Splunk rules: 0i

name: Cisco ASA - Packet Capture Activity
id: 7e9c3f8a-4b2d-4c5e-9a1f-6d8e5b3c2a9f
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM.
    Adversaries may abuse the built-in packet capture functionality to perform network sniffing, intercept credentials transmitted over the network, capture sensitive data in transit, or gather intelligence about network traffic patterns and internal communications. Packet captures can reveal usernames, passwords, session tokens, and confidential business data.
    The detection monitors for command execution events (message ID 111008 or 111010) containing "capture" commands, which are used to initiate packet capture sessions on specific interfaces or for specific traffic patterns on the ASA device.
    Investigate unauthorized packet capture activities, especially captures targeting sensitive interfaces (internal network segments, DMZ), captures configured to capture large volumes of traffic, captures with suspicious filter criteria, captures initiated by non-administrative accounts, or captures during unusual hours.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111008, 111010)
    command IN ("capture *")
    | fillnull
    | stats count
            earliest(_time) as firstTime
            latest(_time) as lastTime
            values(user) as user
            values(action) as action
            values(message_id) as message_id
            values(command) as command
            values(src_ip) as src_ip
            values(process_name) as process_name
      by host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___packet_capture_activity_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
    If your logging level is set to 'notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Admins use packet captures for troubleshooting, performance monitoring, or security investigations. Verify against change management. Filter known admin accounts during maintenance windows.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/ca-cld-commands.html
    - https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: User $user$ executed packet capture command $command$ on Cisco ASA host $host$, potentially for network sniffing activity.
        - field: user
          type: user
          score: 20
          message: User $user$ executed packet capture command $command$ on Cisco ASA host $host$, potentially for network sniffing activity.
threat_objects:
    - field: command
      type: process
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
    - ArcaneDoor
asset_type: Network
mitre_attack_id:
    - T1040
    - T1557
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco Secure Firewall - SSH Connection to sshd_operns
id: 8a9c1d2e-3f4b-5c6d-7e8f-9a0b1c2d3e4f
version: 5
creation_date: '2026-01-12'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects inbound SSH connections to the sshd_operns service on network devices using Cisco Secure Firewall Intrusion Events.
    APT actors have been observed enabling sshd_operns and opening it on non-standard ports to maintain encrypted remote access to compromised network infrastructure.
    This detection leverages Snort signature 65368 to identify connections to this service, which when combined with other indicators may signal persistent access mechanisms established by threat actors.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall`
    EventType=IntrusionEvent
    signature_id=65368
    | fillnull
    | stats dc(signature_id) as unique_signature_count
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(src) as src
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
            by dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___ssh_connection_to_sshd_operns_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: |
    No false positives have been identified yet.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Inbound SSH connection to sshd_operns detected from $src$ to network device $dest$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1021.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '32841.62130'
title: Disabled Pre-Authentication Accounts Discovery - PowerShell
description: With the appropriate parameters, PowerShell cmdlets such as Get-ADUser
  or PowerView cmdlets including Get-DomainUser allow threat actors to discover domain
  accounts with Kerberos Pre-Authentication disabled, enabling them to target accounts
  vulnerable to Kerberos attacks such as AS-REP roasting. This use case detects PowerShell
  commands with parameters targeting accounts with Pre-Authentication disabled. PowerShell
  script block logging is recommended for best detection results. Detection using
  other log sources requires the PowerShell command to be run in a manner that creates
  a new process, such as powershell -command.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=4688) OR "<EventID>4688<"
  OR Type=Process) ("Get-ADUser" ("4194304" OR "DoesNotRequirePreAuth")) OR ("Get-DomainUser"
  "PreauthNotRequired") OR "DONT_REQ_PREAUTH" | table _time, host, user process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:external remote services
- discovery:account discovery
technique_id: 
- T1133
- T1087
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://research.splunk.com/endpoint/114c6bfe-9406-11ec-bcce-acde48001122/
- https://attack.mitre.org/techniques/T1558/004/
- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/

name: ETW Registry Disabled
id: 8ed523ac-276b-11ec-ac39-acde48001122
version: 18
creation_date: '2021-10-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a registry modification that disables the ETW for the .NET Framework. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the ETWEnabled registry value under the .NETFramework path. This activity is significant because disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs. If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `etw_registry_disabled_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
    - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/
finding:
    title: Modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Hermetic Wiper
    - Windows Persistence Techniques
    - Windows Privilege Escalation
    - Windows Registry Abuse
    - CISA AA23-347A
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1127
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '16818.26804'
title: File and Directory Discovery Output to File - Windows
description: 'Adversaries may enumerate files and directories or may search in specific
  locations of a host or network share for certain information within a file system.
  Adversaries may use the information from File and Directory Discovery during automated
  discovery to shape follow-on behaviors, including whether or not the adversary fully
  infects the target and/or attempts specific actions. -- Threat Actor Association:
  APT28 (aka. Fancy Bear, Forest Blizzard, Strontium, Tsar Team) -- Atomics T1083
  Test #1 Atomics T1083 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(tree) OR TERM(dir) OR TERM(Get-ChildItem)
  OR TERM(gci) OR TERM(ls) OR TERM(locate) OR TERM(find)) (TERM(>>) OR "&gt;&gt;"
  OR TERM(Out-File)) | table _time, host, user process, process_*, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:file and directory discovery
technique_id: 
- T1083
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1083/T1083.md#atomic-test-1---file-and-directory-discovery-cmdexe

name: GitHub Enterprise Delete Branch Ruleset
id: 6169ea23-3719-439f-957a-0ea5174b70e2
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when branch rules are deleted in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for branch rule deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rules is critical as it could indicate attempts to bypass code review requirements and security controls. Branch deletion rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
data_source:
    - GitHub Enterprise Audit Logs
search: |-
    `github_enterprise` action=repository_ruleset.destroy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_ip,
           actor_is_bot, actor_location.country_code, business,
           business_id, org, org_id,
           repo, repo_id, user_agent,
           action, ruleset_name
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_enterprise_delete_branch_ruleset_filter`
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
    - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ deleted a branch ruleset in repo $repo$
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1685
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '30750.54909'
title: Live Sysinternals Execution
description: Sysinternals utilities are a suite of advanced system utilities aimed
  at managing, troubleshooting, and diagnosing Windows systems and applications. The
  live version of Sysinternals, available from https://live.sysinternals.com, enables
  users to run the tools without having to first download and install them locally.
  Threat actors may leverage these tools for system reconnaissance, privilege escalation,
  or to facilitate lateral movement within a network. This use case detects command
  line invocations of live.sysinternals.com, indicating potential attempts to execute
  Sysinternals tools without installation.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "live.sysinternals.com" | regex process="(?i)live\.sysinternals\.com" | table _time,
  host, user, process, parent_process_name | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://live.sysinternals.com/
- https://learn.microsoft.com/en-us/sysinternals/

name: MacOS - Re-opened Applications
id: 40bb64f9-f619-4e3d-8732-328d40377c4b
version: 8
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Jamie Windley, Splunk
status: experimental
type: TTP
description: The following analytic identifies processes referencing plist files that determine which applications are re-opened when a user reboots their MacOS machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes related to "com.apple.loginwindow." This activity is significant because it can indicate attempts to persist across reboots, a common tactic used by attackers to maintain access. If confirmed malicious, this could allow an attacker to execute code or maintain persistence on the affected system, potentially leading to further compromise.
data_source:
    - Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*com.apple.loginwindow*"
      BY Processes.user Processes.process_name Processes.parent_process_name
         Processes.dest
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos___re_opened_applications_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: At this stage, there are no known false positives. During testing, no process events referring the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be assumed that any occurrences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list.
references: []
finding:
    title: Possible persistence mechanism via plists on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Possible persistence mechanism via plists on $dest$
analytic_story:
    - ColdRoot MacOS RAT
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: threat

id: '15967.23907'
title: PowerShell Modifying Registry Values
description: 'Adversaries may interact with the Windows Registry to hide configuration
  information within Registry keys, remove information as part of cleaning up, or
  as part of other techniques to aid in persistence and execution. This use case detects
  PowerShell commands accessing or modifying the Current User or Local Machine registry
  hives. -- Threat Actor Association: CL-STA-0043 -- Atomics T1059.001 Test #11 Atomics
  T1546.008 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(Invoke-Expression) OR "IEX") ("HKLM" OR "HKEY_LOCAL_MACHINE" OR "HKCU" OR
  "HKEY_CURRENT_USER") | table _time, host, user process, process_*, signature_id
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- execution:command and scripting interpreter:powershell
technique_id:
- T1112
- T1059.001
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-11---powershell-fileless-script-execution

name: Powershell Windows Defender Exclusion Commands
id: 907ac95c-4dd9-11ec-ba2c-acde48001122
version: 17
creation_date: '2021-11-25'
modification_date: '2026-06-29'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions.
    It leverages EventCode 4104 to identify suspicious `Add-MpPreference` or `Set-MpPreference` commands with exclusion parameters.
    This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute without detection.
    If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText IN (
        "*Add-MpPreference *",
        "*Set-MpPreference *"
    )
    ScriptBlockText = "*-exclusion*"
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest signature signature_id
         user_id vendor_product EventID
         Guid Opcode Name
         Path ProcessID ScriptBlockId
         ScriptBlockText
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_windows_defender_exclusion_commands_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: admin or user may choose to use this windows features.
references:
    - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
    - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing exclusion commands to add or set Windows Defender exclusions was executed on host $dest$
        - field: user_id
          type: user
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing exclusion commands to add or set Windows Defender exclusions was executed on host $dest$ by user $user_id$
analytic_story:
    - CISA AA22-320A
    - AgentTesla
    - Remcos
    - Windows Defense Evasion Tactics
    - Data Destruction
    - WhisperGate
    - Warzone RAT
    - NetSupport RMM Tool Abuse
    - BlankGrabber Stealer
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: PTC Windchill GW READY OK Probe
id: 2f37ab99-5eae-44c4-a6bc-15b6d9787a3d
version: 1
creation_date: '2026-06-14'
modification_date: '2026-06-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects Windchill MethodServer log4j events that contain the CVE-2026-4681 exploitation probe `run?c=echo%20GW_READY_OK`.
    PTC identifies `GW_READY_OK` and related `run?c=` activity as log indicators associated with Windchill and FlexPLM exploitation.
    This behavior is significant because attackers use the probe to confirm that a staged gateway component is reachable before sending operating system commands through the same `c=` parameter.
data_source:
    - Windchill Log4j
search: |-
    `windchill_log4j`
    ("GW_READY_OK" OR "run?c=echo%20GW_READY_OK" OR "c=echo%20GW_READY_OK")
    | rex field=_raw "^(?:[^:\r\n]+:)?(?<log_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2},\d{3})\s+(?<log_level>\w+)\s+\[(?<thread>[^\]]+)\]\s+(?<logger>\S+)\s+-\s+(?<payload>.*)$"
    | search logger IN ("wt.servlet.ServletRequestMonitor.request", "wt.method.MethodContextMonitor.contexts.servletRequest")
    | rex field=payload "^(?<event_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d{3})\s+(?<event_tz>[+\-]\d{4}),\s+(?<rest>.*)$"
    | eval parts=split(rest,", ")
    | eval event_type=case(logger="wt.servlet.ServletRequestMonitor.request","servlet_request",logger="wt.method.MethodContextMonitor.contexts.servletRequest","method_context_servlet_request",true(),"other")
    | eval src_ip=case(event_type="servlet_request",mvindex(parts,2),event_type="method_context_servlet_request",mvindex(parts,5))
    | eval uri_path=case(event_type="servlet_request",mvindex(parts,3),event_type="method_context_servlet_request",mvindex(parts,8))
    | eval query_string=if(event_type="servlet_request",mvindex(parts,4),null())
    | eval http_method=if(event_type="servlet_request",mvindex(parts,5),null())
    | eval status=if(event_type="servlet_request",tonumber(mvindex(parts,6)),null())
    | rex field=uri_path "^(?<uri_only>[^\?]+)(?:\?(?<uri_query>.*))?$"
    | eval query_string=if(query_string="-",null(),query_string)
    | eval query_string=coalesce(query_string,uri_query)
    | rex field=query_string "(?i)(?:^|&)(?<query_param>[cp])=(?<query_value>[^&]*)"
    | eval query_param=lower(query_param), query_value=urldecode(replace(query_value,"\+","%20"))
    | where query_param="c" AND match(query_value,"(?i)^echo(\s|20)+GW_READY_OK$")
    | eval src=src_ip, activity="gw_ready_ok_probe"

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(log_level) as log_level
                  values(logger) as logger
                  values(http_method) as http_method
                  values(status) as status
                  values(uri_only) as uri_path
                  values(query_string) as query_string
      by src activity query_param query_value

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ptc_windchill_gw_ready_ok_probe_filter`
how_to_implement: |
    To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`.
    Update the `windchill_log4j` macro to include the appropriate index constraints for your environment.
    The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers.
known_false_positives: |
    This probe string is specific to the PTC-published Windchill exploitation indicators. False positives should be rare. Validate whether any internal testing, incident response activity, or vendor diagnostics intentionally generated `GW_READY_OK` requests.
references:
    - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4681
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-03
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: PTC Windchill GW READY OK exploitation probe detected from $src$.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - PTC Windchill Exploitation
asset_type: Web Application
cve:
    - CVE-2026-4681
mitre_attack_id:
    - T1190
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '6447.7207'
title: Rare dll called by Spoolsv.exe
description: 'Spooler service has been known to have several vulnerabilities most
  recently CVE-2021-1675 AKA Print Nightmare and CVE-2021-34527. This use case looks
  for rare dll calls from spoolsv.exe. NOTE file auditing on C:\Windows\System32\spool\drivers
  must be enabled and Windows global object access policy may need to be configured
  to capture 4663 events. -- Threat Actor Association: Vice Society - Software Association:
  Black Basta, Lockbit, Play, Ransom Cartel, Vice Society'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
  "<EventID>4663<") TERM("C:\\Windows\\System32\\spool\\drivers\\*") TERM("C:\\Windows\\System32\\spoolsv.exe")
  "dll" | eval file_path=Object_Name| rex max_match=0 "(?<driver>\S+\.dll)" | rex
  field=driver "\\\(?<file_name>[^\\\]+\.dll)"| fields _time, host, user, signature_id,
  process, process_*, parent_*, signature, file_path, parameters, file_name `group_events("host,
  process_name, file_name", 5)` | eventstats c(file_name) as c_file_name dc(host)
  as dc_host by file_name | where c_file_name <= 5 AND dc_host=1 '
techniques:
- persistence:boot or logon autostart execution
- persistence:boot or logon autostart execution:port monitors
- privilege-escalation:boot or logon autostart execution:port monitors
technique_id:
- T1547
- T1547.010
data_category:
- Windows event logs
references:
- https://github.com/calebstewart/CVE-2021-1675
- https://github.com/afwu/PrintNightmare
- https://github.com/JohnHammond/CVE-2021-34527
- https://docs.microsoft.com/en-us/windows-server/identity/solution-guides/deploy-security-auditing-with-central-audit-policies--demonstration-steps-

id: '6357.7092'
title: Rclone Execution
description: 'Rclone is a command line program to manage files on cloud storage. It
  is a feature rich alternative to cloud vendors'' web storage interfaces. Adversaries
  have been known to use rclone in order to exfiltrate data. -- Threat Actor Association:
  ALPHV/BlackCat, BlackMatter, DarkSide, Daixin Team, FIN7, FIN8 (Syssphinx), Hello
  Kitty / Five Hands, Karakurt, LockBit, Scattered Spider (aka. 0ktapus, UNC3944),
  Turla (akaSecret Blizzard, KRYPTON, and UAC-0003), UNC2628, Wizard Spider - Software
  Association: Akira, AvosLocker, BazarLoader, BianLian, Blackbyte, Blackcat/ALPHV,
  Black Basta, Conti, Lockbit, Ransom Cartel, Royal, Vice Society'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=execve OR type=proctitle
  OR sourcetype=bash_history) TERM(rclone) | table _time, host, user process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over web service:exfiltration to cloud storage
- exfiltration:data transfer size limits
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1567.002
- T1030
- T1048.003
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://rclone.org/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkside-ransomware-victims-sold-short/
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- https://unit42.paloaltonetworks.com/royal-ransomware/

id: '5367.5471'
title: Service Stop Commands
description: 'Adversaries may stop or disable services on a system to render those
  services unavailable to legitimate users. Stopping critical services can inhibit
  or stop response to an incident or aid in the adversary''s overall objectives to
  cause damage to the environment. Threat Actor Association: APT29/Nobelium/Cozy Bear,
  FIN6, Kimsuky, Lapsus$, Lazarus, TA2541, Traveling Spider - Software Association:
  BlackByte, Blackcat/ALPHV, Black Basta, Conti, Cring, Cuba, GhostShell, Lockbit,
  Nefilim, Prometheus / Spook, Ryuk, TeamTNT, WatchDog, WhisperGate, XingLocker --
  Atomics T1489 #Test1 Atomics T1489 #Test2 Atomics T1489 #Test3 -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` signature_id=4104 AND ((TERM(sc.exe)
  OR TERM(sc) OR TERM(net) OR TERM(net.exe) ) AND TERM(stop) AND (TERM(ShellHWDetection)
  OR TERM(AVPSUS) OR TERM(McAfeeDLPAgentService) OR TERM(mfewc) OR TERM(eventlog)
  OR (TERM(BMR) AND TERM(SERVICE))) OR ( TERM(taskkill) AND ( TERM(/IM) OR TERM(/PID)
  OR TERM(/T) ) AND TERM(/F)) OR ((TERM(sc.exe) OR TERM(sc)) AND TERM(CONFIG) AND
  TERM(START=) AND TERM(DISABLED))) | rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock
  ID.+)|^(Creating Scriptblock.+)//g"| rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"|
  table _time, host, user event_id, parent_process, parent_process_id, parent_process_name,
  parent_process_path, process, process_id, process_name, process_path, signature_id,
  user_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lockergoga-ransomware-family-used-in-targeted-attacks/
- https://kcm.trellix.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/91000/KB91373/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20LockerGoga.pdf

name: VMware Workspace ONE Freemarker Server-side Template Injection
id: 9e5726fe-8fde-460e-bd74-cddcf6c86113
version: 10
creation_date: '2022-05-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects server-side template injection attempts related to CVE-2022-22954 in VMware Workspace ONE.
    It leverages web or proxy logs to identify HTTP GET requests to the endpoint catalog-portal/ui/oauth/verify with the freemarker.template.utility.Execute command.
    This activity is significant as it indicates potential exploitation attempts that could lead to remote code execution.
    If confirmed malicious, an attacker could execute arbitrary commands on the server, leading to full system compromise, data exfiltration, or further lateral movement within the network.
data_source:
    - Palo Alto Network Threat
search: |-
    | tstats `security_content_summariesonly`
             count min(_time) as firstTime
                   max(_time) as lastTime

    FROM datamodel=Web WHERE
    Web.http_method="GET"
    Web.url="*/catalog-portal/ui/oauth/verify?error=&deviceudid=*"
    Web.url="*freemarker.template.utility.Execute*"
    BY Web.http_user_agent Web.http_method
       Web.url Web.url_length
       Web.src Web.dest sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `vmware_workspace_one_freemarker_server_side_template_injection_filter`
how_to_implement: |
    To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
known_false_positives: |
    False positives may be present if the activity is blocked or was not successful.
    Filter known vulnerability scanners. Filter as needed.
references:
    - https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
    - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb
    - https://github.com/sherlocksecurity/VMware-CVE-2022-22954
    - https://www.vmware.com/security/advisories/VMSA-2022-0011.html
    - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred.
analytic_story:
    - VMware Server Side Injection and Privilege Escalation
asset_type: Web Server
cve:
    - CVE-2022-22954
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Windows AdFind Exe
id: bd3b0187-189b-46c0-be45-f52da2bae67f
version: 14
creation_date: '2020-12-17'
modification_date: '2026-05-13'
author: Jose Hernandez, Bhavin Patel, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of `adfind.exe` standalone or with specific command-line arguments related to Active Directory queries. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent Processes. This activity is significant because `adfind.exe` is a powerful tool often used by threat actors like Wizard Spider and FIN6 to gather sensitive AD information. If confirmed malicious, this activity could allow attackers to map the AD environment, facilitating further attacks such as privilege escalation or lateral movement.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where

    (
      Processes.process_name = "AdFind.exe"
      OR
      Processes.original_file_name = "AdFind.exe"
    )
    OR
    (
      Processes.process IN ("* -f *", "* /f*")
      Processes.process = "*objectcategory=*"
    )
    OR
    (
      Processes.process IN ("* -sc *", "* /sc *")
      Processes.process IN ("* -gcb *", "* /gcb *")
    )
    OR
    (
      Processes.process IN ("* -sc *", "* /sc *")
      Processes.process IN (
            "* trustdmp*",
            "* dclist*",
            "* dcdmp*",
            "* adobjcnt*",
            "* adamobjcnt*",
            "* sdump*",
            "* exchaddresses*",
            "* getacl*",
            "* domainlist*",
            "* export_user*",
            "* export_group*",
            "* admincountdmp*"
      )
    )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_adfind_exe_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro.
references:
    - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
    - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption
    - https://www.joeware.net/freetools/tools/adfind/index.htm
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
finding:
    title: $user$ spawned $process$ indicative of Active Directory discovery on machine - [$dest$]
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Domain Trust Discovery
    - IcedID
    - NOBELIUM Group
    - Graceful Wipe Out Attack
    - BlackSuit Ransomware
asset_type: Endpoint
atomic_guid:
    - 736b4f53-f400-4c22-855d-1a6b5a551600
    - b95fd967-4e62-4109-b48d-265edfd28c3a
    - e1ec8d20-509a-4b9a-b820-06c9b2da8eb7
    - 5e2938fb-f919-47b6-8b29-2f6a1f718e99
    - abf00f6c-9983-4d9a-afbc-6b1c6c6448e1
    - 51a98f96-0269-4e09-a10f-e307779a8b05
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DLL Search Order Hijacking with iscsicpl
id: f39ee679-3b1e-4f47-841c-5c3c580acda2
version: 13
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects DLL search order hijacking involving iscsicpl.exe. It identifies when iscsicpl.exe loads a malicious DLL from a new path, triggering the payload execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on child processes spawned by iscsicpl.exe. This activity is significant as it indicates a potential attempt to execute unauthorized code via DLL hijacking. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=iscsicpl.exe `windows_shells`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_dll_search_order_hijacking_with_iscsicpl_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filtering may be required. Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe.
references:
    - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
    - https://github.com/422926799/csplugin/tree/master/bypassUAC
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to elevate access.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to elevate access.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Living Off The Land
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows File Share Discovery With Powerview
id: a44c0be1-d7ab-41e4-92fd-aa9af4fe232c
version: 11
creation_date: '2023-03-21'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the Invoke-ShareFinder PowerShell cmdlet from PowerView. This detection leverages PowerShell Script Block Logging to identify instances where this specific command is executed. Monitoring this activity is crucial as it indicates an attempt to enumerate network file shares, which may contain sensitive information such as backups, scripts, and credentials. If confirmed malicious, this activity could enable an attacker to escalate privileges or move laterally within the network, potentially compromising additional systems and sensitive data.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104  (ScriptBlockText=Invoke-ShareFinder*)
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_file_share_discovery_with_powerview_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
known_false_positives: Security teams may leverage PowerView proactively to identify and remediate sensitive file shares. Filter as needed.
references:
    - https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1
    - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
    - https://attack.mitre.org/techniques/T1135/
finding:
    title: Invoke-ShareFinder commandlet was executed on $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Invoke-ShareFinder commandlet was executed on $dest$
analytic_story:
    - Active Directory Privilege Escalation
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1135
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Mustang Panda USB Tool Execution
id: e66a167f-6506-4e5b-8e4d-1b04940c70be
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects known executables used for infection or DLL side loading by Mustang Panda being launched from a non-C:\ location.
    This can indicate a compromise via USB, or external storage device.
    You will have to adapt this detection if you do not use C:\ as the root device.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    NOT Processes.process_path="C:\\*"
    Processes.process_path IN (
        "*atkexComSvcRes.exe",
        "*AtlTraceTool8.exe",
        "*browser.ex",
        "*CefSub.exe",
        "*dabs.ex",
        "*FacialFeatureDemo.exe",
        "*GoogleUpdate*.exe",
        "*GUP.exe",
        "*HPCustParticUI.exe",
        "*install_.exe",
        "*mcsync.ex",
        "*melt_64.exe",
        "*mscorsvw.exe",
        "*OleView.exe",
        "*piz.exe",
        "*PlugInInstallerUtility2.exe",
        "*rar330.exe",
        "*Samvd.exe",
        "*scx.exe",
        "*spoololk.exe",
        "*Symantec.exe",
        "*SymantecHp.exe",
        "*Symantecs.exe",
        "*Symantecsy.exe",
        "*upservice.exe",
        "*vivaldi.exe",
        "*wsc_proxy.exe",
        "*ygfdt.exe"
    )

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_mustang_panda_usb_tool_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate tools may be run from external drives or non-C:\ locations for maintenance or portability. Adjust filters accordingly to avoid false alerts for approved usage scenarios.
references:
    - https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
finding:
    title: Mustang Panda-associated USB tool execution observed on $dest$ via $process$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
    - T1204.002
    - T1020
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint