Splunk rules: 0k

id: '13702.20067'
title: AnyDesk Execution from Suspicious Folder
description: 'Adversaries may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. These services are commonly used as legitimate technical support software,
  and may be allowed by application control within a target environment. This use
  case detects when remote access software AnyDesk is executed outside of standard
  install locations. -- Threat Actor Association: Alloy Taurus/Gallium, Gamaredon
  (aka. Armageddon, UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944),
  Scatter Swine, UNC2659 - Software Association: Akira, ALPHV/BlackCat, AvosLocker,
  BianLian, BlackByte, BumbleBee, Clop, Conti, Diavol, Rhysida, Royal -- Atomics T1219
  Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(AnyDesk) | regex process_path!="(?i)(AppData)|(Program\sFiles\\AnyDesk)|(Program\sFiles\s\(x86\))"|
  where match(process_name, "(?i)^anydesk.exe$") | table _time, host, user, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows

id: '25095.46535'
title: Attempted Veeam Database Credential Dump
description: 'Operators from the Diavol ransomware gang were observed using sqlcmd
  to extract encrypted credentials from Veeam databases that were decrypted using
  a publicly documented technique on Veeam''s R+D forums. This use case detects commands
  targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented
  cases, the logic is not reliant on detecting sqlcmd.exe to account for instances
  where the binary has been renamed or another utility was used to interact with the
  database. -- Threat Actor Association: UTA0178 -- Software Association: Akira'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]"
  | table _time, host, user, user, process, process_*, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html

name: AWS Exfiltration via Anomalous GetObject API Activity
id: e4384bbf-5835-4831-8d85-694de6ad2cc6
version: 10
creation_date: '2023-04-10'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. It leverages AWS CloudTrail logs and uses the `anomalydetection` command to detect unusual patterns in the frequency of GetObject API calls by analyzing fields such as "count," "user_type," and "user_arn" within a 10-minute window. This activity is significant as it may indicate unauthorized data access or exfiltration from S3 buckets. If confirmed malicious, attackers could exfiltrate sensitive data, leading to data breaches and compliance violations.
data_source:
    - AWS CloudTrail GetObject
search: |-
    `cloudtrail` eventName=GetObject
      | bin _time span=10m
      | rename user_name as user
      | stats count values(requestParameters.bucketName) as bucketName
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | anomalydetection "count" "user" action=annotate
      | search probable_cause=*
      | `aws_exfiltration_via_anomalous_getobject_api_activity_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: It is possible that a user downloaded these files to use them locally and there are AWS services in configured that perform these activities for a legitimate reason. Filter is needed.
references:
    - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
    - https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.4/search-commands/anomalydetection
    - https://www.vectra.ai/blogpost/abusing-the-replicator-silently-exfiltrating-data-with-the-aws-s3-replication-service
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Anomalous S3 activities detected by user $user$ from $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Data Exfiltration
asset_type: AWS Account
mitre_attack_id:
    - T1119
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS High Number Of Failed Authentications From Ip
id: f75b7f1a-b8eb-4975-a214-ff3e0a944757
version: 11
creation_date: '2023-01-30'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects an IP address with 20 or more failed authentication attempts to the AWS Web Console within a 5-minute window. This detection leverages CloudTrail logs, aggregating failed login events by IP address and time span. This activity is significant as it may indicate a brute force attack aimed at gaining unauthorized access or escalating privileges within an AWS environment. If confirmed malicious, this could lead to unauthorized access, data breaches, or further exploitation of AWS resources.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName=ConsoleLogin action=failure
      | bucket span=10m _time
      | rename user_name as user
      | stats dc(_raw) AS failed_attempts values(user) as user values(user_agent) as user_agent
        BY _time, src, signature,
           dest, vendor_account vendor_region,
           vendor_product
      | where failed_attempts > 20
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_high_number_of_failed_authentications_from_ip_filter`
how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
    - https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: 'Multiple failed console login attempts (Count: $failed_attempts$) against users from IP Address - $src$'
analytic_story:
    - AWS Identity and Access Management Account Takeover
    - Compromised User Account
asset_type: AWS Account
mitre_attack_id:
    - T1110.003
    - T1110.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '13470.19295'
title: CDB Execution
description: 'CDB is a legitimate Windows component that can be used, and abused,
  to launch 64-bit shellcode, setup network connections or attaching to any process
  and executing shell commands. As this is a common component on Windows, it can be
  leveraged to perform living-off-the-land attacks. -- Threat Actor Association: Metador
  -- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("cdb.exe" ("-cf" OR "-cfr" OR ("-premote" ("port"
  OR "pipe")) OR ("-pd" "-pn"))) OR ("-cf" OR "-cfr" OR ("-premote" ("port" OR "pipe"))
  OR ("-pd" "-pn")) | regex process="(?i)\s+\-(cf|cfr|premote|pd.*-pn|pn.*-pd)\s+"
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:trusted developer utilities proxy execution
technique_id: 
- T1127
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/
- https://blog.thecybersecuritytutor.com/the-power-of-cdb-debugging-tool/

name: Cisco IOS Suspicious Privileged Account Creation
id: 63e3aff9-45d7-4d41-bcdb-9da561fb4533
version: 5
creation_date: '2025-08-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: Anomaly
description: This analytic detects the creation of privileged user accounts on Cisco IOS devices, which could indicate an attacker establishing backdoor access. The detection focuses on identifying when user accounts are created with privilege level 15 (the highest administrative privilege level in Cisco IOS) or when existing accounts have their privileges elevated. This type of activity is particularly concerning when performed by unauthorized users or during unusual hours, as it may represent a key step in establishing persistence following the exploitation of vulnerabilities like CVE-2018-0171 in Cisco Smart Install. Threat actors like Static Tundra have been observed creating privileged accounts as part of their attack chain after gaining initial access to network devices.
data_source:
    - Cisco IOS Logs
search: |-
    | tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
      WHERE (
            (All_Changes.command="*username * privilege 15*")
            OR
            (All_Changes.command="*username * password*"
            AND
            All_Changes.command="*USER TABLE MODIFIED*")
            OR
            (All_Changes.command="*USER_PRIVILEGE_UPDATE*priv-15*")
        )
      BY All_Changes.dvc All_Changes.user
    | `drop_dm_object_name("All_Changes")`
    | rename dvc as dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_suspicious_privileged_account_creation_filter`
how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel, with AAA accounting and command logging enabled on your Cisco devices.
known_false_positives: Legitimate account creation and privilege elevation activities by authorized administrators will generate alerts with this detection. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames, typical times for account management, and authorized administrators who regularly perform these actions. You may also want to create a lookup table of approved administrative accounts and filter out alerts for these accounts. Additionally, scheduled maintenance windows should be taken into account when evaluating alerts.
references:
    - https://blog.talosintelligence.com/static-tundra/
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
    - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-cr-a2.html#wp3796044403
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious privileged account was created or modified on Cisco IOS device $dest$ by user $user$
        - field: user
          type: user
          score: 20
          message: A suspicious privileged account was created or modified on Cisco IOS device $dest$ by user $user$
threat_objects:
    - field: command
      type: command
analytic_story:
    - Cisco Smart Install Remote Code Execution CVE-2018-0171
asset_type: Network
cve:
    - CVE-2018-0171
mitre_attack_id:
    - T1136
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Cisco SA - Access to Anonymizer Services
id: a7c8613a-92e2-4232-b64d-bd39d33dee8b
version: 1
creation_date: '2026-05-06'
modification_date: '2026-06-09'
author: Mahamudul Chowdhury, Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    This analytic detects attempts to access proxy-evasion or anonymizer services using Cisco Secure Access DNS and secure web proxy telemetry.
    Users who reach anonymizer or proxy-evasion infrastructure are often trying to bypass corporate controls such as secure web gateway inspection, DLP monitoring, CASB visibility, and threat-detection systems. These services frequently establish encrypted tunnels that hide subsequent traffic from inspection.
    Early identification helps security teams spot circumvention attempts before potential data exfiltration or follow-on malicious activity. Correlating DNS resolution and proxy session data strengthens confidence that access was intentional.
data_source:
    - Cisco Secure Access DNS
search: |-
    `cisco_secure_access_dns`
    action = "allowed" category= "*anonymizer*"
    | fillnull
    | stats count min(_time) as firstTime max(_time) as lastTime values(domain) as domain values(query) as query values(reply_code) as reply_code values(record_type) as record_type by src_ip src_external_ip user identity_type action category sourcetype
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_sa___access_to_anonymizer_services_filter`
how_to_implement: |
    Ingest Cisco Secure Access DNS and proxy events into Splunk using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    Update the `cisco_secure_access_dns` macro so it resolves to the indexes, sources, and sourcetypes used in your environment.
known_false_positives: |
    Security research, approved privacy tools, or mis-categorized destinations may appear as anonymizer traffic. Tune this analytic with the filter macro or allow-lists for known-good users, networks, and domains after validating business justification.
references:
    - https://attack.mitre.org/techniques/T1090/003
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ from $src_ip$ accessed proxy-evasion or anonymizer infrastructure (domains=$domain$, categories=$category$).
threat_objects:
    - field: domain
      type: domain
analytic_story:
    - Cisco Secure Access Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1090.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '11170.15452'
title: 'CVE-2022-30190: Microsoft Office Code Execution Vulnerability'
description: 'Aka: Follina. A remote code execution vulnerability exists when MSDT
  is called using the URL protocol from a calling application such as Word. An attacker
  who successfully exploits this vulnerability can run arbitrary code with the privileges
  of the calling application. The attacker can then install programs, view, change,
  or delete data, or create new accounts in the context allowed by the user’s rights.
  - Threat Actor Association: APT28, GoldenJackal, RomCom, TA413 - Software Association:
  CrescentImp, Qakbot/Qbot'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("msdt.exe" OR TERM(msdt)) (("PCWDiagnostic" and ("ms-msdt:-id" OR "ms-msdt:/id"))
  OR "invoke" OR (TERM(Microsoft) TERM(Office)) OR TERM(WINWORD.EXE) OR TERM(EXCEL.EXE)
  OR TERM(POWERPNT.EXE) OR TERM(MSACCESS.EXE) OR TERM(OUTLOOK.EXE) OR TERM(VISIO.EXE)
  OR TERM(WINPROJ.EXE) OR TERM(wordpad.exe)) | table _time, host, user process, parent_*,
  process_*, signature_id | bin span=1s | stats values(*) as * by _time, host | where
  (match(process, "(?i)PCWDiagnostic|invoke") OR match(parent_process_path, "(?i)(Microsoft
  Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(wordpad\.exe)"))
  and match(process_name, "(?i)msdt.exe") '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows Sysmon
references:
- https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

name: Disabling Task Manager
id: dac279bc-9202-11eb-b7fb-acde48001122
version: 16
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic identifies modifications to the Windows registry that disable Task Manager. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" with a value of "0x00000001". This activity is significant as it is commonly associated with malware such as RATs, Trojans, and worms, which disable Task Manager to prevent users from terminating malicious processes. If confirmed malicious, this could allow attackers to maintain persistence and control over the infected system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
    - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
    - https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html
finding:
    title: The Windows Task Manager was disabled on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The Windows Task Manager was disabled on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - NjRAT
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi Bulk VM Termination
id: cfe094b4-0737-4a33-9d63-e0562ce2b883
version: 4
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` | rex field=_raw "\s\[(?<user>[^\]]+)\]:\s(?<shell_command>.+)$" | rex field=_raw "Z (?<dest>[\w\.]+)\s.*:\s(?<esxicli_Command>esxcli\s.+)" | eval command=mvappend(esxicli_Command, shell_Command) | where isnotnull(command) | search (command="pkill -9 vmx-*") OR ( command="*esxcli*" AND command="*--format-param*" AND command="*vm process list*" AND command="*awk*" AND command="*esxcli vm process kill*") | stats min(_time) as firstTime max(_time) as lastTime values(_time) as timeStamp values(command) as commands values(user) as user by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_bulk_vm_termination_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed.
finding:
    title: Bulk VM termination activity on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1673
    - T1529
    - T1499
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Executable File Written in Administrative SMB Share
id: f63c34fe-a435-11eb-935a-acde48001122
version: 14
creation_date: '2021-04-26'
modification_date: '2026-08-05'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: |-
    The following analytic detects executable files (.exe, .dll, etc.) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity.
    This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution.
    If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network.
data_source:
    - Windows Event Log Security 5145
search: |-
    `wineventlog_security`
    EventCode=5145
    RelativeTargetName IN (
        "*.cpl",
        "*.dll",
        "*.exe",
        "*.sys"
    )
    ObjectType=File
    ShareName IN (
        "\\\\*\\Admin$",
        "\\\\*\\C$",
        "\\\\*\\IPC$"
    )

    | eval AccessMask_ = tonumber(AccessMask, 16)
    | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0)

    | stats min(_time) as firstTime
            max(_time) as lastTime count

      by EventCode ShareName RelativeTargetName ObjectType
         AccessMask src_user src_port IpAddress dest

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `executable_file_written_in_administrative_smb_share_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
known_false_positives: |-
    System Administrators may use tools like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
references:
    - https://attack.mitre.org/techniques/T1021/002/
    - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes
finding:
    title: The [$src_user$] dropped or created an executable file in known sensitive SMB share. Share name=[$ShareName$], Target name=[$RelativeTargetName$], and Access mask=[$AccessMask$]
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Active Directory Lateral Movement
    - BlackSuit Ransomware
    - IcedID
    - Prestige Ransomware
    - Industroyer2
    - Data Destruction
    - Graceful Wipe Out Attack
    - Compromised Windows Host
    - Hermetic Wiper
    - Trickbot
    - VanHelsing Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1021.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GPUpdate with no Command Line Arguments with Network
id: 2c853856-a140-11eb-a5b5-acde48001122
version: 16
creation_date: '2021-04-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of gpupdate.exe without command line arguments and with an active network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network traffic data. It is significant because gpupdate.exe typically runs with specific arguments, and its execution without them, especially with network activity, is often associated with malicious software like Cobalt Strike. If confirmed malicious, this activity could indicate an attacker leveraging gpupdate.exe for lateral movement, command and control, or other nefarious purposes, potentially leading to system compromise.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=gpupdate.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | regex process="(?i)(gpupdate\.exe.{0,4}$)"
    | join process_id dest [
    | tstats `security_content_summariesonly` count values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.direction) as direction values(All_Traffic.dvc) as dvc values(All_Traffic.protocol) as protocol values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src) as src values(All_Traffic.src_ip) as src_ip values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport FROM datamodel=Network_Traffic.All_Traffic
      WHERE All_Traffic.dest_port != 0
      BY All_Traffic.process_id All_Traffic.src All_Traffic.dest All_Traffic.dest_port
    | `drop_dm_object_name(All_Traffic)`
    | rename dest as C2
    | rename src as dest ]
    | table _time user dest parent_process_name process_name process_path process process_id dest_port C2 app dest_ip direction dvc protocol protocol_version src src_ip src_port transport
    | `gpupdate_with_no_command_line_arguments_with_network_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process.
references:
    - https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/
finding:
    title: Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection on port $dest_port$. This behaviour is seen with cobaltstrike.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection on port $dest_port$. This behaviour is seen with cobaltstrike.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Graceful Wipe Out Attack
    - Cobalt Strike
    - Compromised Windows Host
    - BlackByte Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 Application Registration Owner Added
id: c068d53f-6aaa-4558-8011-3734df878266
version: 9
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where a new owner is assigned to an application registration within an Azure AD and Office 365 tenant. It leverages O365 audit logs, specifically events related to changes in owner assignments within the AzureActiveDirectory workload. This activity is significant because assigning a new owner to an application registration can grant significant control over the application's configuration, permissions, and behavior. If confirmed malicious, an attacker could modify the application's settings, permissions, and behavior, leading to unauthorized data access, privilege escalation, or the introduction of malicious behavior within the application's operations.
data_source:
    - O365 Add owner to application.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add owner to application.\" | eval app_id=mvindex('ModifiedProperties{}.NewValue', 0) | eval app_displayName=mvindex('ModifiedProperties{}.NewValue', 1) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product app_id app_displayName object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_application_registration_owner_added_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Application owners may be added for legitimate reasons, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/overview-assign-app-owners
finding:
    title: Application registration $app_displayName$ was assigned a new owner $object$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: O365 Multiple Users Failing To Authenticate From Ip
id: 8d486e2e-3235-4cfe-ac35-0d042e24ecb4
version: 13
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where more than 10 unique user accounts fail to authenticate from a single IP address within a 5-minute window. This detection leverages O365 audit logs, specifically Azure Active Directory login failures (AzureActiveDirectoryStsLogon). Such activity is significant as it may indicate brute-force attacks or password spraying attempts. If confirmed malicious, this behavior suggests an external entity is attempting to breach security by targeting multiple accounts, potentially leading to unauthorized access. Immediate action is required to block or monitor the suspicious IP and notify affected users to enhance their security measures.
data_source:
    - O365 UserLoginFailed
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126
      | bucket span=5m _time
      | fillnull
      | stats dc(user) as unique_accounts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as user_agent values(dest) as dest
        BY _time src vendor_account
           vendor_product
      | where unique_accounts > 10
      | `o365_multiple_users_failing_to_authenticate_from_ip_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: A source Ip failing to authenticate with multiple users in a short period of time is not common legitimate behavior.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
    - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
finding:
    title: Source Ip $src$ failed to authenticate with 20 users within 5 minutes.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1110.003
    - T1110.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '23146.42110'
title: Process Creation Using Sysnative Folder
description: 'Threat actors may use tools spawning processes from the Sysnative folder
  in an attempt to bypass the File System Redirector on 64-bit versions of Windows
  to execute 32-bit applications from the 64-bit system directory. This use cased
  detects instances where the Sysnative folder is used during process creation, a
  tactic often associated with CobaltStrike activities. Note: Sysnative is often referenced
  by legitimate processes. Allowlisting known processes is recommended to reduce false
  positives.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "Sysnative" | regex process="(?i)^[A-Z]:\x5cWindows\x5cSysnative\x5c"
  | table _time, host, user, parent_process_name, process | bin span=1s | stats values(*)
  as * by _time, host '
techniques: 
- defense-evasion:system binary proxy execution
technique_id:
- T1218
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
- https://learn.microsoft.com/sv-se/windows/win32/winprog64/file-system-redirector

name: Python Network Traffic During Package Build
id: 03c9c504-2294-44da-8180-beefe1ca8ba8
version: 1
creation_date: '2026-08-21'
modification_date: '2026-08-21'
author: Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects a Python process making an outbound network connection during package installation.
    Adversaries can abuse `setup.py` build scripts by leveraging `distutils`/`setuptools` command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed.
    This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running `pip install`.
    If confirmed malicious, this could indicate a successful software supply chain compromise.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
search: |-
    `sysmon`
    (
        EventID=1
        (
            process="*_in_process.py*"
            OR
            process_name=python.exe
        )
    )
    OR
    (
        EventID=3
        dest_ip!=""
        process_name=python.exe
    )

    | eval dest=if(EventID=3, Computer, dest)

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(parent_process_id) as parent_process_id
                  values(parent_process_path) as parent_process_path
                  values(parent_process_name) as parent_process_name
                  values(parent_process) as parent_process
                  values(process_path) as process_path
                  values(process_name) as process_name
                  values(process) as process
                  values(dest_ip) as dest_ip
                  values(dest_host) as dest_host

      by dest source process_id

    | search process="* build_wheel*" dest_ip=*

    | table firstTime lastTime
            parent_process_id parent_process_path parent_process_name parent_process
            process_id process_path process_name process
            dest_ip dest_host
            dest source

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `python_network_traffic_during_package_build_filter`
how_to_implement: |-
    The detection is based on data that originates from Sysmon. To implement this search, you must ingest logs
    with process creation (EventID 1) and network connection (EventID 3) events, mapped via the appropriate
    Splunk Technology Add-on. Use the Splunk Common Information Model (CIM) to normalize the field names.
known_false_positives: |-
    Python packages may contact software repositories, mirror sites during build time.
    Investigate the destination and package content to determine legitimacy.
references:
    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A Python process [$process$] on [$dest$] made an outbound network connection to [$dest_ip$] with hostname [$dest_host$] during package installation.
threat_objects:
    - field: process
      type: process
    - field: dest_ip
      type: ip_address
    - field: dest_host
      type: domain
analytic_story:
    - Malicious Python Package Installation
    - Ingress Tool Transfer
    - Command And Control
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1195.002
    - T1059.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '11211.15636'
title: Rare executable from Microsoft Office
description: 'This use case looks for suspicious behavior from Microsoft office products.
  Filters for rarer executable files launched from a Microsoft Office product. - Threat
  Actor Association: Evilnum - Software Association: GlowSand.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ((TERM(Microsoft) TERM(Office)) OR TERM(WINWORD.EXE)
  OR TERM(EXCEL.EXE) OR TERM(POWERPNT.EXE) OR TERM(MSACCESS.EXE) OR TERM(OUTLOOK.EXE)
  OR TERM(VISIO.EXE) OR TERM(WINPROJ.EXE) OR TERM(wordpad.exe))| regex parent_process_name="(?i)((WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(wordpad\.exe)|(Microsoft\s+Office))"
  | table _time, host, user process, parent_*, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | eventstats c(process_name) as c_process
  by process_name| where c_process < 3 '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows event logs
references:
- https://borncity.com/win/2022/06/02/searchnightmare-windows-10-search-ms-uri-handler-0-day-exploit-mit-office-2019/

name: Windows AD Dangerous Deny ACL Modification
id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7
version: 10
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object.
data_source:
    - Windows Event Log Security 5136
search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: No false positives have been identified at this time.
references:
    - https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54
    - https://www.youtube.com/watch?v=_nGpZ1ydzS8
    - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
finding:
    title: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1222.001
    - T1484
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chrome Enable Extension Loading via Command-Line
id: da355155-1d23-48f9-bf95-e534ae273ab0
version: 4
creation_date: '2026-01-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line.
    This may indicate attempts to bypass enterprise extension policies, load unauthorized or malicious extensions, or manipulate browser behavior.
    Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime
    from datamodel=Endpoint.Processes where
      Processes.process_name = "Chrome.exe"
      Processes.process= "*--disable-features*"
      Processes.process= "*DisableLoadExtensionCommandLineSwitch*"
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_chrome_enable_extension_loading_via_command_line_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes.
references:
    - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A $process_name$ process attempted to enable browser extension loading via command line $process$ on $dest$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Browser Hijacking
asset_type: Endpoint
mitre_attack_id:
    - T1185
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint