Splunk rules: 0j

name: AWS SAML Update identity provider
id: 2f0604c6-6030-11eb-ae93-0242ac130002
version: 12
creation_date: '2021-01-26'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: TTP
description: The following analytic detects updates to the SAML provider in AWS. It leverages AWS CloudTrail logs to identify the `UpdateSAMLProvider` event, analyzing fields such as `sAMLProviderArn`, `sourceIPAddress`, and `userIdentity` details. Monitoring updates to the SAML provider is crucial as it may indicate a perimeter compromise of federated credentials or unauthorized backdoor access set by an attacker. If confirmed malicious, this activity could allow attackers to manipulate identity federation, potentially leading to unauthorized access to cloud resources and sensitive data.
data_source:
    - AWS CloudTrail UpdateSAMLProvider
search: |-
    `cloudtrail` eventName=UpdateSAMLProvider
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.sAMLProviderArn) as request_parameters
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_saml_update_identity_provider_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.
references:
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
    - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
    - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
    - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
finding:
    title: User $user$ from IP address $src$ has trigged an event $signature$ to update the SAML provider to $request_parameters$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Cloud Federated Credential Abuse
asset_type: AWS Federated Account
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '33144.58803'
title: Bash -c Execution - Windows
description: Bash is a popular default shell on Linux and macOS. Git Bash is a package
  that installs Bash, some common bash utilities, and Git on a Windows operating system.
  Bash is also included with Windows Subsystem for Linux. Bash is on the Microsoft
  recommended block list for executable files. This use case detects executions of
  bash.exe with -c.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "bash.exe" | regex process_name="(?i)bash\.exe"| regex process="(?i)\s+-[ilsx]*c[ilsx]*"
  | table _time, host, user, signature_id, process, process_*, parent_process_* |
  bin span=1s | stats values(*) as * by _time, host | where event_count < 5 '
techniques:
- defense-evasion:system binary proxy execution
- defense-evasion:system script proxy execution
technique_id: 
- T1218
- T1216
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Bash/

name: Cisco Duo Policy Allow Old Flash
id: f36c0d3f-d57f-4b88-a5d4-0a4c9a0752f6
version: 6
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic identifies instances where a Duo administrator creates or updates a policy to allow the use of outdated Flash components, specifically by detecting policy changes with the flash_remediation=no remediation attribute. It leverages Duo activity logs ingested via the Cisco Security Cloud App, searching for policy_update or policy_create actions and parsing the policy description for indicators of weakened security controls. This behavior is significant for a SOC because permitting old Flash increases the attack surface, as Flash is widely known for its security vulnerabilities and is no longer supported. Attackers may exploit such policy changes to bypass security controls, introduce malware, or escalate privileges within the environment. Detecting and responding to these policy modifications helps prevent potential exploitation, reduces organizational risk, and ensures adherence to security best practices. Immediate investigation is recommended to determine if the change was authorized or indicative of malicious activity.
data_source:
    - Cisco Duo Administrator
search: |-
    `cisco_duo_administrator` action=policy_update OR action=policy_create
    | spath input=description
    | search flash_remediation="no remediation"
    | rename object as user
    | stats count min(_time) as firstTime max(_time) as lastTime
      BY action actionlabel description
         user admin_email
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_duo_policy_allow_old_flash_filter`
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A policy has been created or updated to allow old flash by user $user$ with email $admin_email$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

id: '5463.5687'
title: ' comsvcs.dll Lsass Memory Dump'
description: 'Credential dumping within the lsass memory using Windows built-in comsvcs.dll
  file. When System32 crashes this DLL contains a function called minidumpw which
  dumps the lsass memory. This does not require additional tools like Mimikatz and
  Procdump in order to perform the lsass dump. -- Threat Actor Association: APT27,
  APT35/Phosphorus/Magic Hound, BlackCat, Lancefly, Lazarus, Volt Typhoon, Witchetty,
  Wizard Spider - Software Association: Akira, Conti, HermeticWiper/Trojan.Killdisk,
  Prestige, PYSA/Mespinoza, Vice Society - Atomics T1003 Test #3 Atomics T1003.001
  Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ("rundll32.exe"
  OR "rundll32") ("comsvcs.dll" OR "comsvcs") ("dmp" OR "MiniDump" OR "DumpProc" OR
  "lsass.exe" OR "lsass" OR "#24") | table _time, host, user signature_id, user, process_id,
  process_name, process_path, process, parent_process_id, parent_process_name, parent_process_path,
  parent_process | bin span=1s | stats values(*) as * by _time, host, process '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows Sysmon
references:
- https://en.hackndo.com/remote-lsass-dump-passwords/#manual-method--procdump

name: Linux Auditd Find Ssh Private Keys
id: e2d2bd10-dcd1-4b2f-8a76-0198eab32ba5
version: 11
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command IN ("*find*", "*grep*") AND execve_command IN ("*id_rsa*", "*id_dsa*", "*.key*", "*ssh_key*", "*authorized_keys*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_find_ssh_private_keys_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
    - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$execve_command$] event occurred on host - [$dest$] to find SSH private keys.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1552.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS Data Chunking
id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc
version: 4
creation_date: '2026-04-14'
modification_date: '2026-09-01'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts.
    Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data.
    By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        Processes.process IN ("*/dd *", "dd *")
         Processes.process = "* if=*"
    )
    OR
    (
        Processes.process = "*split *"
        Processes.process="* -b *"
    )

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_data_chunking_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://ss64.com/mac/dd.html
    - https://ss64.com/mac/split.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A file was split on $dest$ by $user$ via $process$
        - field: dest
          type: system
          score: 20
          message: A file was split on $dest$ by $user$ via $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1030
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 ApplicationImpersonation Role Assigned
id: 49cdce75-f814-4d56-a7a4-c64ec3a481f2
version: 11
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of the ApplicationImpersonation role in Office 365 to a user or application. It uses the Office 365 Management Activity API to monitor Azure Active Directory audit logs for role assignment events. This activity is significant because the ApplicationImpersonation role allows impersonation of any user, enabling access to and modification of their mailbox. If confirmed malicious, an attacker could gain unauthorized access to sensitive information, manipulate mailbox data, and perform actions as a legitimate user, posing a severe security risk to the organization.
data_source:
    - O365
search: |-
    `o365_management_activity` Workload=Exchange Operation="New-ManagementRoleAssignment" Role=ApplicationImpersonation
      | rename User as target_user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
           target_user
      | `security_content_ctime(lastTime)`
      | `o365_applicationimpersonation_role_assigned_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: While infrequent, the ApplicationImpersonation role may be granted for leigimate reasons, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/002/
    - https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452
    - https://www.mandiant.com/media/17656
finding:
    title: $user$ granted the ApplicationImpersonation role to $target_user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: target_user
          type: user
          score: 50
          message: $user$ granted the ApplicationImpersonation role to $target_user$
analytic_story:
    - Office 365 Persistence Mechanisms
    - Office 365 Collection Techniques
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '43757.85555'
title: Security Software Discovery via Findstr.exe
description: Threat actors may enumerate security software, configurations, and monitoring
  tools on a system or cloud environment to evade defenses or tailor their attack.
  This can involve querying registry keys, running system commands, or checking for
  specific processes related to security tools. This use case detects instances where
  findstr.exe or find.exe are executed to search for security software on the host.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("findstr.exe" OR TERM(findstr) OR "find.exe"
  OR TERM(find)) ("avira" OR "cb" OR "cylance" OR "defender" OR "kaspersky" OR "kes"
  OR "mc" OR "sec" OR "sentinel" OR "symantec" OR "virus" OR "wrsa" OR "opssvc" OR
  "avastui" OR "avgui" OR "bdservicehost" OR "nsWscSvc" OR "ekrn" OR "sophoshealth"
  OR "falcon") | where match(process_path, "(?i)\x5cWindows\x5cSystem32\x5cfindstr\.exe|\x5cWindows\x5cSysWOW64\x5cfind\.exe")
  and match(process, "(?i)\w+(\.exe)?\x22?\s+(avira|cb|cylance|defender|kaspersky|kes|mc|sec|sentinel|symantec|virus|wrsa|opssvc|avastui|avgui|bdservicehost|nsWscSvc|ekrn|sophoshealth|falcon)\x22?$")
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:software discovery:security software discovery
technique_id:
- T1518.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1518/001/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/findstr
- https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/

name: Splunk Secure Application Alerts for Runtime Security
id: 37365336-e8af-42b1-b9d5-a5183d7b7e73
version: 1
creation_date: '2026-06-12'
modification_date: '2026-06-12'
author: Ryan Long, Bhavin Patel, Bryan Pluta, Splunk
status: experimental
type: Anomaly
description: |
    The following analytic leverages alerts from Splunk Secure Application, which identifies and monitors exploit attempts targeting business applications. Attacks observed include exploiting vulnerabilities in web applications, such as injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution, LOG4J, and zero-day attacks. These events are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality.

    Splunk Secure Application provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by:

    * Identifying active exploitation attempts in real-time, allowing for quicker incident response.
    * Categorizing attack severity to prioritize remediation efforts based on risk level.
    * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications.
    * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows.
    * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability.

    By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.
data_source: []
search: |-
    `secureapp_attack`
    | rename attackEvents{}.* AS *, detailJson.* AS *, vulnerabilityInfo.* AS *
    | fields - tag::eventtype, eventtype, host, id, index, linecount, punct, source, sourcetype, splunk_server, tag, SourceType, app, clientAddressType, "attackEvents{}.* status"
    | eval socketOut=mvjoin(socketOut," AND ")
    | eval risk_score=kennaScore
    | fillnull risk_score value="0"
    `secureapp_es_field_mappings`
    | dedup gid
    | eval severity=case(
        risk_score>=75 OR signature="LOG4J", "critical",
        risk_score>50 AND risk_score<75, "high",
        risk_score=0 AND attackOutcome="EXPLOITED", "high",
        risk_score<=50 AND attackOutcome!="OBSERVED", "medium",
        risk_score=0 AND attackOutcome="ATTEMPTED", "medium",
        risk_score=0, "low",
        risk_score=0 AND attackOutcome="OBSERVED", "low"
    )
    | eval rule_description=case(
        attacktypecount>1, mvjoin(mvappend("Multiple different attack types have been seen against the application", mvdedup(app), "This includes", mvdedup(signature), "attacks. Review the", mvdedup(dest_nt_host), "server for signs of exploitation"), " "),
        (signature="API" OR signature="LOG4J" OR signature="SSRF"), "An attempt to exploit a ".signature." vulnerability was made from a ".src_category." IP address ".src_ip.". The server ".dest_nt_host." hosting application ".app." was accessed, and data may have been exfiltrated to ".ip.".",
        (signature="SQL"), "IP address ".src_ip." has attempted a SQL injection via ".src_category.". The server ".dest_nt_host." hosting application ".app." may have executed this SQL statement and should be reviewed.",
        (signature="DESEREAL"), "The application ".app." deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Data which is untrusted cannot be trusted to be well-formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized.",
        (signature="RCE"),  "An attacker tried to perform Remote Code Execution by running the command ".command." in the ".file_path." directory. The server ".dest_nt_host." hosting application ".app."  ".action." this command."
    )
    | `splunk_secure_application_alerts_for_runtime_security_filter`
how_to_implement: |
    Create the secureapp_attack sourcetype in Splunk Enterprise Security. Configure Splunk Enterprise Security to receive alerts for Observability Cloud via HEC. Configure Secure Application Alerts in Observability Cloud to send alerts to Enterprise Security. Full details can be found in the referenced lantern article.
known_false_positives: |
    No known false positives for this detection. If alerts are noisy, tune this detection with the `_filter` macro or configure the originating tool.
references:
    - https://lantern.splunk.com/@go/page/10379
    - https://help.splunk.com/en/splunk-observability-cloud/monitor-application-security/set-up-secure-application/step-1-set-up-notifications-for-vulnerabilities
intermediate_findings:
    entities:
        - field: dest_ip
          type: system
          score: 20
          message: $rule_description$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Critical Alerts
asset_type: Web Application
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: threat

id: '6176.6729'
title: Suspicious DLLhost Execution
description: 'Used by Windows to DLL Surrogate COM Objects, “dllhost.exe” process
  has been used by malware in the past (especially trickbot) and can be used to load
  a registered or hijacked COM Server payload. -- Living Off the Land Binary and Scripts
  (LOLBAS) (LOLBIN) -- Threat Actor Association: APT29, Wizard Spider - Software Association:
  Avaddon, Bazarloader, Blackcat/ALPHV, Conti, Quantum'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(dllhost) OR "dllhost.exe") | table _time,
  host, user, signature_id, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host | eventstats c(process) as c_process by process |
  where c_process < 6 AND match(process_name,"(?i)dllhost") '
techniques:
- privilege-escalation:event triggered execution:component object model hijacking
- persistence:event triggered execution:component object model hijacking
technique_id:
- T1546.015
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/Binaries/Dllhost/
- https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08

id: '35215.61888'
title: Unusual AppCert Child Process
description: Threat actors may exploit legitimate developer utilities to execute malicious
  payloads by proxy. One such utility is appcert.exe, a command-line tool included
  in the Windows Application Certification Kit, which is typically used to verify
  the compliance of Windows applications with Microsoft's certification standards.
  This use case detects appcert launching child processes outside of known good paths
  C:\Program Files\Windows Kits\10\App Certification Kit\ and C:\Program Files (x86)\Windows
  Kits\10\App Certification Kit\. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(appcert) OR "appcert.exe") | regex parent_process_name="(?i)^appcert.exe"|
  regex process_path!="(?i)\x5cProgram\sFiles(\s\(x86\))?\x5cWindows\sKits\x5c10\x5c"
  | table _time, host, user, process, signature_id, parent_process_*, process_* |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:trusted developer utilities proxy execution
technique_id: 
- T1127
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1218/007/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appcert/

name: Windows AD ServicePrincipalName Added To Domain Account
id: 8a1259cb-0ea7-409c-8bfe-74bad89259f9
version: 11
creation_date: '2022-11-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the addition of a Service Principal Name (SPN) to a domain account. It leverages Windows Event Code 5136 and monitors changes to the servicePrincipalName attribute. This activity is significant because it may indicate an attempt to perform Kerberoasting, a technique where attackers extract and crack service account passwords offline. If confirmed malicious, this could allow an attacker to obtain cleartext passwords, leading to unauthorized access and potential lateral movement within the domain environment.
data_source:
    - Windows Event Log Security 5136
search: >-
    `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
    OperationType="%%14674" ObjectClass=user
    | stats values(ObjectDN) as ObjectDN by _time, Computer, SubjectUserName, AttributeValue
    | rex field=ObjectDN "^CN=(?P<user>[a-zA-Z0-9!#$%&'@^_{}~.-]+),"
    | rename Computer as dest, SubjectUserName as src_user  | `windows_ad_serviceprincipalname_added_to_domain_account_filter`
how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications.
known_false_positives: A Service Principal Name should only be added to an account when an application requires it. While infrequent, this detection may trigger on legitimate actions. Filter as needed.
references:
    - https://adsecurity.org/?p=3466
    - https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
finding:
    title: A Servince Principal Name for $ObjectDN$ was set by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 50
          message: A Servince Principal Name for $ObjectDN$ was set by $user$
analytic_story:
    - Sneaky Active Directory Persistence Tricks
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Admin Password Changed by Non-Admin
id: 6d4c4d88-cd60-43a1-8c70-c74a9614f724
version: 1
creation_date: '2026-04-27'
modification_date: '2026-04-27'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
data_source:
    - Windows Event Log Security 4723
search: |-
    `wineventlog_security`
    EventCode=4723
    | rex field=object_id "-(?<target_rid>\d+)$"
    | rex field=SubjectUserSid "-(?<subject_rid>\d+)$"
    | where target_rid="500" OR tonumber(target_rid) IN (512,513,518,519,520)
    | where tonumber(subject_rid) >= 1000
    | where SubjectUserSid != object_id
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest user object_id EventCode src_user
         SubjectUserSid SubjectLogonId PrivilegeList
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_admin_password_changed_by_non_admin_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Some IT support tools or automated scripts may change administrator passwords during maintenance. Verify changes against authorized administrative activities to reduce false alerts.
references:
    - https://github.com/Nightmare-Eclipse/BlueHammer
finding:
    title: Non-Administrator account $src_user$ changed password of Admin account $user$ on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Privilege Escalation
    - BlueHammer
asset_type: Endpoint
cve:
    - CVE-2026-33825
mitre_attack_id:
    - T1068
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Binary Proxy Execution Mavinject DLL Injection
id: ccf4b61b-1b26-4f2e-a089-f2009c569c57
version: 13
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of mavinject.exe for DLL injection into running processes, identified by specific command-line parameters such as /INJECTRUNNING and /HMODULE. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because it indicates potential arbitrary code execution, a common tactic for malware deployment and persistence. If confirmed malicious, this could allow attackers to execute unauthorized code, escalate privileges, and maintain persistence within the environment, posing a severe security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_binary_proxy_execution_mavinject_dll_injection_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter on DLL name or parent process.
references:
    - https://attack.mitre.org/techniques/T1218/013/
    - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1218.013
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Curl Upload to Remote Destination
id: 42f8f1a2-4228-11ec-aade-acde48001122
version: 18
creation_date: '2021-11-10'
modification_date: '2026-07-14'
author: Michael Haag, Splunk
status: production
type: TTP
description: |-
    The following analytic detects the use of Windows Curl.exe to upload a file to a remote destination.
    It identifies command-line arguments such as `-T`, `--upload-file`, `-d`, `--data`, and `-F` in process execution logs.
    This activity is significant because adversaries may use Curl to exfiltrate data or upload malicious payloads. If confirmed malicious, this could lead to data breaches or further compromise of the system.
    Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        Processes.process_name=curl.exe
        OR
        Processes.original_file_name=Curl.exe
    )
    Processes.process IN (
        "*-T *",
        "*--upload-file *",
        "*-d *",
        "*--data *",
        "*-F *"
    )

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
       Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_curl_upload_to_remote_destination_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be limited to source control applications and may be required to be filtered out.
references:
    - https://everything.curl.dev/usingcurl/uploads
    - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
    - https://twitter.com/d1r4c/status/1279042657508081664?s=20
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
    - Compromised Windows Host
    - Ingress Tool Transfer
    - Microsoft WSUS CVE-2025-59287
    - NPM Supply Chain Compromise
    - PromptLock
    - Axios Supply Chain Post Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Executable in Loaded Modules
id: 3e27af56-fcf0-4113-988d-24969b062be7
version: 12
creation_date: '2023-09-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies instances where executable files (.exe) are loaded as modules, detected through 'ImageLoaded' events in Sysmon logs. This method leverages Sysmon EventCode 7 to track unusual module loading behavior, which is significant as it deviates from the norm of loading .dll files. This activity is crucial for SOC monitoring because it can indicate the presence of malware like NjRAT, which uses this technique to load malicious modules. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, maintain persistence, and further compromise the host system.
data_source:
    - Sysmon EventID 7
search: |-
    `sysmon` EventCode=7 ImageLoaded != *.dll AND Signed != true
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY Image ImageLoaded dest
           loaded_file loaded_file_path original_file_name
           process_exec process_guid process_hash
           process_id process_name process_path
           service_dll_signature_exists service_dll_signature_verified signature
           Signed signature_id user_id
           vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_executable_in_loaded_modules_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
finding:
    title: An executable $ImageLoaded$ loaded by $Image$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - NjRAT
    - Lokibot
asset_type: Endpoint
mitre_attack_id:
    - T1129
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Metasploit Confluence Plugin Execution
id: 3a3d1f35-5985-4827-b2ad-965467303c59
version: 2
creation_date: '2021-09-02'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects the malicious java plugin execution used by metasploit for Atlassian Confluence exploitation.
    This usually leads to the download of meterpreter giving the actor full control over the Confluence server.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_path="*\\Atlassian\\Confluence\\jre\\bin\\java.exe"
    Processes.process="*-classpath *"
    Processes.process="*\\AppData\\Local\\Temp\\~spawn*"
    Processes.process="*.Payload*"

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_metasploit_confluence_plugin_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate penetration testing tools or authorized security assessments may trigger this detection. Verify activity with your security team before taking action.
finding:
    title: Potential Metasploit Confluence plugin execution observed on $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Confluence Data Center and Confluence Server Vulnerabilities
asset_type: Endpoint
mitre_attack_id:
    - T1608
    - T1505.003
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry No Auto Update
id: fbd4f333-17bb-4eab-89cb-860fa2e0600e
version: 11
creation_date: '2023-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies a suspicious modification to the Windows registry that disables automatic updates. It detects changes to the registry path `SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate` with a value of `0x00000001`. This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to evade detection and maintain persistence. If confirmed malicious, this could allow attackers to bypass security updates, leaving the system vulnerable to further exploitation and potential zero-day attacks.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_no_auto_update_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
references:
    - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A registry modification in Windows auto update configuration on $dest$
analytic_story:
    - CISA AA23-347A
    - RedLine Stealer
asset_type: Endpoint
atomic_guid:
    - 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows PowerView Unconstrained Delegation Discovery
id: fbf9e47f-e531-4fea-942d-5c95af7ed4d6
version: 11
creation_date: '2022-03-28'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of PowerView commandlets to discover Windows endpoints with Kerberos Unconstrained Delegation. It leverages PowerShell Script Block Logging (EventCode=4104) to identify specific commands like `Get-DomainComputer` or `Get-NetComputer` with the `-Unconstrained` parameter. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out privileged delegation settings in Active Directory. If confirmed malicious, this could allow attackers to identify high-value targets for further exploitation, potentially leading to privilege escalation or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*" OR ScriptBlockText = "*Get-NetComputer*") AND (ScriptBlockText = "*-Unconstrained*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_powerview_unconstrained_delegation_discovery_filter`
how_to_implement: The following  analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://adsecurity.org/?p=1667
    - https://docs.microsoft.com/en-us/defender-for-identity/cas-isp-unconstrained-kerberos
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation
    - https://www.cyberark.com/resources/threat-research-blog/weakness-within-kerberos-delegation
finding:
    title: Suspicious PowerShell Get-DomainComputer was identified on endpoint $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious PowerShell Get-DomainComputer was identified on endpoint $dest$
analytic_story:
    - CISA AA23-347A
    - Rhysida Ransomware
    - Active Directory Kerberos Attacks
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Service Stop Win Updates
id: 0dc25c24-6fcf-456f-b08b-dd55a183e4de
version: 9
creation_date: '2023-05-02'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the disabling of Windows Update services, such as "Update Orchestrator Service for Windows Update," "WaaSMedicSvc," and "Windows Update." It leverages Windows System Event ID 7040 logs to identify changes in service start modes to 'disabled.' This activity is significant as it can indicate an adversary's attempt to evade defenses by preventing critical updates, leaving the system vulnerable to exploits. If confirmed malicious, this could allow attackers to maintain persistence and exploit unpatched vulnerabilities, compromising the integrity and security of the affected host.
data_source:
    - Windows Event Log System 7040
search: |-
    `wineventlog_system` EventCode=7040 (service_name IN ("Update Orchestrator Service for Windows Update", "WaaSMedicSvc", "Windows Update") OR param1 IN ("UsoSvc", "WaaSMedicSvc", "wuauserv")) AND (param3=disabled OR start_mode = disabled)
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY Computer Error_Code service_name
           start_mode param1 param2
           param3 param4
      | rename Computer as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_service_stop_win_updates_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints (like Windows system.log Event ID 7040)
known_false_positives: Network administrator may disable this services as part of its audit process within the network. Filter is needed.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Windows update services $service_name$ was being disabled on $dest$
analytic_story:
    - CISA AA23-347A
    - RedLine Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Unsigned MS DLL Side-Loading
id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c
version: 16
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies potential DLL side-loading instances involving unsigned DLLs mimicking Microsoft signatures. It detects this activity by analyzing Sysmon logs for Event Code 7, where both the `Image` and `ImageLoaded` paths do not match system directories like `system32`, `syswow64`, and `programfiles`. This behavior is significant as adversaries often exploit DLL side-loading to execute malicious code via legitimate processes. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to privilege escalation, persistence, and unauthorized access to sensitive information.
data_source:
    - Sysmon EventID 7
search: |
    `sysmon`
    EventCode=7
    Company="Microsoft Corporation"
    Signed=false
    SignatureStatus!= Valid
    NOT (Image IN (
                  "C:\\Program Files \(x86\)\\*",
                  "C:\\Program Files\\*",
                  "C:\\Windows\\System32\\*",
                  "C:\\Windows\\SysWow64\\*"
                  )
        )
    NOT (ImageLoaded IN (
                        "C:\\Program Files \(x86\)\\*",
                        "C:\\Program Files\\*",
                        "C:\\Windows\\System32\\*",
                        "C:\\Windows\\SysWow64\\*"
                        )
        )
    | rex field=Image "(?<ImageFolderPath>.+\\\)"
    | rex field=ImageLoaded "(?<ImageLoadedFolderPath>.+\\\)"
    | where ImageFolderPath = ImageLoadedFolderPath
    | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded
    dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash
    process_id process_name process_path service_dll_signature_exists service_dll_signature_verified
    signature signature_id user_id vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_unsigned_ms_dll_side_loading_filter`
how_to_implement: The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into Splunk. The analytic searches for EventCode 7 where the Image is either SQLDumper.exe or SQLWriter.exe and the ImageLoaded is vcruntime140.dll. The search also filters out the legitimate loading of vcruntime140.dll from the System32 directory to reduce false positives. The analytic can be modified to include additional known good paths for vcruntime140.dll to further reduce false positives.
known_false_positives: False positives are possible if legitimate processes are loading vcruntime140.dll from non-standard directories. It is recommended to investigate the context of the process loading vcruntime140.dll to determine if it is malicious or not. Modify the search to include additional known good paths for vcruntime140.dll to reduce false positives.
references:
    - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties
    - https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $Image$ loading Unsigned $ImageLoaded$ was detected on $dest$.
threat_objects:
    - field: Image
      type: file_name
analytic_story:
    - China-Nexus Threat Activity
    - Derusbi
    - APT29 Diplomatic Deceptions with WINELOADER
    - Salt Typhoon
    - Earth Alux
    - XWorm
threat_group:
    - APT29
    - Cozy Bear
    - Midnight Blizzard
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
    - T1547
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint