Splunk rules: 0h

id: '17427.28494'
title: Application Discovery - Windows
description: 'Adversaries may attempt to get a listing of software and software versions
  that are installed on a system or in a cloud environment. Adversaries may use the
  information from Software Discovery during automated discovery to shape follow-on
  behaviors, including whether or not the adversary fully infects the target and/or
  attempts specific actions. Adversaries may attempt to enumerate software for a variety
  of reasons, such as figuring out what security measures are present or if the compromised
  system has a version of software that is vulnerable to Exploitation for Privilege
  Escalation. This use case detects commands enumerating applications installed on
  a Windows system. Atomics T1518 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(query) OR (TERM(Get-ItemProperty) OR TERM(gp))
  "Software" "Uninstall") OR ("wmic" TERM(product)) | regex process="(?i)((\s+query\s+|Get-ItemProperty|gp\s).*\x5cUninstall\x5c\*)|wmic\s+product\s+get\s+"
  | table _time, host, user, process, process_*, parent_process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- discovery:software discovery
technique_id: 
- T1518
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518/T1518.md#atomic-test-2---applications-installed

name: Cisco Isovalent - Kprobe Spike
id: 3df0e9a8-7d5e-4b2f-bcd7-bf93e671d1f2
version: 4
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Hunting
description: |
    This analytic detects excessive kernel probe (kprobe) events in a Kubernetes cluster over a short period of time.
    Kprobes are a Linux kernel debugging and instrumentation mechanism that allows dynamic monitoring and tracing of kernel functions and system calls.
    In containerized or cloud-native environments, kprobes are occasionally used for legitimate low-level diagnostics; however, monitoring a spike in kprobe activity is important because malware or attackers may abuse this mechanism to gain insights into the kernel, attempt privilege escalation, or tamper with host processes.
    More than 10 kprobe events within 5 minutes may indicate suspicious activity, such as an attacker probing the kernel through repeated system calls (e.g., nsenter, mount, sethostname).
    Such abnormal volume and frequency of kprobe usage within application pods or on nodes can signal container escape attempts or low-level tampering with the host, thereby representing a potential security threat.
data_source:
    - Cisco Isovalent Process Kprobe
search: |
    `cisco_isovalent` process_kprobe.action!=""
    | bin _time span=5m | rename process_kprobe.parent.pod.name as pod_name
    | stats count as kprobe_count
            values(process_kprobe.function_name) as functions
            values(process_kprobe.process.binary) as binaries
            values(process_kprobe.args{}.string_arg) as args
      by pod_name _time
    | where kprobe_count > 10 | `cisco_isovalent___kprobe_spike_filter`
how_to_implement: |
    Requires Cisco Isovalent Runtime Security with kprobe tracing enabled and logs
    forwarded into Splunk. Ensure that your Splunk Technology Add-on (TA) for Cisco
    Security Cloud parses the kprobe JSON correctly. Tune the threshold based on
    your workload baseline.
known_false_positives: |
    Busy or noisy pods may legitimately produce bursts of kprobe events during normal
    operation. Tune thresholds and filter by function_name to reduce false positives.
references:
    - https://docs.isovalent.com/user-guide/sec-ops-visibility/process-execution/index.html
analytic_story:
    - Cisco Isovalent Suspicious Activity
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31402.56382'
title: Defender Registry Values Modified
description: Adversaries may interact with the Windows Registry to disable security
  tools to avoid possible detection of their malware/tools and activities. They may
  interact directly with the registry via command line interpreters or they may abuse
  system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe.
  This use case detects commands for registry modifications targeting Windows Defender
  capabilities.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ((TERM(EventCode=1) OR "<EventID>1<")
  ("cmd.exe" OR "powershell.exe" OR "pwsh.exe") "Defender" (("DisableEnhancedNotifications"
  OR "RTP") "1") OR (("SubmitSamplesConsent" OR "SpynetReporting") "0") OR (("Set-ItemProperty"
  OR "sp " OR "ADD ") ("SOFTWARE\\Microsoft\\Windows Defender\\Reporting" OR "SOFTWARE\\Microsoft\\Windows
  Defender\\Spynet" OR "SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection")))
  OR ((TERM(EventCode=13) OR "<EventID>13<") ("SOFTWARE\\Microsoft\\Windows Defender\\Reporting"
  OR "SOFTWARE\\Microsoft\\Windows Defender\\Spynet" OR "SOFTWARE\\Microsoft\\Windows
  Defender\\Real-Time Protection")) | table _time, host, user, process, process_name,
  registry_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- defense-evasion:impair defenses:disable or modify tools
technique_id:
- T1112
- T1562.001
data_category:
- Windows Sysmon
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1562/001/
- https://attack.mitre.org/techniques/T1112/
- https://www.huntress.com/blog/lolbin-to-inc-ransomware

name: Get DomainPolicy with Powershell
id: b8f9947e-065a-11ec-aafb-acde48001122
version: 11
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `powershell.exe` running the `Get-DomainPolicy` cmdlet, which is used to retrieve password policies in a Windows domain. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather domain policy information, which is crucial for planning further attacks. If confirmed malicious, this could lead to unauthorized access to sensitive domain configurations, aiding in privilege escalation and lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="cmd.exe"
            OR
            Processes.process_name="powershell*"
        )
        AND Processes.process = "*Get-DomainPolicy*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `get_domainpolicy_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/
    - https://attack.mitre.org/techniques/T1201/
finding:
    title: an instance of process $process_name$ with commandline $process$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: an instance of process $process_name$ with commandline $process$ on $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1201
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32310.57466'
title: Git Hooks Spawn System32 Process
description: 'Adversaries may abuse command and script interpreters to execute commands,
  scripts, or binaries with the help of Git hooks. These interfaces and languages
  provide ways of interacting with computer systems and are a common feature across
  many different platforms. Most systems come with some built-in command-line interface
  and scripting capabilities, for example, Windows installations include the Windows
  Command Shell and PowerShell. This use case detects Git hooks spawning a System32
  process. Note: for best rule fidelity, Windows Event or Sysmon process creation
  logs are recommended due to their detailed parent process path information. Vulnerability
  reference: CVE-2024-32002'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(git) (TERM(hook) OR TERM(hooks)) "C:\\Windows\\System32" | where match(process,
  "(?i)C:\x5cWindows\x5csystem32") and match(parent_process_path, "(?i)\x5cgit\x5c")
  and not match(process, "(?i)\x5c\?\?\x5cC:\x5cWindows\x5csystem32\x5cconhost\.exe\s+0xffffffff\s+-ForceV1")
  | table _time, host, user, process_*, process, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows Sysmon
references:
- https://amalmurali.me/posts/git-rce/
- https://github.com/amalmurali47/git_rce/tree/main
- https://nvd.nist.gov/vuln/detail/CVE-2024-32002

id: '29278.52976'
title: HTTP_HTTPS Default Security Zone Modified to Local Machine
description: Threat actors may Windows Registry to reconfigure the default Internet
  Zone settings for both HTTP and HTTPS, aligning them with the "My Computer" zone.
  The effectively grants websites the same level of trust as files and applications
  locally stored on your machine. This use case detects modifications to Windows registry
  settings to elevate trust levels for websites, treating them similarly to locally
  stored files.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults"
  (" http " OR " https ") (" /d " OR "-Value" OR "0x00000000") | regex process="(?i)HKCU|HKEY_CURRENT_USER|HKLM|HKEY_LOCAL_MACHINE|HKU"
  | regex process="(?i)\/d\s+0|\-Value\s+0|0x00000000" | table _time, host, user,
  process, process_name, parent_process_name | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- PowerShell logs
references:
- https://twitter.com/JAMESWT_MHT/status/1699042827261391247
- https://attack.mitre.org/techniques/T1112/

name: Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078
id: 66b9c9ba-7fb2-4e80-a3a2-496e5e078167
version: 10
creation_date: '2023-07-31'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |-
    The following analytic detects attempts to exploit CVE-2023-35078, a vulnerability in Ivanti Endpoint Manager Mobile (EPMM) versions up to 11.4.
    It identifies HTTP requests to the endpoint "/mifs/aad/api/v2/authorized/users?*" with a status code of 200 in web logs.
    This activity is significant as it indicates unauthorized remote access to restricted functionalities or resources.
    If confirmed malicious, this could lead to data theft, unauthorized modifications, or further system compromise, necessitating immediate action to mitigate potential severe impacts.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url="*/mifs/aad/api/v2/authorized/users?*"
    Web.status=200

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078_filter`
how_to_implement: |-
    To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products.
known_false_positives: |-
    The Proof of Concept exploit script indicates that status=200 is required for successful exploitation of the vulnerability.
    False positives may be present if status=200 is removed from the search.
    If it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts.
    Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.
references:
    - https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US
    - https://github.com/vchan-in/CVE-2023-35078-Exploit-POC/blob/main/cve_2023_35078_poc.py
finding:
    title: Potential CVE-2023-35078 against an Ivanti EPMM appliance on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ivanti EPMM Remote Unauthenticated Access
asset_type: Web Server
cve:
    - CVE-2023-35078
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: MacOS Account Created
id: 491004ae-694f-453e-b1e0-fc1e65daeea1
version: 4
creation_date: '2026-04-14'
modification_date: '2026-09-01'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity.
    Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network.
    If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where

    (
        Processes.process = "*sysadminctl*"
        Processes.process = "*-addUser*"
    )
    OR
    (
        Processes.process = "*createhomedir*"
        Processes.process = "*-u*"
    )
    OR
    (
        Processes.process = "*dseditgroup*"
        Processes.process IN (
            "*edit*",
            "*-a*"
            )
    )
    OR
    (
        Processes.process = "*dscl*"
        Processes.process = "*-create*"
    )

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user Processes.user_id
       Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_account_created_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Creating new accounts after initial endpoint management should be rare in most environments. Investigate and tune as needed.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://ss64.com/mac/sysadminctl.html
    - https://ss64.com/mac/dseditgroup.html
    - https://ss64.com/mac/dscl.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: New local account created on $dest$ by $user$ via $process$
        - field: dest
          type: system
          score: 20
          message: New local account created on $dest$ by $user$ via $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1136
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS Osascript Displaying Suspicious User Prompt
id: d565ae18-7db6-460c-a2eb-a7109f18bc5e
version: 1
creation_date: '2026-08-03'
modification_date: '2026-08-31'
author: Radka Viskova, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content.
    Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information.
    This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name="osascript"
    Processes.process IN (
        "*display alert*",
        "*display dialog*"
    )
    Processes.process IN (
        "*access System*",
        "*authentication*",
        "*credentials*",
        "*critical update*",
        "*needs your attention*",
        "*password*",
        "*security update*",
        "*system error*",
        "*verify*",
        "*with hidden answer*"
    )

    BY Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_osascript_displaying_suspicious_user_prompt_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity.
references:
    - https://attack.mitre.org/tactics/TA0002/
    - https://attack.mitre.org/tactics/TA0006/
    - https://attack.mitre.org/techniques/T1056/002/
    - https://attack.mitre.org/techniques/T1059/002/
    - https://www.loobins.io/binaries/osascript/
    - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1
    - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/
    - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The osascript utility executed a command containing dialog-related and potentially deceptive content on endpoint [$dest$] with the Command Line [$process$].
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1059.002
    - T1056.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27585.50196'
title: NirCmd Execution
description: 'NirCmd is a command line utility with capabilities to delete files from
  Recycling Bin, delete registry keys, take screenshots and execute command without
  displaying a user interface. While it has legitimate administrative uses, threat
  actors including Mint Sandstorm aka PHOSPHORUS have been observed using renamed
  NirCmd to execute malicious code. This use case detects executions of NirCmd.exe
  or command line argument patterns consistent with abusive activities observed with
  NirCmd, accounting for instances where it has been renamed. Allowlisting is recommended
  for executables using the same command line arguments for best results. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "NirCmd" OR ((" execmd " OR ".exe script " OR ".exe shexec " OR
  " runinteractive " OR " runinteractivecmd " OR " savescreenshot " OR " savescreenshotfull
  " OR "savescreenshotwin " OR " regdelval " OR " regdelkey " OR " regsetval ") OR
  ((" exec " OR " exec2 ") (" show " OR " hide "))) | regex process="(?i)nircmd(\.exe)?|\s(execcmd|runinteractive(cmd)?|savescreenshot(full|win)?|regdel(val|key)|regsetval|exec2?\s+(show|hide))\s|\.exe\s+(script|shexec)")
  | table _time, host, user, process, parent_process_name, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:screen capture
- execution:command and scripting interpreter
- defense-evasion:indicator removal
technique_id: 
- T1113
- T1059
- T1070
data_category:
- PowerShell logs
references:
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
- https://asec.ahnlab.com/ko/45153/
- https://nircmd.nirsoft.net/
- https://www.nirsoft.net/utils/nircmd.html

name: Powershell Disable Security Monitoring
id: c148a894-dd93-11eb-bf2a-acde48001122
version: 17
creation_date: '2021-07-05'
modification_date: '2026-06-08'
author: Michael Haag, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    The following analytic identifies attempts to disable Windows Defender
    real-time behavior monitoring via PowerShell commands. It detects the use of specific
    `Set-MpPreference` parameters that disable various security features. This activity
    is significant as it is commonly used by malware such as RATs, bots, or Trojans
    to evade detection by disabling antivirus protections. If confirmed malicious, this
    action could allow an attacker to operate undetected, leading to potential data
    exfiltration, further system compromise, or persistent access within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    `process_powershell`
    Processes.process="*Set-MpPreference*"
    (
      Processes.process IN (
        "*DisableArchiveScanning*",
        "*DisableBehaviorMonitoring*",
        "*DisableBlockAtFirstSeen*",
        "*DisableCatchupFullScan*",
        "*DisableCatchupQuickScan*",
        "*DisableIOAVProtection*",
        "*DisableRealtimeMonitoring*",
        "*DisableRemovableDriveScanning*",
        "*DisableRestorePoint*",
        "*DisableScanningMappedNetworkDrivesForFullScan*",
        "*DisableScanningNetworkFiles*",
        "*DisableScriptScanning*",
        "*drdsc*",
        "*dsnf *",
        "*drtm *",
        "*dioavp *",
        "*dscrptsc *",
        "*dbaf *",
        "*darchsc *",
        "*dcfsc *",
        "*dbm *"
      )
      Processes.process IN (
        "* $true*",
        "* 1*"
      )
    )
    OR
    (
      Processes.process = "*PUAProtection*"
      Processes.process = "*disable*"
    )
    OR
    (
      Processes.process = "*CloudBlockLevel*"
      Processes.process IN (
        "* $false*",
        "* 0*"
      )
    )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_disable_security_monitoring_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    Limited false positives. However, tune based on scripts that may perform this action.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell
    - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
finding:
    title: Windows Defender Real-time Behavior Monitoring disabled on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ransomware
    - Revil Ransomware
    - CISA AA24-241A
    - BlankGrabber Stealer
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '21901.38725'
title: ProtocolHandler.exe File Download
description: ProtocolHandler.exe is a component of Microsoft Office and is typically
  used for accessing Microsoft Office documents from Outlook and Sharepoint. Adversaries
  can use ProtocolHandler.exe to download files. This use case detects executions
  of ProtocolHandler.exe followed by URLs in the command line. Allowlisting of expected
  Sharepoint domains is recommended to reduce false positives. LOLBINS/LOLBAS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") "ProtocolHandler.exe"
  | regex process="(?i)ProtocolHandler\.exe\"?\s+\"?[A-Za-z0-9]{2,6}:\/\/" | table
  _time, host, user, signature_id, process, process_*, parent_process_path, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- PowerShell logs
references:
- https://pentera.io/blog/the-lol-isnt-so-funny-when-it-bites-you-in-the-bas/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/ProtocolHandler/

id: '39085.70280'
title: RDP File Written by Outlook
description: Remote desktop is a common feature in operating systems. It allows a
  user to log into an interactive session with a system desktop graphical user interface
  on a remote system. Targeted spear-phishing campaigns attributed to Russia’s APT29
  have been observed distributing .rdp files to victims to initiate a remote connection.
  This use case detects the creation of .rdp files in the temporary directory that
  Outlook uses when opening attachments.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
  "<EventID>4663<" OR TERM(EventCode=4656) OR "<EventID>4656<") ".rdp" ("\\AppData\\Local\\Packages\\Microsoft.Outlook_"
  OR ("\\AppData\\Local\\Microsoft\\Windows\\" "\\Content.Outlook\\"))| where match(file_path,
  "(?i)((\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5c.*\x5cContent\.Outlook\x5c)|(\x5cAppData\x5cLocal\x5cPackages\x5cMicrosoft\.Outlook_)).*\.rdp")
  | table _time, host, user, process_*, process, parent_*, file_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:remote desktop protocol
- initial-access:phishing:spearphishing attachment
technique_id:
- T1021.001
- T1566.001
data_category:
- Windows event logs
references:
- https://x.com/cyb3rops/status/1851880158640099675?s=46
- https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
- https://cert.gov.ua/article/6281076
- https://aws.amazon.com/blogs/security/amazon-identified-internet-domains-abused-by-apt29/
- https://github.com/SigmaHQ/sigma/pull/5063/files

id: '18093.30444'
title: Remote .msi Installation
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). The Msiexec.exe binary may
  also be digitally signed by Microsoft. This use case detects attempts to install
  .msi from remote locations. -- Threat Actor Association: APT-K-47/Mysterious Elephant
  -- Atomics T1218.007 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(/i) OR TERM(install)) ".msi") OR (TERM(EventCode=1040)
  OR TERM(EventCode=1042) OR "<EventID>1040<" OR "<EventID>1042<") "://" | where (match(process,
  "(?i)\w+tps?://\S+\.msi") and match(signature_id, "4688")) or (match(message, "(?i)\w+tps?://\S+\.msi")
  and match(signature_id, "1040|1042")) | table _time, host, user process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md#atomic-test-11---msiexecexe---execute-remote-msi-file

name: Schedule Task with Rundll32 Command Trigger
id: 75b00fd8-a0ff-11eb-8b31-acde48001122
version: 12
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks in Windows that use the rundll32 command. It leverages Windows Security EventCode 4698, which logs the creation of scheduled tasks, and filters for tasks executed via rundll32. This activity is significant as it is a common technique used by malware, such as TrickBot, to persist in an environment or deliver additional payloads. If confirmed malicious, this could lead to data theft, ransomware deployment, or other damaging outcomes. Immediate investigation and mitigation are crucial to prevent further compromise.
data_source:
    - Windows Event Log Security 4698
search: |-
    `wineventlog_security` EventCode=4698
      | xmlkv Message
      | search Command IN ("*rundll32*")
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, Task_Name, Command,
           Author, Enabled, Hidden,
           Arguments
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `schedule_task_with_rundll32_command_trigger_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
known_false_positives: No false positives have been identified at this time.
references:
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
finding:
    title: A scheduled task process commandline rundll32 arguments $Arguments$ on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Persistence Techniques
    - Living Off The Land
    - IcedID
    - Scheduled Tasks
    - Compromised Windows Host
    - Trickbot
    - Castle RAT
asset_type: Endpoint
mitre_attack_id:
    - T1053
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '13454.19255'
title: System Owner_User Discovery - Windows
description: 'Adversaries may attempt to identify the primary user, currently logged
  in user, set of users that commonly uses a system, or whether a user is actively
  using the system. Adversaries may use the information during automated discovery
  to direct follow-on behaviors, including whether or not the adversary fully infects
  the target and/or attempts specific actions. This use case detects when reconnaissance
  commands specifically targeting discovery of system owners and users are executed
  in a short period of time. -- Threat Actor Association: Alloy Taurus/Gallium, APT28/Fancy
  Bear, FIN8 - Software Association: Play, Rhysida -- Atomics T1033 Test #1'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("whoami" OR "useraccount" OR "quser" OR "qwinsta.exe" ) | regex process="(?i)(whoami|useraccount|quser|qwinsta)"
  | table _time, host, user process, process_*, parent_process, parent_process_*,
  src_*, dest_* | bin span=60s | stats values(*) as * by _time, host, user | streamstats
  dc(process_name) as dc_process_name by _time, host | where dc_process_name>2 '
techniques:
- discovery:system owner/user discovery
technique_id: 
- T1033
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md#atomic-test-1---system-owneruser-discovery

id: '38988.70115'
title: WFP Filter and Provider Changed
description: Threat actors may abuse Windows Filtering Platform filters to prevent
  EDR agents from reporting security events, as observed with tools like EDRSilencer
  or EDRNoisemaker. This use case detects when a host has events for both WFP provider
  and filter changes within a short time period (default 30s).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5447) OR
  "<EventID>5447<" OR TERM(EventCode=5448) OR "<EventID>5448<") | regex user!="NT\sAUTHORITY|\$$"
  | table _time, host, user, process, process_*, parent_process_name, user, signature_id
  | bin span=30s | stats values(*) as * by _time, host | where match(signature_id,
  "5447") and match(signature_id, "5448") '
techniques:
- defense-evasion:impair defenses
technique_id: 
- T1562
data_category:
- Windows event logs
references:
- https://github.com/netero1010/EDRSilencer
- https://github.com/amjcyber/EDRNoiseMaker
- https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983
- https://www.huntress.com/blog/silencing-the-edr-silencers

name: Windows Anomalous Registry Value Length in Environment Key
id: f5bde743-245a-4e1f-a152-3971cec6e9ef
version: 2
creation_date: '2026-04-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects creation or modification of registry values under a user or system Environment key (paths matching *\Environment\*) where the stored value exceeds 2,000 characters.
    Legitimate environment variables are typically short strings (paths, tokens, or flags); unusually long values can indicate adversaries or malware staging encoded payloads, bloated malicious PATH entries, or other data in a location that is loaded for every interactive session.
    This behavior has been observed in contexts such as .NET infostealer activity. Analysts should validate the writing process, value content, and whether the change aligns with trusted software deployment or administrative tasks.
data_source:
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Registry WHERE

    Registry.action IN ("created", "modified")
    Registry.registry_path= "*\\Environment\\*"
    Registry.registry_value_name != "Path"

    by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive  Registry.registry_key_name  Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product Registry.registry_value_data Registry.registry_path
    | `drop_dm_object_name(Registry)`
    | eval registry_value_data_len = len(registry_value_data)
    | where registry_value_data_len > 2000
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_anomalous_registry_value_length_in_environment_key_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.joesandbox.com/analysis/1817558/0/pdfexecutive
    - https://www.broadcom.com/support/security-center/protection-bulletin/vip-keylogger-spreads-via-multi-org-impersonation-campaign
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.vipkeylogger
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An anomalous registry value length of [$registry_value_data_len$] characters in [$registry_value_data$] was detected on [$dest$].
threat_objects:
    - field: registry_path
      type: registry_path
    - field: registry_value_data
      type: registry_value_text
analytic_story:
    - VIP Keylogger
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows ClipBoard Data via Get-ClipBoard
id: ab73289e-2246-4de0-a14b-67006c72a893
version: 12
creation_date: '2022-12-06'
modification_date: '2026-06-29'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of the PowerShell command 'Get-Clipboard' to retrieve clipboard data.
    It leverages PowerShell Script Block Logging (EventCode 4104) to identify instances where this command is used.
    This activity is significant because it can indicate an attempt to steal sensitive information such as usernames, passwords, or other confidential data copied to the clipboard.
    If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText = "*Get-Clipboard*"
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest signature signature_id
         user_id vendor_product EventID
         Guid Opcode Name
         Path ProcessID ScriptBlockId
         ScriptBlockText
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_clipboard_data_via_get_clipboard_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: It is possible there will be false positives, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1115/
    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Get-Clipboard commandlet to retrieve clipboard data was executed on host $dest$
        - field: user_id
          type: user
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Get-Clipboard commandlet to retrieve clipboard data was executed on host $dest$ by user $user_id$
analytic_story:
    - Windows Post-Exploitation
    - Prestige Ransomware
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1115
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Credential Access From Browser Password Store
id: 72013a8e-5cea-408a-9d51-5585386b4d69
version: 23
creation_date: '2024-03-20'
modification_date: '2026-06-25'
author: Teoderick Contreras, Bhavin Patel Splunk
status: production
type: Anomaly
description: The following analytic identifies a possible non-common browser process accessing its browser user data profile. This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` EventCode=4663 | stats count by _time object_file_path object_file_name dest process_name process_path process_id EventCode | lookup browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed | stats count min(_time) as firstTime max(_time) as lastTime values(object_file_name) values(object_file_path)  values(browser_process_name) as browser_process_name by dest process_name process_path process_id EventCode isAllowed | rex field=process_name "(?<extracted_process_name>[^\\\\]+)$" | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") | where isMalicious=1 and isAllowed="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credential_access_from_browser_password_store_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file.
known_false_positives: The lookup file `browser_app_list` may not contain all the browser applications that are allowed to access the browser user data profiles. Consider updating the lookup files to add allowed object paths for the browser applications that are not included in the lookup file.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger
    - https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/snake-keylogger-malware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A non-common browser process $process_name$ accessing browser user data folder on $dest$
analytic_story:
    - StealC Stealer
    - Salt Typhoon
    - Earth Alux
    - Quasar RAT
    - PXA Stealer
    - SnappyBee
    - Malicious Inno Setup Loader
    - Braodo Stealer
    - MoonPeak
    - Snake Keylogger
    - China-Nexus Threat Activity
    - Meduza Stealer
    - Scattered Spider
    - 0bj3ctivity Stealer
    - Scattered Lapsus$ Hunters
    - BlankGrabber Stealer
    - VIP Keylogger
    - Salat Stealer
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DNS Query Request To TinyUrl
id: b1ea79da-719c-437c-acaf-5c93f838f425
version: 5
creation_date: '2021-11-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl.
    URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
    While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
data_source:
    - Sysmon EventID 22
search: |
    `sysmon`
    EventCode=22
    QueryName = "tinyurl.com"
    Image IN (
      "*\\AppData\\*",
      "*\\Perflogs\\*",
      "*\\ProgramData\\*",
      "*\\Temp\\*",
      "*\\Users\\Public\\*",
      "*\\Windows\\Tasks\\*"
      )
    | stats count min(_time) as firstTime max(_time) as lastTime
      by answer answer_count dvc process_exec process_guid process_name query query_count
         reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_dns_query_request_to_tinyurl_filter`
how_to_implement: |
    This detection relies on sysmon logs with the Event ID 22, DNS Query.
    We suggest you run this detection at least once a day over the last 14 days.
known_false_positives: |
    Noise and false positive can be seen if the following instant
    messaging is allowed to use within corporate network. In this case, a filter is needed.
references:
    - https://x.com/Unit42_Intel/status/1919418143476199869
intermediate_findings:
    entities:
        - field: dvc
          type: system
          score: 20
          message: Suspicious process $process_name$ made a DNS query for $QueryName$ on $dvc$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Error Report Created in ReportQueue Manually
id: c3b33d42-dd28-41bc-8abd-407654a5c9bc
version: 1
creation_date: '2026-08-17'
modification_date: '2026-08-18'
author: Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries.
    Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
    In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
    If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
data_source:
    - Sysmon EventID 11
search: |-
    `sysmon`
    EventCode=11
    action IN ("created","modified")
    file_name="*.wer"
    file_path="*\\ReportQueue\\*"
    NOT process_path IN (
      "*\\svchost.exe",
      "*\\werfault.exe",
      "*\\werfaultsecure.exe",
      "*\\wermgr.exe"
    )
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest file_name file_path file_hash action
         process_name process_path process_id user vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_error_report_created_in_reportqueue_manually_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .wer or containing ReportQueue, since these are commonly excluded by default configurations.
known_false_positives: |-
    Crash-reporting or telemetry agents that integrate with Windows Error Reporting may stage .wer files outside the standard WER binaries. Tune by Image as necessary for your environment.
references:
    - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
    - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet
    - https://isc.sans.edu/diary/22536
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 40
          message: A suspicious process [$process_name$] created a Windows Error Reporting report [$file_path$] on [$dest$]
threat_objects:
    - field: process_name
      type: process_name
    - field: file_path
      type: file_path
analytic_story:
    - RoguePlanet
    - Windows Privilege Escalation
    - Windows Error Reporting Service Elevation of Privilege Vulnerability
asset_type: Endpoint
mitre_attack_id:
    - T1068
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint