM - Rclone Execution With Network Activity
id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a
version: 7
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This detection identifies execution of the file synchronization utility "rclone".
    It leverages Cisco Network Visibility Module logs, specifically flow data in order to capture process executions
    initiating network connections.
    While rclone is a legitimate command-line tool for syncing data to cloud storage providers, it has been widely abused by threat actors for data exfiltration.
    This analytic inspects process name and arguments for rclone and flags usage of suspicious flags.
    If matched, this could indicate malicious usage for stealthy data exfiltration or cloud abuse.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    (
      process_name = "rclone.exe"
      OR
      (
        process_arguments = "* copy *"
        process_arguments = "*\\\\*"
        process_arguments IN ("*remote:*", "*mega:*", "*ftp:*", "*ftp1:*")
      )
      OR
      (
        process_arguments IN ("*remote:*", "*mega:*", "*ftp:*", "*ftp1:*")
        process_arguments = "*--transfers"
        process_arguments = "*--ignore-existing*"
        process_arguments = "*--auto-confirm*"
      )
    )
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___rclone_execution_with_network_activity_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Rclone is used legitimately in some backup or other workflows. Tune this rule based on known-good operational usage or restrict by known user/service accounts an specific folders or remote names.
references:
    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
    - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
    - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
    - https://redcanary.com/blog/threat-detection/rclone-mega-extortion/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Rclone was executed on $src$ using flags $process_arguments$ and connected to $dest_hostname$ over $dest_port$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Scattered Lapsus$ Hunters
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1567.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Common Ransomware Extensions
id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
version: 22
creation_date: '2019-10-16'
modification_date: '2026-07-02'
author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick
status: production
type: TTP
description: |-
    The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns.
    This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption.
    If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            latest(Filesystem.user) as user
            values(Filesystem.file_path) as file_path
    FROM datamodel=Endpoint.Filesystem WHERE

    Filesystem.action IN (
        "created",
        "modified"
    )
    NOT Filesystem.file_name IN (
        "*.7z", "*.aac", "*.appx", "*.appxbundle", "*.asc", "*.asm", "*.avi",
        "*.bak", "*.bat", "*.bin", "*.bmp", "*.bz2", "*.cab", "*.cer",
        "*.cfg", "*.cmd", "*.com", "*.conf", "*.cpp", "*.crt", "*.cs",
        "*.csh", "*.css", "*.csv", "*.cxx", "*.dat", "*.deb", "*.der",
        "*.diff", "*.dll", "*.doc", "*.docm", "*.docx", "*.dot", "*.dotm",
        "*.dotx", "*.drv", "*.eml", "*.eps", "*.exe", "*.flac", "*.gif",
        "*.go", "*.gz", "*.h", "*.hpp", "*.htm", "*.html", "*.ico", "*.ics",
        "*.ini", "*.iso", "*.jar", "*.java", "*.jpeg", "*.jpg", "*.js", "*.json",
        "*.key", "*.ksh", "*.ldf", "*.lib", "*.log", "*.lnk", "*.m4a", "*.m4v",
        "*.md", "*.mdb", "*.mdf", "*.mht", "*.mhtml", "*.mkv", "*.mov", "*.mp3",
        "*.mp4", "*.mpeg", "*.mpg", "*.msi", "*.msix", "*.msixbundle", "*.msg",
        "*.odp", "*.ods", "*.odt", "*.one", "*.ost", "*.otf", "*.pdf", "*.pem",
        "*.pfx", "*.php", "*.pif", "*.pl", "*.png", "*.pot", "*.potm", "*.potx",
        "*.ppam", "*.pps", "*.ppsm", "*.ppsx", "*.ppt", "*.pptm", "*.pptx", "*.ps1",
        "*.ps1xml", "*.psd1", "*.psm1", "*.pst", "*.pub", "*.py", "*.pyc", "*.rar",
        "*.reg", "*.rpm", "*.rss", "*.rtf", "*.scr", "*.sh", "*.sql", "*.svg",
        "*.swift", "*.sys", "*.tar", "*.tgz", "*.tif", "*.tiff", "*.toml", "*.ttf",
        "*.txt", "*.url", "*.vb", "*.vbe", "*.vbs", "*.vcxproj", "*.vhd", "*.vhdx",
        "*.wav", "*.webm", "*.webp", "*.wim", "*.wsf", "*.xlam", "*.xls", "*.xlsb",
        "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xltx", "*.xml", "*.xps",
        "*.yaml", "*.yml"
    )
    BY Filesystem.action Filesystem.dest
        Filesystem.file_access_time Filesystem.file_create_time
        Filesystem.file_hash Filesystem.file_modify_time
        Filesystem.file_name Filesystem.file_path
        Filesystem.file_acl Filesystem.file_size
        Filesystem.process_guid Filesystem.process_id
        Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | rex field=file_name "(?<file_extension>(\.[^\.]+){1,2})$"
    | lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name
    | search Name !=False
    | stats min(firstTime) as firstTime
            max(lastTime) as lastTime
            dc(file_path) as path_count
            dc(file_name) as file_count
            values(action) as action
            values(file_access_time) as file_access_time
            values(file_create_time) as file_create_time
            values(file_hash) as file_hash
            values(file_modify_time) as file_modify_time
            values(file_acl) as file_acl
            values(file_size) as file_size
            values(file_path) as file_path
            values(process_guid) as process_guid
            values(process_id) as process_id
            values(user) as user
            values(vendor_product) as vendor_product
            values(file_name) as file_name
            values(file_extension) as file_extension
            values(Name) as Name
      by dest
    | where path_count > 1 OR file_count > 20
    | `common_ransomware_extensions_filter`
how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data model node. To see the additional metadata, add the following fields, if not already present, please review the detailed documentation on how to create a new field within Mission Control Queue
known_false_positives: It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions.
references:
    - https://github.com/splunk/security_content/issues/2448
finding:
    title: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack.
analytic_story:
    - Rhysida Ransomware
    - Prestige Ransomware
    - Ransomware
    - LockBit Ransomware
    - Medusa Ransomware
    - SamSam Ransomware
    - Clop Ransomware
    - Ryuk Ransomware
    - Black Basta Ransomware
    - Termite Ransomware
    - Interlock Ransomware
    - NailaoLocker Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '33080.59641'
title: Common Recon Commands in Short Burst
description: Most initial access broker malware run several discovery commands in
  a short time span to gather information after gaining access to a system. While
  these commands are used routinely in legitimate activity, several executions in
  rapid succession may indicate automated reconnaissance activities from malicious
  actors. This use case detects several common reconnaissance/discovery commands executed
  in a short time period (default 2 minutes).
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("whoami" OR ("net" ("group" OR "use")) OR "/Domain" OR "systeminfo" OR "nltest"
  OR "/dclist" OR "/domain_trusts" OR "ipconfig" OR "arp" OR "tasklist" OR "ping"
  OR "quser" OR "tasklist" OR "netstat" OR "netsh" OR "driverquery" OR "cmdkey" OR
  "tracert") | where (!match(process, "(?i)\x5cSplunkUniversalForwarder\x5c(etc|bin)\x5c")
  and !match(parent_process, "(?i)\x5cSplunkUniversalForwarder\x5c(etc|bin)\x5c"))
  and (match(process, "(?i)whoami|systeminfo|ipconfig|arp|nltest|dclist|domain_trusts|tasklist|quser|tasklist|netstat|netsh|driverquery|cmdkey|tracert|net1?(\.exe)?\s+(group|use)($|\s|\.exe)")
  OR match(process_name, "(?i)(whoami|systeminfo|ipconfig|arp|nltest|tasklist|net1?|quser|tasklist|netstat|netsh|driverquery|cmdkey|tracert)\.exe"))
  and !match(user, "\$$") | table _time, host, user process, process_*, parent_process,
  parent_process_* | bin span=120s | stats values(*) as * by _time, host | streamstats
  dc(process) as dc_process, dc(process_name) as dc_process_name by _time, host| where
  dc_process > 3 and dc_process_name > 1 '
techniques:
- discovery:system owner/user discovery
- discovery:account discovery
- discovery:process discovery
- discovery:system information discovery
- discovery:system service discovery
- defense-evasion:virtualization/sandbox evasion:system checks
- discovery:system network connections discovery
technique_id:
- T1033
- T1087
- T1057
- T1082
- T1007
- T1497.001
- T1049
data_category:
- Windows Sysmon
references:
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072

name: Creation of Shadow Copy with wmic and powershell
id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
version: 15
creation_date: '2019-12-11'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the creation of shadow copies using "wmic" or "Powershell" commands. It leverages the Endpoint.Processes data model in Splunk to identify processes where the command includes "shadowcopy" and "create". This activity is significant because it may indicate an attacker attempting to manipulate or access data in an unauthorized manner, potentially leading to data theft or manipulation. If confirmed malicious, this behavior could allow attackers to backup and exfiltrate sensitive data or hide their tracks by restoring files to a previous state after an attack.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_wmic`
        OR
        `process_powershell` Processes.process=*shadowcopy* Processes.process=*create*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `creation_of_shadow_copy_with_wmic_and_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate administrator usage of wmic to create a shadow copy.
references:
    - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
    - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
analytic_story:
    - Volt Typhoon
    - Living Off The Land
    - Compromised Windows Host
    - Credential Dumping
asset_type: Endpoint
mitre_attack_id:
    - T1003.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Excessive distinct processes from Windows Temp
id: 23587b6a-c479-11eb-b671-acde48001122
version: 11
creation_date: '2021-06-15'
modification_date: '2026-05-13'
author: Michael Hart, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies an excessive number of distinct processes executing from the Windows\Temp directory. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process paths and counts within a 20-minute window. This behavior is significant as it often indicates the presence of post-exploit frameworks like Koadic and Meterpreter, which use this technique to execute malicious actions. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and maintain persistence within the environment, posing a severe threat to system integrity and security.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m |  where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_distinct_processes_from_windows_temp_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
references:
    - https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Multiple processes were executed out of windows\temp within a short amount of time on $dest$.
analytic_story:
    - Meterpreter
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kubernetes Process Running From New Path
id: 454076fb-0e9e-4adf-b93a-da132621c5e6
version: 10
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies processes running from newly seen paths within a Kubernetes environment. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, and data is pulled from Splunk Observability Cloud using the Splunk Infrastructure Monitoring Add-on. This detection compares processes observed in the last hour with those seen over the previous 30 days. This activity is significant as it may indicate unauthorized changes, compromised nodes, or the introduction of malicious software. If confirmed malicious, it could lead to unauthorized process execution, control over critical resources, data exfiltration, privilege escalation, or malware introduction within the Kubernetes cluster.
data_source: []
search: |-
    | mstats count(process.memory.utilization) as process.memory.utilization_count where `kubernetes_metrics` AND earliest=-1h by host.name k8s.cluster.name k8s.node.name process.pid process.executable.path process.executable.name
    | eval current="True"
    | append [ mstats count(process.memory.utilization) as process.memory.utilization_count where `kubernetes_metrics` AND earliest=-30d latest=-1h by host.name k8s.cluster.name k8s.node.name process.pid process.executable.path process.executable.name ]
    | stats count values(current) as current
      BY host.name k8s.cluster.name k8s.node.name
         process.pid process.executable.name process.executable.path
    | where count=1 and current="True"
    | rename host.name as host
    | `kubernetes_process_running_from_new_path_filter`
how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes Process Running From New Path on host $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: O365 Email Access By Security Administrator
id: c6998a30-fef4-4e89-97ac-3bb0123719b4
version: 11
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when a user with sufficient access to O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess
      | rename InternetMessageId as signature_id, UserId as src_user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
           src_user signature_id
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_email_access_by_security_administrator_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Threat Explorer is a premium feature with o365, logging may not be available with proper license.
known_false_positives: Legitamate access by security administators for incident response measures.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-investigate-delivered-malicious-email?view=o365-worldwide
finding:
    title: A security administrator $src_user$ accessed email messages for $user$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: A security administrator $src_user$ accessed email messages for $user$
analytic_story:
    - Data Exfiltration
    - Azure Active Directory Account Takeover
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.002
    - T1567
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 Email Password and Payroll Compromise Behavior
id: e36de71a-6bdc-4002-98ff-e3e51b0d8f96
version: 7
creation_date: '2025-01-23'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
data_source:
    - Office 365 Universal Audit Log
    - Office 365 Reporting Message Trace
search: |-
    `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
    | eval mailtime = _time
    | bin _time span=4hr
    | eval user = lower(RecipientAddress)
    | eval InternetMessageId = lower(MessageId)
    | join InternetMessageId, user max=0
      [
      | search `o365_management_activity` Workload=Exchange Operation IN ("SoftDelete","HardDelete")
      | spath path=AffectedItems{}  output=AffectedItemSplit
      | fields _time,ClientIP,ClientInfoString,UserId,Operation,ResultStatus,MailboxOwnerUPN,AffectedItemSplit
      | mvexpand AffectedItemSplit | spath input=AffectedItemSplit
      | search Subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
      | eval deltime = _time
      | bin _time span=4hr
      | eval InternetMessageId = lower(InternetMessageId), user = lower(UserId)
      ]
    | stats values(ClientInfoString) as http_user_agent, values(ClientIP) as src, values(Subject) as subject, dc(Subject) as subject_count, values(Operation) as action, values(ResultStatus) as result, count, min(mailtime) as firstTime, max(deltime) as lastTime by user,_time
    | search subject IN ("*banking*","*direct deposit*","*pay-to*") AND subject IN ("*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_email_password_and_payroll_compromise_behavior_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
known_false_positives: No false positives have been identified at this time.
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
    - https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
finding:
    title: The user $user$ received and deleted password and payroll change emails within a short timeframe
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
    - Office 365 Collection Techniques
    - Suspicious Emails
    - Data Destruction
asset_type: O365 Tenant
mitre_attack_id:
    - T1070.008
    - T1485
    - T1114.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Possible Browser Pass View Parameter
id: 8ba484e8-4b97-11ec-b19a-acde48001122
version: 8
creation_date: '2021-11-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process  IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*" , "*/UseOperaPasswordFile*", "*/OperaPasswordFile*","*/stab*", "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*" ) AND Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positive is quite limited. Filter is needed
references:
    - https://www.nirsoft.net/utils/web_browser_password.html
    - https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/
analytic_story:
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1555.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: PowerShell Script Block With URL Chain
id: 4a3f2a7d-6402-4e64-a76a-869588ec3b57
version: 12
creation_date: '2023-07-11'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that contains multiple URLs within a function or array. It leverages PowerShell operational logs to detect script blocks with embedded URLs, often indicative of obfuscated scripts or those attempting to download secondary payloads. This activity is significant as it may signal an attempt to execute malicious code or download additional malware. If confirmed malicious, this could lead to code execution, further system compromise, or data exfiltration. Review parallel processes and the full script block for additional context and related artifacts.
data_source:
    - Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*http:*","*https:*") | regex ScriptBlockText="(\"?(https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))\"?(?:,|\))?){2,}" | rex max_match=20 field=ScriptBlockText "(?<url>https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_script_block_with_url_chain_filter`'
how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
    - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
    - https://attack.mitre.org/techniques/T1059/001/
finding:
    title: A suspicious powershell script used by $user_id$ on host $dest$ contains URLs in an array, this is commonly used for malware.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious powershell script used by $user_id$ on host $dest$ contains URLs in an array, this is commonly used for malware.
analytic_story:
    - Malicious PowerShell
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20368.36103'
title: Remote WMIC Query
description: 'An adversary can use WMI to interact with local and remote systems and
  use it as a means to execute various behaviors, such as gathering information for
  Discovery as well as remote Execution of files as part of Lateral Movement. This
  use case detects execution of WMIC commands with the ''/node'' switch, indicating
  potential remote operations or information gathering attempts on network endpoints.
  -- Threat Actor Association: Earth Estries, Flax Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(wmic) OR "wmic.exe")
  OR "/node:" | regex process="(?i)/node:" | table _time, host, user process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:windows management instrumentation
technique_id: 
- T1047
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/