Splunk rules: 0f

name: AWS Bedrock Delete Model Invocation Logging Configuration
id: 9c5e3d62-f743-11ee-9f6e-acde48001124
version: 7
creation_date: '2025-03-25'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies attempts to delete AWS Bedrock model invocation logging configurations. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteModelInvocationLogging API. This activity is significant as it may indicate an adversary attempting to remove audit trails of model interactions after compromising credentials. Deleting model invocation logs could allow attackers to interact with AI models without leaving traces, potentially enabling them to conduct data exfiltration, prompt injection attacks, or other malicious activities without detection. If confirmed malicious, this could represent a deliberate attempt to hide unauthorized model usage and evade detection.
data_source:
    - AWS CloudTrail DeleteModelInvocationLoggingConfiguration
search: >-
    `cloudtrail` eventSource=bedrock.amazonaws.com
    eventName=DeleteModelInvocationLoggingConfiguration | rename user_name as user
    | stats count min(_time) as firstTime max(_time) as lastTime by src user
    user_agent vendor_account vendor_product dest signature vendor_region |
    `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |
    `aws_bedrock_delete_model_invocation_logging_configuration_filter`
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock model invocation logging management events.
known_false_positives: Legitimate administrators may delete model invocation logging configurations during maintenance, when updating logging policies, or when cleaning up unused resources. Consider implementing an allowlist for expected administrators who regularly manage logging configurations.
references:
    - https://www.sumologic.com/blog/defenders-guide-to-aws-bedrock/
    - https://attack.mitre.org/techniques/T1562/008/
finding:
    title: User $user$ deleted AWS Bedrock model invocation logging from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Bedrock Security
asset_type: AWS Account
mitre_attack_id:
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS Defense Evasion PutBucketLifecycle
id: ce1c0e2b-9303-4903-818b-0d9002fc6ea4
version: 10
creation_date: '2022-07-25'
modification_date: '2026-05-13'
author: Bhavin Patel
status: production
type: Hunting
description: The following analytic detects `PutBucketLifecycle` events in AWS CloudTrail logs where a user sets a lifecycle rule for an S3 bucket with an expiration period of fewer than three days. This detection leverages CloudTrail logs to identify suspicious lifecycle configurations. This activity is significant because attackers may use it to delete CloudTrail logs quickly, thereby evading detection and impairing forensic investigations. If confirmed malicious, this could allow attackers to cover their tracks, making it difficult to trace their actions and respond to the breach effectively.
data_source:
    - AWS CloudTrail PutBucketLifecycle
search: |-
    `cloudtrail` eventName=PutBucketLifecycle user_type=IAMUser errorCode=success
      | spath path=requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days output=expiration_days
      | spath path=requestParameters{}.bucketName output=bucket_name
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product bucket_name
           expiration_days
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_defense_evasion_putbucketlifecycle_filter`
how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. We recommend our users to set the expiration days value according to your company's log retention policies.
known_false_positives: While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names.
references:
    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/
analytic_story:
    - AWS Defense Evasion
asset_type: AWS Account
mitre_attack_id:
    - T1485.001
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '1067.1100'
title: BitsAdmin NetCat PowerCat File Transfer
description: 'This use case is searching for specific keywords that are generated
  when a file transfer using Bitsadmin, Netcat or PowerCat is made to send data to/from
  an external source. -- Threat Actor Association: Cadet Blizzard - Software Association:
  Black Basta -- Atomics T1105 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (("/transfer" OR "/addfile" OR "Start-BitsTransfer" OR " -vw " OR " -vn " OR " -vwn
  " OR " -vnw " OR " -w " OR " -wv " OR " -wn " OR " -wvn " OR " -wnv " OR " -N "
  OR " -Nv " OR " -Nw " OR " -Nvw " OR " -Nwv " OR " --send-only") OR ("nc64" OR "nc32"
  OR "netcat64" OR "netcat32" OR "ncat" OR "nc" OR "netcat")) | regex process="(\s+\-[Nvw]+\s+\d+?.*?(((\d{1,3}\.){3}\d{1,3})|(\w?\wtps?\:(\/\/|\x5c\x5c)))\s+\d{2,5})|(?i)((ncat|nc|nc64|nc32|netcat64|netcat32|netcat)(\s+|\.exe).*?\-[Nvw]+\s+\d+?.*?(((\d{1,3}\.){3}\d{1,3})|(\w?\wtps?\:(\/\/|\x5c\x5c)))\s+\d{2,5})|(\s+\/(transfer)\s+.*?\w{3,5}\:\/\/)|(?i)(--send-only\s+?$)|(?i)(Start-BitsTransfer)|\s+(\/(addfile)\s+)"
  | rex field=process max_match=1 (?<dest_ip>"\s+((([a-f0-9:]+:+)+[a-f0-9]+)|((\d{1,3}\.){3}\d{1,3}))\s+")|
  rex field=dest_ip mode=sed "s/([\n|\r|\s])//g" | table _time, host, user process,
  process_*, parent_*, dest_ip | bin span=1s | stats values(*) as * by _time, host
  | search NOT dest_ip IN(10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12,
  192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1", "FE80::/10", "FF00::/8") '
techniques:
- command-and-control:application layer protocol:file transfer protocols
- persistence:bits jobs
- defense-evasion:bits jobs
technique_id:
- T1071.002
- T1197
data_category:
- Windows Sysmon
references: null

id: '6167.6701'
title: Certutil Execution
description: 'certutil is a command-line utility that can be used to obtain certificate
  authority information and configure Certificate Services. This use case looks for
  process executions of certutil. -- Threat Actor Association: DarkSide, BlackMatter,
  REvil - Software Association: HermeticWiper/Trojan.Killdisk -- Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN) -- Atomics 1003.002 Test #5 Atomics 1140 Test
  #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(certutil) OR "certutil.exe") | table _time,
  host, user, signature_id, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process_name, "(?i)certutil") '
techniques:
- command-and-control:data encoding
- command-and-control:ingress tool transfer
- defense-evasion:deobfuscate/decode files or information
- defense-evasion:obfuscated files or information
technique_id: 
- T1132
- T1105
- T1140
- T1027
data_category:
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
- https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html

id: '1073.1112'
title: Common Active Directory Commands
description: 'Detects the possible execution of specific AD commands on hosts. Threat
  Actor Association: APT29/Nobelium/Cozy Bear, APT41, FIN6, FIN10, Carbanak, CL-STA-0043,
  Lapsus$, Lazarus, MuddyWater, Sandworm Team, TA428, Turla, UNC2596, Vice Society,
  Volt Typhoon (Bronze Silhouette, Vanguard Panda), Witchetty, Wizard Spider Software
  Association: Akira, ALPHV/BlackCat, AvosLocker, Bazarloader, BianLian, Black Basta,
  Clop, Conti, Cuba, Havex, IcedID, Insekt, Lockbit, Revil, Ryuk, Snatch, WASTEDLOCKER
  Tags: TrendingThreat, Russia, Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("csvde.exe" OR "dsacls.exe" OR "dcpromo.exe"
  OR "dcdiag.exe" OR "dsamain.exe" OR "dsmgmt.exe" OR "ldifde.exe" OR "ldp.exe" OR
  "netdom.exe" OR "nltest.exe" OR "setspn.exe" OR "dsquery" OR ("net" AND ("/domain"
  OR "/dom" OR "computer" )) OR "whoami /groups")) | table _time, host, user, dvc,
  event_id, host, parent_process_id, parent_process_name, parent_process_path, process,
  process_id, process_name, process_path, signature_id, tag, user_id | bin span=300s
  | stats values(*) as * by _time, host |eventstats dc(process_name) as dc_process_name
  by host, _time | where dc_process_name > 0 '
techniques:
- discovery:account discovery:domain account
- discovery:system service discovery
technique_id:
- T1087.002
- T1007
data_category:
- Windows event logs
references:
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

name: Detect Port Security Violation
id: 2de3d5b8-a4fa-45c5-8540-6d071c194d24
version: 11
creation_date: '2020-10-28'
modification_date: '2026-05-13'
author: Mikael Bjerkeland, Splunk
status: experimental
type: TTP
description: The following analytic detects port security violations on Cisco switches. It leverages logs from Cisco network devices, specifically looking for events with mnemonics indicating port security violations. This activity is significant because it indicates an unauthorized device attempting to connect to a secured port, potentially bypassing network access controls. If confirmed malicious, this could allow an attacker to gain unauthorized access to the network, leading to data exfiltration, network disruption, or further lateral movement within the environment.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN")
      | eval src_interface=src_int_prefix_long+src_int_suffix
      | stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(action) AS action count
        BY host src_interface
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_port_security_violation_filter`
how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with Port Security and Error Disable for this to work (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
known_false_positives: This search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.
references: []
finding:
    title: Port Securtiy Violation on $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Router and Infrastructure Security
asset_type: Infrastructure
mitre_attack_id:
    - T1200
    - T1498
    - T1557.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Detect Regasm with Network Connection
id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f
version: 16
creation_date: '2021-02-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of regasm.exe establishing a network connection to a public IP address, excluding private IP ranges. This detection leverages Sysmon EventID 3 logs to identify such behavior. This activity is significant as regasm.exe is a legitimate Microsoft-signed binary that can be exploited to bypass application control mechanisms. If confirmed malicious, this behavior could indicate an adversary's attempt to establish a remote Command and Control (C2) channel, potentially leading to privilege escalation and further malicious actions within the environment.
data_source:
    - Sysmon EventID 3
search: |
    `sysmon`
    EventID=3
    process_name=regasm.exe
    NOT dest_ip IN (
      "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
      "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
      "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
      "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
      "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4"
    )
    | stats count min(_time) as firstTime max(_time) as lastTime
      by action app dest dest_ip dest_port direction dvc protocol protocol_version src
         src_ip src_port transport user vendor_product process_name process_exec process_guid
         process_id
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_regasm_with_network_connection_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
references:
    - https://attack.mitre.org/techniques/T1218/009/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
    - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
finding:
    title: An instance of $process_name$ contacting a remote destination was identified on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $process_name$ contacting a remote destination was identified on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Regsvcs Regasm Activity
    - Living Off The Land
    - Handala Wiper
    - Hellcat Ransomware
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1218.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Excessive File Deletion In WinDefender Folder
id: b5baa09a-7a05-11ec-8da4-acde48001122
version: 10
creation_date: '2022-01-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects excessive file deletion events in the Windows Defender folder. It leverages Sysmon EventCodes 23 and 26 to identify processes deleting multiple files within this directory. This behavior is significant as it may indicate an attempt to corrupt or disable Windows Defender, a key security component. If confirmed malicious, this activity could allow an attacker to disable endpoint protection, facilitating further malicious actions without detection.
data_source:
    - Sysmon EventID 23
    - Sysmon EventID 26
search: '`sysmon` EventCode IN ("23","26") TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender\\*" | stats count min(_time) as firstTime, max(_time) as lastTime values(file_path) as file_path values(file_hash) as file_hash values(file_name) as file_name values(file_modify_time) as file_modify_time values(process_name) as process_name values(process_path) as process_path values(process_guid) as process_guid values(process_id) as process_id values(process_exec) as process_exec by action dest dvc signature signature_id user user_id vendor_product | where count >=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_file_deletion_in_windefender_folder_filter`'
how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
known_false_positives: Windows Defender AV updates may trigger this alert. Please adjust the filter macros to mitigate false positives.
references:
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
finding:
    title: Excessive file deletion events were detected in the Windows Defender folder on $dest$ by $user$. Investigate further to determine if this activity is malicious.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Excessive file deletion events were detected in the Windows Defender folder on $dest$ by $user$. Investigate further to determine if this activity is malicious.
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Data Destruction
    - WhisperGate
    - BlackByte Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Hunting for Log4Shell
id: 158b68fa-5d1a-11ec-aac8-acde48001122
version: 7
creation_date: '2021-12-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects potential exploitation attempts of the Log4Shell vulnerability (CVE-2021-44228) by analyzing HTTP headers for specific patterns. It leverages the Web Datamodel and evaluates various indicators such as the presence of `{jndi:`, environment variables, and common URI paths. This detection is significant as Log4Shell allows remote code execution, posing a severe threat to systems. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and potentially compromise sensitive data, leading to extensive damage and data breaches.
data_source:
    - Nginx Access
search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0) | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0) | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0) | eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID") OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw, "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0) | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0) | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^ /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0)  | addtotals fieldname=Score, jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, lookups | where Score > 2 | stats values(Score) by  jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, lookups, obf, dest, src, http_method, _raw | `hunting_for_log4shell_filter`'
how_to_implement: Out of the box, the Web datamodel is required to be pre-filled. However, tested was performed against raw httpd access logs. Change the first line to any dataset to pass the regex's against.
known_false_positives: It is highly possible you will find false positives, however, the base score is set to 2 for _any_ jndi found in raw logs. tune and change as needed, include any filtering.
references:
    - https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
    - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449
    - https://regex101.com/r/OSrm0q/1/
    - https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar
    - https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/
    - https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c
    - https://twitter.com/sasi2103/status/1469764719850442760?s=20
analytic_story:
    - Log4Shell CVE-2021-44228
    - CISA AA22-320A
asset_type: Web Server
cve:
    - CVE-2021-44228
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Auditd Data Transfer Size Limits Via Split
id: 4669561d-3bbd-44e3-857c-0e3c6ef2120c
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command = "*split*" AND execve_command = "*-b *"
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_data_transfer_size_limits_via_split_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$execve_command$] event occurred on host - [$dest$] to split a file.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1030
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Doas Tool Execution
id: d5a62490-6e09-11ec-884e-acde48001122
version: 11
creation_date: '2022-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, similar to 'sudo'. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as 'doas' can be exploited by adversaries to gain elevated privileges on a compromised host. If confirmed malicious, this could lead to unauthorized administrative access, potentially compromising the entire system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "doas"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_doas_tool_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://wiki.gentoo.org/wiki/Doas
    - https://www.makeuseof.com/how-to-install-and-use-doas/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A doas $process_name$ with commandline $process$ was executed on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: M365 Copilot Information Extraction Jailbreak Attack
id: c0ee37bb-ed43-4632-8e38-060fba80b0b2
version: 5
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: TTP
description: Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. The detection searches exported eDiscovery prompt logs for extraction keywords like "transcendent," "tell me everything," "confidential," "dump," "extract," "reveal," and "bypass" in the Subject_Title field, categorizing each attempt by extraction type and assigning severity levels (CRITICAL for classified/proprietary data, HIGH for bulk extraction or privacy bypass). Prompts are further analyzed for compound risk patterns such as "Confidential+Extraction" or "Bulk_Request+Bypass," filtering out low-severity cases to surface the most dangerous attempts to exfiltrate sensitive organizational information through AI manipulation.
data_source:
    - M365 Exported eDiscovery Prompts
search: >
    `m365_exported_ediscovery_prompt_logs` | search Subject_Title="*transcendent*"
    OR Subject_Title="*incorporeal*" OR Subject_Title="*being who*" OR
    Subject_Title="*tell me everything*" OR Subject_Title="*give me all*" OR
    Subject_Title="*comprehensive*" OR Subject_Title="*step by step*" OR
    Subject_Title="*hidden*" OR Subject_Title="*secret*" OR
    Subject_Title="*confidential*" OR Subject_Title="*classified*" OR
    Subject_Title="*internal*" OR Subject_Title="*sensitive*" OR
    Subject_Title="*proprietary*" OR Subject_Title="*dump*" OR
    Subject_Title="*extract*" OR Subject_Title="*reveal*" OR
    Subject_Title="*disclose*" OR Subject_Title="*leak*" | eval user = Sender |
    eval extraction_type=case(match(Subject_Title,
    "(?i)(transcendent|incorporeal).*being"), "Knowledge_Entity",
    match(Subject_Title, "(?i)tell.*me.*(everything|all)"), "Everything_Request",
    match(Subject_Title, "(?i)(give|show|provide).*me.*(all|every)"),
    "Complete_Data_Request", match(Subject_Title,
    "(?i)(hidden|secret|confidential|classified)"), "Restricted_Info",
    match(Subject_Title, "(?i)(comprehensive|complete|full|entire)"),
    "Complete_Info", match(Subject_Title,
    "(?i)(dump|extract|scrape).*(data|info|content)"), "Data_Extraction",
    match(Subject_Title, "(?i)(reveal|disclose|expose|leak)"),
    "Information_Disclosure", match(Subject_Title,
    "(?i)(internal|proprietary|sensitive).*information"),
    "Sensitive_Data_Request", match(Subject_Title,
    "(?i)step.*by.*step.*(process|procedure|method)"), "Process_Extraction",
    match(Subject_Title, "(?i)(bypass|ignore).*privacy"), "Privacy_Bypass",
    match(Subject_Title, "(?i)(access|view|see).*(private|restricted)"),
    "Unauthorized_Access", 1=1, "Generic_Request") | eval
    severity=case(match(Subject_Title, "(?i)(transcendent|incorporeal)"), "HIGH",
    match(Subject_Title, "(?i)tell.*everything"), "HIGH", match(Subject_Title,
    "(?i)(dump|extract|scrape)"), "HIGH", match(Subject_Title,
    "(?i)(classified|proprietary|confidential)"), "CRITICAL", match(Subject_Title,
    "(?i)(hidden|secret|internal|sensitive)"), "MEDIUM", match(Subject_Title,
    "(?i)(reveal|disclose|leak)"), "MEDIUM", match(Subject_Title,
    "(?i)(bypass|ignore).*privacy"), "HIGH", 1=1, "LOW") | where severity!="LOW" |
    eval data_risk_flags=case(match(Subject_Title,
    "(?i)(classified|confidential|proprietary)") AND match(Subject_Title,
    "(?i)(dump|extract|scrape)"), "Confidential+Extraction", match(Subject_Title,
    "(?i)(everything|all|complete)") AND match(Subject_Title,
    "(?i)(bypass|ignore)"), "Bulk_Request+Bypass", match(Subject_Title,
    "(?i)(classified|confidential|proprietary)"), "Confidential",
    match(Subject_Title, "(?i)(dump|extract|scrape)"), "Extraction",
    match(Subject_Title, "(?i)(everything|all|complete|comprehensive)"),
    "Bulk_Request", match(Subject_Title, "(?i)(bypass|ignore)"), "Bypass_Attempt",
    1=1, "Standard_Request") | table _time, user, Subject_Title, extraction_type,
    severity, data_risk_flags, Size | sort -severity, -_time |
    `m365_copilot_information_extraction_jailbreak_attack_filter`
how_to_implement: To export M365 Copilot prompt logs, navigate to the Microsoft Purview compliance portal (compliance.microsoft.com) and access eDiscovery. Create a new eDiscovery case, add target user accounts or date ranges as data sources, then create a search query targeting M365 Copilot interactions across relevant workloads. Once the search completes, export the results to generate a package containing prompt logs with fields like Subject_Title (prompt text), Sender, timestamps, and workload metadata. Download the exported files using the eDiscovery Export Tool and ingest them into Splunk for security analysis and detection of jailbreak attempts, data exfiltration requests, and policy violations.
known_false_positives: Legitimate researchers studying data classification systems, cybersecurity professionals testing information handling policies, compliance officers reviewing data access procedures, journalists researching transparency issues, or employees asking for comprehensive project documentation may trigger false positives.
references:
    - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
finding:
    title: Use $user$ attempted M365 Copilot information extraction jailbreak with severity level $severity$ using extraction type $extraction_type$ techniques and $data_risk_flags$ patterns to obtain sensitive or classified information, potentially violating data protection policies and corporate security controls.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Suspicious Microsoft 365 Copilot Activities
asset_type: Web Application
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: O365 Bypass MFA via Trusted IP
id: c783dd98-c703-4252-9e8a-f19d9f66949e
version: 13
creation_date: '2021-01-13'
modification_date: '2026-05-13'
author: Bhavin Patel, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where new IP addresses are added to the trusted IPs list in Office 365, potentially allowing users from these IPs to bypass Multi-Factor Authentication (MFA) during login. It leverages O365 audit logs, specifically focusing on events related to the modification of trusted IP settings. This activity is significant because adding trusted IPs can weaken the security posture by bypassing MFA, which is a critical security control. If confirmed malicious, this could lead to unauthorized access, compromising sensitive information and systems. Immediate investigation is required to validate the legitimacy of the IP addition.
data_source:
    - O365 Set Company Information.
search: '`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by signature dest user src vendor_account vendor_product ip_addresses_new_added | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_bypass_mfa_via_trusted_ip_filter`'
how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
references:
    - https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
    - https://attack.mitre.org/techniques/T1562/007/
    - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings
finding:
    title: User $user$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
asset_type: O365 Tenant
mitre_attack_id:
    - T1686.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Windows Anonymous Pipe Activity
id: ee301e1e-cd81-4011-a911-e5f049b9e3d5
version: 7
creation_date: '2025-02-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: "The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques."
data_source:
    - Sysmon EventID 17
    - Sysmon EventID 18
search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName="*Anonymous Pipe*" NOT( Image IN ("C:\\Program Files*", "C:\\Windows\\system32\\*","C:\\Windows\\syswow64\\*")) | stats  min(_time) as firstTime max(_time) as lastTime count by dest EventCode PipeName ProcessGuid ProcessId Image EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anonymous_pipe_activity_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. .
known_false_positives: Automation tool might use anonymous pipe for task orchestration or process communication.
references:
    - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
analytic_story:
    - Salt Typhoon
    - China-Nexus Threat Activity
    - SnappyBee
    - Interlock Rat
    - Castle RAT
asset_type: Endpoint
mitre_attack_id:
    - T1559
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Disable Shutdown Button Through Registry
id: 55fb2958-9ecd-11ec-a06a-acde48001122
version: 15
creation_date: '2022-03-08'
modification_date: '2026-08-05'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: |-
    The following analytic detects suspicious registry modifications that disable the shutdown button on a user's logon screen.
    It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with shutdown policies.
    This activity is significant because it is a tactic used by malware, particularly ransomware like KillDisk, to hinder system usability and prevent the removal of malicious changes.
    If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications.
data_source:
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Registry WHERE

    (
        (
        Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
        Registry.registry_value_data = "0x00000000"
        )
    OR
        (
            Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
            Registry.registry_value_data = "0x00000001"
        )
    )

    by Registry.action Registry.dest Registry.process_guid Registry.process_id
       Registry.registry_hive Registry.registry_path Registry.registry_key_name
       Registry.registry_value_data Registry.registry_value_name
       Registry.registry_value_type Registry.status
       Registry.user Registry.vendor_product

    | `drop_dm_object_name(Registry)`
    | where isnotnull(registry_value_data)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_disable_shutdown_button_through_registry_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints.
    If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: |-
    This Windows feature may be implemented by an administrator on some servers where shutdown is restricted.
    In that scenario, filtering by the machines and users allowed to modify this registry key is recommended.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The registry key [$registry_path$] was modified to disable the shutdown button on [$dest$].
analytic_story:
    - Ransomware
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows HTTP Network Communication From MSIExec
id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99
version: 11
creation_date: '2022-06-17'
modification_date: '2026-07-14'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
    - Cisco Network Visibility Module Flow Data
search: |-
    | tstats `security_content_summariesonly`
      count

    FROM datamodel=Endpoint.Processes where

    `process_msiexec`

    by _time Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id
       Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`

    | join process_id [
        | tstats `security_content_summariesonly`
          count

        FROM datamodel=Network_Traffic.All_Traffic where

        All_Traffic.dest_port IN ("80","443")

        by All_Traffic.action All_Traffic.app All_Traffic.bytes
           All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest
           All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc
           All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
           All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport
           All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
           All_Traffic.process_id

        | `drop_dm_object_name(All_Traffic)`
    ]
    | table _time user dest parent_process_name process_name
            process_path process process_id dest_port dest_ip
    | `windows_http_network_communication_from_msiexec_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will be present and filtering is required.
references:
    - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination $dest_ip$
        - field: dest
          type: system
          score: 20
          message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination $dest_ip$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - GhostRedirector IIS Module and Rungan Backdoor
    - Windows System Binary Proxy Execution MSIExec
    - Water Gamayun
    - Cisco Network Visibility Module Analytics
    - SolarWinds WHD RCE Post Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1218.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Disable Realtime Signature Delivery
id: ffd99aea-542f-448e-b737-091c1b417274
version: 11
creation_date: '2024-01-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that disable the Windows Defender real-time signature delivery feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender signature updates. This activity is significant because disabling real-time signature delivery can prevent Windows Defender from receiving timely malware definitions, reducing its effectiveness. If confirmed malicious, this action could allow attackers to bypass malware detection, leading to potential system compromise and persistent threats.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\RealtimeSignatureDelivery" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_realtime_signature_delivery_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender File realtime signature delivery set to disable on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows WMI Process And Service List
id: ef3c5ef2-3f6d-4087-aa75-49bf746dc907
version: 11
creation_date: '2022-12-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies suspicious WMI command lines querying for running processes or services. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process and command-line events. This activity is significant as adversaries often use WMI to gather system information and identify services on compromised machines. If confirmed malicious, this behavior could allow attackers to map out the system, identify critical services, and plan further attacks, potentially leading to privilege escalation or persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_wmic` Processes.process IN ("*process*", "*service*") Processes.process = "*list*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_wmi_process_and_service_list_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: netowrk administrator or IT may execute this command for auditing processes and services.
references:
    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: wmi command $process$ to list processes and services on $dest$
analytic_story:
    - Windows Post-Exploitation
    - Prestige Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32506.57774'
title: Wow6432Node Classes Autorun Keys Modification
description: Adversaries may achieve persistence by adding a program to a startup
  folder or referencing it with a Registry run key. Adding an entry to the "run keys"
  in the Registry or startup folder will cause the program referenced to be executed
  when a user logs in. These programs will be executed under the context of the user
  and will have the account's associated permissions level. This use case detects
  any modifications made to the \Software\Wow6432Node\Classes registry path, indicating
  modification of autostart extensibility point (ASEP).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ((TERM(EventCode=13) OR "<EventID>13<")
  OR ((TERM(EventCode=1) OR "<EventID>1<") "ADD" OR "Set-ItemProperty" OR "sp " OR
  "New-ItemProperty" OR "New-Item" OR "md " OR "ni ")) "SOFTWARE\\Wow6432Node\\Classes"
  ("\\Folder\\ShellEx\\ExtShellFolderViews" OR "\\Folder\\ShellEx\\DragDropHandlers"
  OR "\\Folder\\ShellEx\\ColumnHandlers" OR "\\Directory\\Shellex\\DragDropHandlers"
  OR "\\Directory\\Shellex\\CopyHookHandlers" OR "\\CLSID\\{AC757296-3522-4E11-9862-C17BE5A1767E}\\Instance"
  OR "\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance" OR "\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance"
  OR "\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance" OR "\\AllFileSystemObjects\\ShellEx\\DragDropHandlers"
  OR "\\ShellEx\\PropertySheetHandlers" OR "\\ShellEx\\ContextMenuHandlers") | table
  _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
technique_id:
- T1547.001
data_category:
- Windows Sysmon
references:
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml
- https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns