Splunk rules: 0e

name: Azure AD Authentication Failed During MFA Challenge
id: e62c9c2e-bf51-4719-906c-3074618fcc1c
version: 13
creation_date: '2022-07-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk, 0xC0FFEEEE
status: production
type: TTP
description: The following analytic identifies failed authentication attempts against an Azure AD tenant during the Multi-Factor Authentication (MFA) challenge, specifically flagged by error code 500121. It leverages Azure AD SignInLogs to detect these events. This activity is significant as it may indicate an adversary attempting to authenticate using compromised credentials on an account with MFA enabled. If confirmed malicious, this could suggest an ongoing effort to bypass MFA protections, potentially leading to unauthorized access and further compromise of the affected account.
data_source:
    - Azure Active Directory
search: "`azure_monitor_aad` category=SignInLogs properties.status.errorCode=500121 | rename properties.* as *, authenticationDetails{}.* as * | eval time=strptime(authenticationStepDateTime,\"%Y-%m-%dT%H:%M:%S\") | eval auth_detail=mvzip(strftime(time, \"%Y-%m-%dT%H:%M:%S\"),authenticationStepResultDetail,\" - \"), auth_msg=mvappend('status.additionalDetails', authenticationStepResultDetail) | eval auth_method=mvmap(authenticationMethod, if(isnull(mvfind('mfaDetail.authMethod',authenticationMethod)), authenticationMethod, null())) | search NOT auth_msg=\"MFA successfully completed\" | rename userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product auth_method auth_msg user_agent signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_authentication_failed_during_mfa_challenge_filter`"
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: "False positives have been minimized by removing attempts that result in 'MFA successfully completed messages', which were found to be generated when a user opts to use a different MFA method than the default.\nFurther reductions in finding events can be achieved through filtering 'MFA denied; duplicate authentication attempt' messages within the auth_msg field, as they could arguably be considered as false positives."
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://attack.mitre.org/techniques/T1078/004/
    - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-in-log-activity-details
finding:
    title: User $user$ failed to pass MFA challenge
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Active Directory
mitre_attack_id:
    - T1078.004
    - T1586.003
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
id: 1ff7ccc8-065a-11ec-91e4-acde48001122
version: 9
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `Get-ADDefaultDomainPasswordPolicy` PowerShell cmdlet, which is used to retrieve the password policy in a Windows domain. This detection leverages PowerShell Script Block Logging (EventCode=4104) to identify the specific command execution. Monitoring this activity is significant as it can indicate an attempt to gather domain policy information, which is often a precursor to further malicious actions. If confirmed malicious, this activity could allow an attacker to understand password policies, aiding in password attacks or further domain enumeration.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText ="*Get-ADDefaultDomainPasswordPolicy*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
    - https://attack.mitre.org/techniques/T1201/
    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1201
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kubernetes Nginx Ingress RFI
id: fc5531ae-62fd-4de6-9c36-b4afdae8ca95
version: 11
creation_date: '2021-08-23'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects remote file inclusion (RFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs from the Nginx ingress controller, parsing fields such as `remote_addr`, `request`, and `url` to identify suspicious activity. This activity is significant because RFI attacks can allow attackers to execute arbitrary code or access sensitive files on the server. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further compromise of the Kubernetes environment.
data_source: []
search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | eval phase="operate" | eval severity="medium" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`'
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/splunk/splunk-connect-for-kubernetes
    - https://www.invicti.com/blog/web-security/remote-file-inclusion-vulnerability/
finding:
    title: Remote File Inclusion Attack detected on $host$
    entity:
        field: host
        type: system
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Dev Sec Ops
asset_type: Kubernetes
mitre_attack_id:
    - T1212
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Mshta spawning Rundll32 OR Regsvr32 Process
id: 4aa5d062-e893-11eb-9eb2-acde48001122
version: 14
creation_date: '2021-07-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a suspicious mshta.exe process spawning rundll32 or regsvr32 child processes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUID, process name, and parent process fields. This activity is significant as it is a known technique used by malware like Trickbot to load malicious DLLs and execute payloads. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or download additional malware, posing a severe threat to the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name = "mshta.exe"  `process_rundll32`
        OR
        `process_regsvr32`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `mshta_spawning_rundll32_or_regsvr32_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: limitted. this anomaly behavior is not commonly seen in clean host.
references:
    - https://twitter.com/cyb3rops/status/1416050325870587910?s=21
finding:
    title: a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
analytic_story:
    - Trickbot
    - IcedID
    - Living Off The Land
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '22128.39012'
title: mshta.exe File Download
description: 'mshta.exe is a Windows utility used for executing HTML applications
  and can be abused by adversaries to download files. This use case detects executions
  of mshta.exe with URLs in the command line. LOLBINS/LOLBAS -- Threat Actor Association:
  LockBit'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "mshta.exe" | regex process="(?i)(http|ftp)s?:\/\/" | table _time, host, user, signature_id,
  process, process_*, parent_process_path, parent_process_name | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1105
- T1218.005
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://pentera.io/blog/the-lol-isnt-so-funny-when-it-bites-you-in-the-bas/
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- https://www.falconguard.cz/post/top-10-lol-binaries-and-techniques-used-by-cyber-threat-actors

name: O365 Add App Role Assignment Grant User
id: b2c81cc6-6040-11eb-ae93-0242ac130002
version: 12
creation_date: '2021-01-26'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: TTP
description: The following analytic detects the addition of an application role assignment grant to a user in Office 365. It leverages data from the `o365_management_activity` dataset, specifically monitoring the "Add app role assignment grant to user" operation. This activity is significant as it can indicate unauthorized privilege escalation or the assignment of sensitive roles to users. If confirmed malicious, this could allow an attacker to gain elevated permissions, potentially leading to unauthorized access to critical resources and data within the Office 365 environment.
data_source:
    - O365 Add app role assignment grant to user.
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user."
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_add_app_role_assignment_grant_user_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
references:
    - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
finding:
    title: User $user$ added a new app role assignment
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: User $user$ added a new app role assignment
analytic_story:
    - Office 365 Persistence Mechanisms
    - Cloud Federated Credential Abuse
asset_type: O365 Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 Advanced Audit Disabled
id: 49862dd4-9cb2-4c48-a542-8c8a588d9361
version: 11
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects instances where the O365 advanced audit is disabled for a specific user within the Office 365 tenant. It uses O365 audit logs, focusing on events related to audit license changes in AzureActiveDirectory workloads. This activity is significant because the O365 advanced audit provides critical logging and insights into user and administrator activities. Disabling it can blind security teams to potential malicious actions. If confirmed malicious, attackers could operate within the user's mailbox or account with reduced risk of detection, leading to unauthorized data access, data exfiltration, or account compromise.
data_source:
    - O365 Change user license.
search: "`o365_management_activity` Operation=\"Change user license.\" | eval property_name = mvindex ('ExtendedProperties{}.Name', 1) | search property_name = \"extendedAuditEventCategory\" | eval additionalDetails = mvindex('ExtendedProperties{}.Value',0) | eval split_value=split(additionalDetails,\"NewValue\") | eval possible_plan=mvindex(split_value, 1) | rex field=\"possible_plan\" \"DisabledPlans=\\[(?P<DisabledPlans>[^\\]]+)\\]\" | search DisabledPlans IN (\"*M365_ADVANCED_AUDITING*\") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product DisabledPlans object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_advanced_audit_disabled_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Administrators might temporarily disable the advanced audit for troubleshooting, performance reasons, or other administrative tasks. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1562/008/
    - https://www.mandiant.com/sites/default/files/2022-08/remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf
    - https://www.csoonline.com/article/570381/microsoft-365-advanced-audit-what-you-need-to-know.html
finding:
    title: Advanced auditing for user $object$ was disabled by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
asset_type: O365 Tenant
mitre_attack_id:
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '6138.6632'
title: Query Registry
description: 'Adversaries may interact with the Windows Registry to gather information
  about the system, configuration, and installed software. -- Threat Actor Association:
  APT29/Nobelium/Cozy Bear, APT33, APT37, Carbanak, GoldenJackal, Lazarus, SaintBear
  (aka UAC-0056, UNC2589, TA471), TA505, Wizard Spider, WIRTE - - Software Associations:
  Bazar, Conti, Dridex, Emotet, NanoCore, PowerShortShell, Snatch, SquirrelWaffle,
  Ursnif, Zloader -- Atomics T1012 Test#1 Atomics T1218 Test#4 Atomics T1547.005 Test#1
  -- #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(reg) OR "reg.exe") TERM(query) | table _time,
  host, user, signature_id, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- discovery:query registry
technique_id: 
- T1012
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://securelist.com/the-epic-turla-operation/65545/
- https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf

id: '5763.6035'
title: Rare Scheduled Task
description: 'Adversaries may abuse task scheduling functionality to facilitate initial
  or recurring execution of malicious code. Utilities exist within all major operating
  systems to schedule programs or scripts to be executed at a specified date and time.
  -- Threat Actor Association: APT33, APT34/OilRig, FIN7, TA505, TA551, Turla (akaSecret
  Blizzard, KRYPTON, and UAC-0003) -- Software Association: BianLian, Clop, Cring,
  IcedID, NanoCore, Sodinokibi/REvil, Trickbot -- Atomics T1053.005 Test#1 Atomics
  T1053.005 Test#2 Atomics T1053.005 Test#3 Atomics T1053.005 Test#4 Atomics T1053.005
  Test#5 Atomics T1053.005 Test#6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4702) OR
  "<EventID>4702<" OR TERM(EventCode=4700) OR "<EventID>4700<" OR TERM(EventCode=4698)
  OR "<EventID>4698<") | rex field=body "\<Command\>(?<process>.{1,}\Q</Command>\E)"|
  rex field=body "\<Arguments\>(?<process_exec>.{1,}\Q</Arguments>\E)"| rex field=process
  mode=sed "s/\<\/Command\>//g"| rex field=process_exec mode=sed "s/\<\/Arguments\>//g"|
  rename Task_Name as task_name | where isnotnull(process) | table _time, host, user,
  signature_id, task_name, process, process_exec | eventstats count by task_name process
  signature_id| where count=1 '
techniques:
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
- privilege-escalation:scheduled task/job:scheduled task
- exfiltration:scheduled transfer
technique_id:
- T1053.005
- T1029
data_category:
- Windows event logs
references: null

name: Remote Process Instantiation via WMI and PowerShell
id: 112638b4-4634-11ec-b9ab-3e22fbd008af
version: 20
creation_date: '2021-11-15'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `powershell.exe` using the `Invoke-WmiMethod` cmdlet to start a process on a remote endpoint via WMI. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process telemetry. This activity is significant as it indicates potential lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, leading to further compromise and persistence within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_powershell` (Processes.process="*Invoke-WmiMethod*"
        AND
        Processes.process="*-CN*"
        AND
        Processes.process="*-Class Win32_Process*"
        AND
        Processes.process="*-Name create*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_process_instantiation_via_wmi_and_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
references:
    - https://attack.mitre.org/techniques/T1047/
    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
finding:
    title: A process was started on a remote endpoint from $dest$ by abusing WMI using PowerShell.exe
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Services LOLBAS Execution Process Spawn
id: ba9e1954-4c04-11ec-8b74-3e22fbd008af
version: 13
creation_date: '2021-11-23'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies `services.exe` spawning a LOLBAS (Living Off the Land Binaries and Scripts) execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `services.exe` is the parent process. This activity is significant because adversaries often abuse the Service Control Manager to execute malicious code via native Windows binaries, facilitating lateral movement. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.parent_process_name=services.exe
        )
        (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe"))
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `services_lolbas_execution_process_spawn_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1543/003/
    - https://pentestlab.blog/2020/07/21/lateral-movement-services/
    - https://lolbas-project.github.io/
finding:
    title: "Services.exe spawned LOLBAS: $process_name$ located in $process_path$ on $dest$"
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process
      type: process
analytic_story:
    - Active Directory Lateral Movement
    - Living Off The Land
    - Qakbot
    - CISA AA23-347A
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20632.36755'
title: Suspicious ntds.dit Commands
description: 'Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information, as well as obtain other
  information about domain members such as devices, users, and access rights. This
  use case detects patterns of commands associated with ntds.dit dumping and/or exfiltration.
  -- Threat Actor Association: UNC5221, UTA0178 -- Software Association: Akira --
  Atomics T1003.003 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(ntdsutil) OR TERM(ntds) OR "ntds.dit") (((TERM(ac)
  TERM(i)) OR (TERM(activate) TERM(instance)) TERM(create) TERM(full)) OR TERM(copy))
  | regex process="(?i)(ac\s+i\s+ntds.+create\s+full)|(copy\s+.+?ntds\.dit)|(activate\s+instance\s+ntds.*create\s+full)"
  | table _time, host, user, process*, parent_process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
- https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
- https://pentestlab.blog/tag/ntds-dit/
- https://github.com/zcgonvh/NTDSDumpEx
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1

name: Windows Credentials from Password Stores Chrome LocalState Access
id: 3b1d09a8-a26f-473e-a510-6c6613573657
version: 24
creation_date: '2023-05-02'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
    This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome.
    If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk.
    Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
data_source:
    - Windows Event Log Security 4663
search: |
    `wineventlog_security`
    EventCode=4663
    object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State"
    NOT process_path IN (
        "*:\\Windows\\explorer.exe",
        "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe",
        "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe",
        "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe",
        "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe",
        "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
        "*\\platform_experience_helper.exe*",
        "*:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe*"
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime

      by object_file_name object_file_path
         process_name process_path
         process_id EventCode dest

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_credentials_from_password_stores_chrome_localstate_access_filter`
how_to_implement: |-
    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: |-
    The chrome uninstaller will access these set of files and folders. Filter as needed.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A non-chrome process $process_name$ accessing "Chrome\\User Data\\Local State" file on $dest$
analytic_story:
    - StealC Stealer
    - DarkGate Malware
    - Malicious Inno Setup Loader
    - NjRAT
    - Phemedrone Stealer
    - Salt Typhoon
    - Amadey
    - Earth Alux
    - Warzone RAT
    - Quasar RAT
    - PXA Stealer
    - RedLine Stealer
    - SnappyBee
    - Meduza Stealer
    - Braodo Stealer
    - MoonPeak
    - Snake Keylogger
    - China-Nexus Threat Activity
    - 0bj3ctivity Stealer
    - Lokibot
    - Scattered Lapsus$ Hunters
    - BlankGrabber Stealer
    - VIP Keylogger
    - Salat Stealer
    - Phantom Stealer
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows FFmpeg DirectShow Video Capture
id: 636f1a0b-562a-4629-80f6-5ad46d2ebdee
version: 1
creation_date: '2026-05-20'
modification_date: '2026-05-20'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic detects active video capture performed by FFmpeg (ffmpeg.exe) via the Windows DirectShow (dshow) interface, a technique observed in SalatStealer and related UAC-0252 campaigns. After enumerating available devices, threat actors invoke FFmpeg with a specific video capture command that references a named webcam device (video=), requests MJPEG encoding (mjpeg), and uses the dshow input filter — all from a temporary directory to reduce forensic footprint. This sequence moves beyond reconnaissance into active collection, aligning with MITRE ATT&CK T1125 (Video Capture), where adversaries silently record from the victim's webcam to gather intelligence or capture sensitive on-screen activity. The presence of ffmpeg.exe in a temp path combined with these DirectShow video arguments is highly anomalous outside of dedicated multimedia or screen-recording software, making it a strong signal of covert surveillance activity.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
          WHERE (
                  (
                    Processes.process_name = ffmpeg.exe OR
                    Processes.original_file_name = ffmpeg.exe
                  ) AND

                  Processes.process_path IN ("*\\temp\\*") AND
                  Processes.process = "*video=*" AND
                  Processes.process = "* mjpeg *" AND
                  Processes.process = "* dshow *"
                )
          BY Processes.action Processes.dest Processes.original_file_name
            Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
            Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
            Processes.process Processes.process_exec Processes.process_guid
            Processes.process_hash Processes.process_id Processes.process_integrity_level
            Processes.process_name Processes.process_path Processes.user
            Processes.user_id Processes.vendor_product
        | `drop_dm_object_name(Processes)`
        | `security_content_ctime(firstTime)`
        | `security_content_ctime(lastTime)`
    | `windows_ffmpeg_directshow_video_capture_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
references:
    - https://www.broadcom.com/support/security-center/protection-bulletin/uac-0252-activity-delivering-shadowsniff-and-salatstealer-malware
    - https://bazaar.abuse.ch/browse/tag/SalatStealer/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a ffmpeg.exe process [$process_path$] capture video using DirectShow on [$dest$].
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1125
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Increase in Group or Object Modification Activity
id: 4f9564dd-a204-4f22-b375-4dfca3a68731
version: 10
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This analytic detects an increase in modifications to AD groups or objects. Frequent changes to AD groups or objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.
data_source:
    - Windows Event Log Security 4663
search: |-
    `wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764)
      | bucket span=5m _time
      | stats values(object) as object, dc(object) as objectCount, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category
        BY _time, src_user, signature,
           status
      | eventstats avg(objectCount) as comp_avg, stdev(objectCount) as comp_std
        BY src_user, signature
      | eval upperBound=(comp_avg+comp_std)
      | eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0)
      | search isOutlier=1
      | `windows_increase_in_group_or_object_modification_activity_filter`
how_to_implement: Run this detection looking over a 7 day timeframe for best results.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: Spike in Group or Object Modifications performed by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1098
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: audit

name: Windows Mock Trusted Directory MSC File Creation
id: de8cc077-2dba-4060-af78-c98b3cfc5407
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects the creation of MSC files within a "C:\Windows \System32" directory.
    Due to how Windows parses paths, the space causes an execution flow hijack and a malicious file will be executed instead of the standard Windows Files.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.file_path IN (
        "C:\\Windows \\System32\\*.msc",
        "C:\\Windows \\System32\\de-DE\\*.msc",
        "C:\\Windows \\System32\\en-US\\*.msc",
        "C:\\Windows \\System32\\es-ES\\*.msc",
        "C:\\Windows \\System32\\fr-FR\\*.msc",
        "C:\\Windows \\System32\\it-IT\\*.msc",
        "C:\\Windows \\System32\\ja-JP\\*.msc",
        "C:\\Windows \\System32\\ko-KR\\*.msc",
        "C:\\Windows \\System32\\zh-CN\\*.msc",
        "C:\\Windows \\System32\\zh-TW\\*.msc"
    )

    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name
       Filesystem.user Filesystem.vendor_product Filesystem.action

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_mock_trusted_directory_msc_file_creation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate software installers or system maintenance tools may create MSC files in the System32 directory with unusual paths. Verify and allow trusted system or vendor-approved processes to reduce false positives.
references:
    - https://www.fortinet.com/blog/threat-research/fickle-stealer-distributed-via-multiple-attack-chain
finding:
    title: MSC file created in a mock trusted directory at $file_path$ on $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_path
      type: file_path
analytic_story:
    - Windows Persistence Techniques
    - Windows Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1218.014
    - T1548.002
    - T1574
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows MsiExec HideWindow Rundll32 Execution
id: 9683271d-92e4-43b5-a907-1983bfb9f7fd
version: 12
creation_date: '2021-10-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the msiexec.exe process with the /HideWindow and rundll32 command-line parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant because it is a known tactic used by malware like QakBot to mask malicious operations under legitimate system processes. If confirmed malicious, this behavior could allow an attacker to download additional payloads, execute malicious code, or establish communication with remote servers, thereby evading detection and maintaining persistence.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name = msiexec.exe  Processes.process = "* /HideWindow *" Processes.process = "* rundll32*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_msiexec_hidewindow_rundll32_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Other possible 3rd party msi software installers use this technique as part of its installation process.
references:
    - https://twitter.com/Max_Mal_/status/1736392741758611607
    - https://twitter.com/1ZRR4H/status/1735944522075386332
finding:
    title: a msiexec parent process with /hidewindow rundll32 process commandline on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Qakbot
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1218.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Multiple NTLM Null Domain Authentications
id: c187ce2c-c88e-4cec-8a1c-607ca0dedd78
version: 10
creation_date: '2024-03-16'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects when a device is the target of numerous NTLM authentications using a null domain. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a domain joined Windows device from a non-domain device. This activity may also generate a large number of EventID 4776 events in tandem, however these events will not indicate the attacker or target device
data_source:
    - NTLM Operational 8004
    - NTLM Operational 8005
    - NTLM Operational 8006
search: '`ntlm_audit` EventCode IN (8004,8005,8006) DomainName=NULL UserName!=NULL | eval src = replace(WorkstationName,"\\\\","")  ```CIM alignment, remove leading \\ from some auth attempts ``` | eval dest = SChannelName, user = UserName ``` CIM alignment``` | where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications``` | stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count dc(eval(upper(src))) as src_count by dest | eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std | eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity``` | eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0) | where isOutlier==1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_multiple_ntlm_null_domain_authentications_filter`'
how_to_implement: The following analytic requires that NTLM Operational logs to be imported from the environment Domain Controllers. This requires configuration of specific auditing settings, see Microsoft references for further guidance. This analytic is specific to EventID 8004~8006.
known_false_positives: Applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/ntlm-blocking-and-you-application-analysis-and-auditing/ba-p/397191
    - https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/enriched-ntlm-authentication-data-using-windows-event-8004/m-p/871827
    - https://www.varonis.com/blog/investigate-ntlm-brute-force
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/4d1235e3-2c96-4e9f-a147-3cb338a0d09f
finding:
    title: The device [$dest$] was the target of $count$ NTLM authentications from $src_count$ sources using $unique_count$ unique user accounts.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Password Spraying
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
id: f122cb2e-d773-4f11-8399-62a3572d8dd7
version: 11
creation_date: '2021-04-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies a source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. It leverages Event ID 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code 0x6, indicating the user is not found in the Kerberos database. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access and potential privilege escalation within the Active Directory environment.
data_source:
    - Windows Event Log Security 4768
search: |-
    `wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
      | bucket span=5m _time
      | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
        BY _time, IpAddress
      | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
        BY IpAddress
      | eval upperBound=(comp_avg+comp_std*3)
      | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
      | search isOutlier=1
      | `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
references:
    - https://attack.mitre.org/techniques/T1110/003/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Potential Kerberos based password spraying attack from $IpAddress$
threat_objects:
    - field: IpAddress
      type: ip_address
analytic_story:
    - Active Directory Password Spraying
    - Active Directory Kerberos Attacks
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint