Splunk rules: 0l

name: ASL AWS UpdateLoginProfile
id: 5b3f63a3-865b-4637-9941-f98bd1a50c0d
version: 8
creation_date: '2022-10-04'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects an AWS CloudTrail event where a user with permissions updates the login profile of another user. It leverages CloudTrail logs to identify instances where the user making the change is different from the user whose profile is being updated. This activity is significant because it can indicate privilege escalation attempts, where an attacker uses a compromised account to gain higher privileges. If confirmed malicious, this could allow the attacker to escalate their privileges, potentially leading to unauthorized access and control over sensitive resources within the AWS environment.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=UpdateLoginProfile
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_updateloginprofile_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
references:
    - https://bishopfox.com/blog/privilege-escalation-in-aws
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
finding:
    title: User $user$ from IP address $src$ updated the login profile of another user
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS Bedrock High Number List Foundation Model Failures
id: e84b3c74-f742-11ee-9f6e-acde48001122
version: 6
creation_date: '2025-03-25'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies an high number of AccessDenied attempts to list AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service experiences multiple failures when calling the ListFoundationModels API. This activity is significant as it may indicate an adversary performing reconnaissance of available AI models after compromising credentials with limited permissions. Repeated failures could suggest brute force attempts to enumerate accessible resources or misconfigured access controls. If confirmed malicious, this could represent early-stage reconnaissance before attempting to access or manipulate Bedrock models or knowledge bases.
data_source:
    - AWS CloudTrail
search: >-
    `cloudtrail` eventSource=bedrock.amazonaws.com eventName=ListFoundationModels errorCode=AccessDenied  | rename user_name as user
    | stats count min(_time) as firstTime max(_time) as lastTime values(errorCode) as errorCodes values(errorMessage) as errorMessages by src user user_agent vendor_account vendor_product dest signature vendor_region
    | where count > 9
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `aws_bedrock_high_number_list_foundation_model_failures_filter`
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS.
known_false_positives: Legitimate users may encounter multiple failures during permission testing, role transitions, or when service permissions are being reconfigured. High volumes of API errors may also occur during automated processes with misconfigured IAM policies or when new Bedrock features are being explored through API testing.
references:
    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListFoundationModels.html
    - https://trustoncloud.com/blog/exposing-the-weakness-how-we-identified-a-flaw-in-bedrocks-foundation-model-access-control/
    - https://attack.mitre.org/techniques/T1595/
finding:
    title: User $user$ attempted to list AWS Bedrock foundation models $count$ times with failures from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Bedrock Security
asset_type: AWS Account
mitre_attack_id:
    - T1580
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Azure AD Multiple Failed MFA Requests For User
id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea
version: 14
creation_date: '2022-08-25'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Azure AD tenant. It leverages Azure AD Sign-in Logs, specifically error code 500121, to detect more than 10 failed MFA attempts within 10 minutes. This behavior is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication prompts. If confirmed malicious, this activity could lead to unauthorized access, allowing attackers to compromise user accounts and potentially escalate their privileges within the environment.
data_source:
    - Azure Active Directory Sign-in activity
search: |-
    `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity" properties.status.errorCode=500121 properties.status.additionalDetails!="MFA denied; user declined the authentication"
      | rename properties.* as *
      | bucket span=10m _time
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest values(src) as src
        BY user, status.additionalDetails, appDisplayName,
           user_agent, vendor_account, vendor_product,
           signature
      | where count > 10
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_multiple_failed_mfa_requests_for_user_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
references:
    - https://www.mandiant.com/resources/blog/russian-targeting-gov-business
    - https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/
    - https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/
    - https://attack.mitre.org/techniques/T1621/
    - https://attack.mitre.org/techniques/T1078/004/
    - https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
finding:
    title: User $user$ failed to complete MFA authentication more than 9 times in a timespan of 10 minutes.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Active Directory
mitre_attack_id:
    - T1078.004
    - T1586.003
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco Isovalent - Pods Running Offensive Tools
id: e9d0b9e6-2f3c-4a8a-9d61-2b6f4a9c1c2e
version: 5
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects execution of known offensive tooling from within Kubernetes pods, including network scanners and post-exploitation frameworks (e.g., nmap, masscan, zmap, impacket-*, hashcat, john, SharpHound, kube-hunter, peirates). We have created a macro named `linux_offsec_tool_processes` that contains the list of known offensive tooling found on linux systems. Adversaries commonly introduce these tools into compromised workloads to conduct discovery, lateral movement, credential access, or cluster reconnaissance. This behavior may indicate a compromised container or supply-chain abuse. Extra scrutiny is warranted for namespaces that do not typically run diagnostic scanners and for pods that suddenly begin invoking these binaries outside of normal maintenance activity.
data_source:
    - Cisco Isovalent Process Exec
search: |
    `cisco_isovalent_process_exec`  `linux_offsec_tool_processes`
    | stats count
            min(_time) as firstTime
            max(_time) as lastTime
            values(process) as process
        by cluster_name container_id pod_name pod_namespace pod_image_name parent_process_name process_name process_exec process_id node_name
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_isovalent___pods_running_offensive_tools_filter`
how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
known_false_positives: Security testing, approved red team exercises, or sanctioned diagnostics can trigger this analytic. Coordinate allowlists and maintenance windows with platform/SecOps teams. Please update a macro named `linux_offsec_tool_processes` that contains the list of known offensive tooling found on linux systems if your environment has additional known offensive tools that are not included in the macro.
references:
    - https://dev.to/thenjdevopsguy/attacking-a-kubernetes-cluster-enter-red-team-mode-2onj
    - https://www.reddit.com/r/kubernetes/comments/l6e5yr/one_of_our_kubernetes_containers_was_compromised/
intermediate_findings:
    entities:
        - field: pod_name
          type: system
          score: 20
          message: Offensive tool execution [$process_name$] detected in pod [$pod_name$] on cluster [$cluster_name$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Isovalent Suspicious Activity
asset_type: Endpoint
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5746.6449'
title: Executable Process from Suspicious Folder
description: 'Detects the execution of executable process spawned by powershell or
  similar processes from suspicious file locations like temp, appdata, and downloads.
  - Threat Actor Association: Andariel, APT10/menuPass, APT28 (aka.Fancy Bear, Fighting
  Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT34/OilRig, Blind Eagle/APT-C-36,
  Carbanak, Evilnum, FIN7, FIN8, GoldenJackal, Gorgon Group, Kimsuky, Lazarus, Magic
  Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Mustang Panda
  (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA505,
  TA551, UNC2465, Volt Typhoon, WinterVivern/UAC-0114 -- Software Association: Babuk,
  BadHatch, Bazar, Blackbyte, Clop, IcedID, Lockbit, MagicRAT, PowerShortShell, PYSA/Mespinoza,
  SmokedHAM, SolidBit, RATDispenser, Remcos, TA413, TargetCompany, Trickbot, Trigona,
  Yellow Cockatoo/Jupiter Infostealer, Vidar Stealer, WhisperGate - #TrendingThreat
  #Russia #Ukraine - Atomics T1574.001 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) ("Temporary
  Internet Files" OR TERM("TEMP") OR TERM("Downloads") OR TERM("Appdata"))| regex
  Path="(?i)Temp|Downloads|Appdata" | eval process_path=Path | table _time, host,
  user process, process_*, signature_id, user | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- execution:command and scripting interpreter
- execution:user execution
- execution:command and scripting interpreter:visual basic
- defense-evasion:system binary proxy execution:rundll32
- execution:command and scripting interpreter:javascript
technique_id:
- T1059
- T1204
- T1059.007
- T1218.011
- T1059.005
data_category:
- Process command-line parameters
- PowerShell logs
references:
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

name: Firewall Allowed Program Enable
id: 9a8f63a8-43ac-11ec-904c-acde48001122
version: 13
creation_date: '2021-11-17'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the modification of a firewall rule to allow the execution of a specific application. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events with command-line arguments related to firewall rule changes. This activity is significant as it may indicate an attempt to bypass firewall restrictions, potentially allowing unauthorized applications to communicate over the network. If confirmed malicious, this could enable an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the target environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process = "*firewall*" Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `firewall_allowed_program_enable_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: A network operator or systems administrator may utilize an automated or manual execution of this firewall rule that may generate false positives. Filter as needed.
references:
    - https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: firewall allowed program commandline $process$ of $process_name$ on $dest$ by $user$
analytic_story:
    - BlackByte Ransomware
    - NjRAT
    - PlugX
    - Windows Defense Evasion Tactics
    - Medusa Ransomware
    - Azorult
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GCP Multi-Factor Authentication Disabled
id: b9bc5513-6fc1-4821-85a3-e1d81e451c83
version: 13
creation_date: '2022-10-14'
modification_date: '2026-05-13'
author: Bhavin Patel, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects an attempt to disable multi-factor authentication (MFA) for a Google Cloud Platform (GCP) user. It leverages Google Workspace Admin log events, specifically the `UNENROLL_USER_FROM_STRONG_AUTH` command. This activity is significant because disabling MFA can allow an adversary to maintain persistence within the environment using a compromised account without raising suspicion. If confirmed malicious, this action could enable attackers to bypass additional security layers, potentially leading to unauthorized access, data exfiltration, or further exploitation of the compromised account.
data_source:
    - Google Workspace
search: |-
    `gws_reports_admin` command=UNENROLL_USER_FROM_STRONG_AUTH
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY user, command, actor.email,
           status, id.applicationName, event.name,
           vendor_account, action
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gcp_multi_factor_authentication_disabled_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the Admin log events.
known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed.
references:
    - https://support.google.com/cloudidentity/answer/2537800?hl=en
    - https://attack.mitre.org/tactics/TA0005/
    - https://attack.mitre.org/techniques/T1556/
finding:
    title: MFA disabled for User $user$ initiated by $actor.email$
    entity:
        field: actor.email
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: MFA disabled for User $user$ initiated by $actor.email$
analytic_story:
    - GCP Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: GCP
mitre_attack_id:
    - T1556.006
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '31900.56999'
title: Invoke-DCOM.ps1 - PowerShell
description: 'Adversaries may use Valid Accounts to interact with remote machines
  by taking advantage of Distributed Component Object Model (DCOM). The adversary
  may then perform actions as the logged-on user. This use case detects the usage
  of Invoke-DCOM PowerShell script to remotely obtain arbitrary and direct shellcode
  execution through Office applications as well as other Windows objects that contain
  insecure methods. Note: PowerShell logging is recommended for best detection. Detection
  using other log sources is dependent on commands being run in manner that creates
  a new process, such as powershell -c.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ((("MMC20.Application" OR "ShellWindows" OR "ShellBrowserWindow" OR "CheckDomain"
  OR "ServiceCheck" OR "MinimizeAll" OR "ServiceStop" OR "ServiceStart" OR "DetectOffice"
  OR "RegisterXLL" OR "ExcelDDE") OR ("9BA05972-F6A8-11CF-A442-00A0C90A8F39" OR "C08AFD90-F2A1-11D1-8455-00A0C91F3880"
  OR "7e0423cd-1119-0928-900c-e6d4a52a0715")) OR ("Application.ServiceStart" OR "Application.ServiceStop"
  OR "Application.IsServiceRunning" OR "Application.ShutDownWindows" OR "Application.GetSystemInformation"
  OR "DDEInitiate" OR "Application.RegisterXLL" OR "Application.ProductCode" OR "Application.MinimizeAll"
  OR "ActiveView.ExecuteShellCommand") ("cmd.exe" OR "powershell.exe" OR "pwsh.exe"))
  AND NOT ("rundll32.exe" OR TERM(rundll32)) | table _time, host, user, process, parent_process
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:distributed component object model
technique_id:
- T1021.003
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1021/003/
- https://github.com/EmpireProject/Empire/blob/master/data/module_source/lateral_movement/Invoke-DCOM.ps1
- https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/

name: Kubernetes Suspicious Image Pulling
id: 4d3a17b3-0a6d-4ae0-9421-46623a69c122
version: 10
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious image pulling in Kubernetes environments. It identifies this activity by monitoring Kubernetes audit logs for image pull requests that do not match a predefined list of allowed images. This behavior is significant for a SOC as it may indicate an attacker attempting to deploy malicious software or infiltrate the system. If confirmed malicious, the impact could be severe, potentially leading to unauthorized access to sensitive systems or data, and enabling further malicious activities within the cluster.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` requestObject.message="Pulling image*"
      | search NOT `kube_allowed_images`
      | fillnull
      | stats count
        BY objectRef.name objectRef.namespace objectRef.resource
           requestReceivedTimestamp requestURI responseStatus.code
           sourceIPs{} stage user.groups{}
           user.uid user.username userAgent
           verb
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_suspicious_image_pulling_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Suspicious image $objectRef.name$ pulled in Kubernetes from ip $src_ip$ by user $user$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1526
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '7825.17910'
title: Mavinject Execution
description: 'Mavinject is a legitimate Windows component that can be used, and abused,
  to perform arbitrary code injections inside any running process. As this is a common
  component on Windows, it can be leveraged to perform living-off-the-land attacks.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Threat Actor Assocaition:
  Lancefly -- Atomics T1218 Test #1 Atomics T1055.001 Test#1 Atomics T1056.004 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  OR Type=Process) ("mavinject.exe") OR TERM(/INJECTRUNNING) | table _time, host,
  user process, process_*, signature_id, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:process injection:dynamic-link library injection
- collection:input capture:credential api hooking
- defense-evasion:system binary proxy execution
- credential-access:input capture:credential api hooking
- privilege-escalation:process injection:dynamic-link library injection
technique_id:
- T1056.004
- T1218
- T1055.001
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Mavinject/
- https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e

id: '21865.38560'
title: Net.exe Use with URL
description: This use case detects net share commands mapping a drive to a URL as
  observed by the BumbleBee loader.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(net) TERM(use) | regex process="://" | table _time, host, user process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://twitter.com/Kostastsale/status/1701111694611898446

name: O365 Email Send and Hard Delete Suspicious Behavior
id: c97b3d72-0a47-46f9-b742-b89f1cc2d551
version: 6
creation_date: '2025-01-23'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies when an O365 email account sends and then hard deletes email with within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of activity. Threat actors often use this technique to prevent defenders and victims from knowing the account has been compromised. --- Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions"))
    | eval user = lower(UserId), sender = lower(CASE(isnotnull(SendAsUserSmtp),SendAsUserSmtp,isnotnull(SendOnBehalfOfUserSmtp),SendOnBehalfOfUserSmtp,true(),MailboxOwnerUPN)), subject = trim(CASE(Operation IN ("Send","SendAs","SendOnBehalf"),'Item.Subject',Operation IN ("SoftDelete","HardDelete"),'AffectedItems{}.Subject')), -time = _time,file_name = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),split('Item.Attachments',"; "),Operation IN ("SoftDelete","HardDelete"),split('AffectedItems{}.Attachments',"; ")), file_size = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),round(tonumber('Item.SizeInBytes')/1024/1024,2),true(),round(tonumber(replace(file_name, "(.+)\s\((\d+)(b\)$)", "\2"))/1024/1024,2))
    | eval sendtime = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),_time)
    | eval deltime = CASE(Operation IN ("SoftDelete","HardDelete"),_time)
    | stats values(sender) as sender, values(ClientIPAddress) as src, values(ClientInfoString) as http_user_agent, values(Operation) as signature, values(file_name) as file_name, sum(file_size) as file_size, values(Folder.Path) as file_path, min(sendtime) as firstTime, max(deltime) as lastTime, dc(Operation) as opcount, count by subject,user
    | eval timediff = tonumber(lastTime) - tonumber(firstTime)
    | where opcount > 1 AND firstTime < lastTime  AND timediff < 3600
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_email_send_and_hard_delete_suspicious_behavior_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
    - https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ sent and hard deleted an email within a short timeframe
threat_objects:
    - field: src
      type: ip_address
    - field: subject
      type: email_subject
analytic_story:
    - Office 365 Account Takeover
    - Office 365 Collection Techniques
    - Suspicious Emails
    - Data Destruction
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.001
    - T1070.008
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 Email Transport Rule Changed
id: 11ebb7c2-46bd-41c9-81e1-d0b4b34583a2
version: 7
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies when a user with sufficient access to Exchange Online alters the mail flow/transport rule configuration of the organization. Transport rules are a set of rules that can be used by attackers to modify or delete emails based on specific conditions, this activity could indicate an attacker hiding or exfiltrated data.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") AND Operation="*TransportRule"
    | eval object_name = case('Parameters{}.Name'=="Name",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Name$")),true(),ObjectId), object_id = case('Parameters{}.Name'=="Identity",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Identity$")),true(),Id)
    | stats values(object_name) as object_name, min(_time) as firstTime, max(_time) as lastTime, count by object_id, UserId, Operation, signature
    | rename UserId as user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_email_transport_rule_changed_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Legitimate administrative changes for business needs.
references:
    - https://attack.mitre.org/techniques/T1114/003/
    - https://cardinalops.com/blog/cardinalops-contributes-new-mitre-attck-techniques-related-to-abuse-of-mail-transport-rules/
    - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-OAuth-applications-used-to-compromise-email-servers-and-spread-spam/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user [$user$] altered the exchange transport rule id [$object_name$]
threat_objects:
    - field: object_id
      type: signature
    - field: object_name
      type: signature
analytic_story:
    - Data Exfiltration
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.003
    - T1564.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 New Forwarding Mailflow Rule Created
id: 289ed0a1-4c78-4a43-9321-44ea2e089c14
version: 9
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the creation of new mail flow rules in Office 365 that may redirect or copy emails to unauthorized or external addresses. It leverages Office 365 Management Activity logs, specifically querying for the "New-TransportRule" operation and parameters like "BlindCopyTo", "CopyTo", and "RedirectMessageTo". This activity is significant as it can indicate potential data exfiltration or unauthorized access to sensitive information. If confirmed malicious, attackers could intercept or redirect email communications, leading to data breaches or information leakage.
data_source: []
search: "`o365_management_activity` Workload=Exchange Operation=\"New-TransportRule\" | eval match1=mvfind('Parameters{}.Name',\"BlindCopyTo\") | eval match2=mvfind('Parameters{}.Name',\"CopyTo\") | eval match3=mvfind('Parameters{}.Name', \"RedirectMessageTo\") | where match1>= 0 OR match2>= 0 OR match3>=0 | eval ForwardTo=coalesce(BlindCopyTo, CopyTo, RedirectMessageTo) | search ForwardTo!=\"\" | rename UserId as user | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, ForwardTo, vendor_account, vendor_product, dest, signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_forwarding_mailflow_rule_created_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Forwarding mail flow rules may be created for legitimate reasons, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules
    - https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rule-actions
finding:
    title: A new forwarding mailflow rule was created by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1114
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

id: '1083.1127'
title: ProcDump Credential Harvest
description: 'Mimikatz is largely detected by AntiVirus software.As Procdump is a
  legitimate Microsoft tool, it''s not detected by AntiVirus. The goal is to dump
  the lsass.exe process, which contains the credentials, and then give this dump to
  mimikatz.You need Admin rights to use it. Dump the lsass process which contains
  credentials. -- Threat Actor Association: Agrius, Alloy Taurus/Gallium, Antlion,
  BlackCat, FamousSparrow, FIN12, FIN13, Hydrochasma, Lazarus, MuddyWater, TA551,
  Wizard Spider - Software Association: Bazarloader, Conti, Hafnium , IcedID, LockBit,
  NetWalker, Rhysida -- Atomics T1003.001 Test #2 Atomics T1003.001 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` "procdump" "lsass" | rex field=_raw
  max_match=2 "(?<file>[a-zA-Z0-9]+\.dmp") | table _time, host, user, process, parent_process_name,
  file| bin span=30s | stats values(*) as * by _time, host | where match(process,
  "(?i)procdump") AND match(process, "(?i)lsass") | table _time, host, user process,
  parent_process_name, file `hec_collect`'
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1003/001/
- https://github.com/LOLBAS-Project/LOLBAS/pull/182/commits/e14a01bbb5c0b06990cd8f6fc85ee5908ae3da32

id: '6357.18233'
title: Rclone Execution
description: 'Rclone is a command line program to manage files on cloud storage. It
  is a feature rich alternative to cloud vendors'' web storage interfaces. Adversaries
  have been known to use rclone in order to exfiltrate data. -- Threat Actor Association:
  ALPHV/BlackCat, BlackMatter, DarkSide, Daixin Team, FIN7, FIN8 (Syssphinx), Hello
  Kitty / Five Hands, Karakurt, LockBit, Scattered Spider (aka. 0ktapus, UNC3944),
  Turla (akaSecret Blizzard, KRYPTON, and UAC-0003), UNC2628, Wizard Spider - Software
  Association: Akira, AvosLocker, BazarLoader, BianLian, Blackbyte, Blackcat/ALPHV,
  Black Basta, Conti, Lockbit, Ransom Cartel, Royal, Vice Society'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104)
  OR "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") ("rclone.exe" OR
  "rclone32.exe" OR "rclone") | table _time, host, user process, process_*, signature_id,
  parent_* | bin span=1s | stats values(*) as * by _time, host | where match(process,
  "(?i)rclone") `hec_collect`'
techniques:
- exfiltration:exfiltration over web service:exfiltration to cloud storage
- exfiltration:data transfer size limits
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1567.002
- T1030
- T1048.003
data_category:
- PowerShell logs
references:
- https://rclone.org/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkside-ransomware-victims-sold-short/
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- https://unit42.paloaltonetworks.com/royal-ransomware/

id: '5850.18101'
title: Rundll32.exe as Parent Process
description: 'Adversaries may abuse rundll32.exe to proxy execution of malicious code.
  Using rundll32.exe, may avoid triggering security tools that may not monitor execution
  of the rundll32.exe process because of allowlists or false positives from normal
  operations. Rundll32.exe is commonly associated with executing DLL payloads. Threat
  Actor Association: MuddyWater, TA505, Wizard Spider - Software Association: Bazar,
  Clop, Conti, Quantum, Rhysida, Trickbot'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  TERM(rundll32) | regex parent_process_name="(?i)(rundll32)" | table _time, host,
  user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Windows Sysmon
references:
- https://redcanary.com/threat-detection-report/techniques/rundll32/

id: '24804.45867'
title: SoftPerfect Network Scanner Execution
description: 'SoftPerfect Network Scanner is a free port scanner that can be run without
  installation. Due to its portability, it is an attractive tool for threat actors
  during post-compromise discovery activities as reported by DFIR. This use case detects
  executions of netscan.exe, netscan32.exe, or netscan64.exe. While the tool itself
  is not considered malicious, unexpected use should be investigated as it may indicate
  unauthorized discovery activity. -- Software Association: Akira'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "netscan" | where match(process_name, "(?i)\x5cnetscan(32|64)?\.exe") or match(process_path,
  "(?i)\x5cnetscan_portable") | table _time, host, user, process, process_*, parent_process,
  parent_process_*, user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows Sysmon
references:
- https://www.softperfect.com/products/networkscanner/
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://thedfirreport.com/2020/07/13/ransomware-again-but-we-changed-the-rdp-port/
- https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/

name: Unusual Number of Computer Service Tickets Requested
id: ac3b81c0-52f4-11ec-ac44-acde48001122
version: 9
creation_date: '2021-12-03'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: experimental
type: Hunting
description: The following analytic identifies an unusual number of computer service ticket requests from a single source, leveraging Event ID 4769, "A Kerberos service ticket was requested." It uses statistical analysis, including standard deviation and the 3-sigma rule, to detect anomalies in service ticket requests. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, facilitating further compromise and potential data exfiltration.
data_source:
    - Windows Event Log Security 4769
search: |-
    `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
      | bucket span=2m _time
      | stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets
        BY _time, Client_Address, Account_Name
      | eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std
        BY Client_Address, Account_Name
      | eval upperBound=(comp_avg+comp_std*3)
      | eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
      | `unusual_number_of_computer_service_tickets_requested_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: An single endpoint requesting a large number of computer service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systeams and missconfigured systems.
references:
    - https://attack.mitre.org/techniques/T1078/
analytic_story:
    - Active Directory Lateral Movement
    - Active Directory Kerberos Attacks
    - Active Directory Privilege Escalation
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '16041.24006'
title: Unusual svchost Child Process
description: 'Adversaries may inject code into processes in order to evade process-based
  defenses as well as possibly elevate privileges. Process injection is a method of
  executing arbitrary code in the address space of a separate live process. Running
  code in the context of another process may allow access to the process''s memory,
  system/network resources, and possibly elevated privileges. Execution via process
  injection may also evade detection from security products since the execution is
  masked under a legitimate process. Expected Service Host (svchost.exe) activity
  does not normally include certain child processes. Svchost spawning these child
  processes may be an indication of process injection. -- Threat Actor Association:
  Lazarus'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "svchost" ("WdiSystemHost" OR "LicenseManager"
  OR "StorSvc" OR "CDPSvc" OR "cdbhsvc" OR "BthAvctpSvc" OR "SstpSvc" OR "WdiServiceHost"
  OR "imgsvc" OR "TrkWks" OR "WpnService" OR "IKEEXT" OR "PolicyAgent" OR "CryptSvc"
  OR "netprofm" OR "ProfSvc" OR "StateRepository" OR "camsvc" OR "LanmanWorkstation"
  OR "NlaSvc" OR "EventLog" OR "hidserv" OR "DisplayEnhancementService" OR "ShellHWDetection"
  OR "AppHostSvc" OR "fhsvc" OR "CscService" OR "PushToInstall") | regex process="(?i)WdiSystemHost|LicenseManager|StorSvc|CDPSvc|cdbhsvc|BthAvctpSvc|SstpSvc|WdiServiceHost|imgsvc|TrkWks|WpnService|IKEEXT|PolicyAgent|CryptSvc|netprofm|ProfSvc|StateRepository|camsvc|LanmanWorkstation|NlaSvc|EventLog|hidserv|DisplayEnhancementService|ShellHWDetection|AppHostSvc|fhsvc|CscService|PushToInstall"|
  where match(parent_process_name, "(?i)svchost")| where not match(process_name, "(?i)werfault(secure)?|wermgr\.exe")
  | table _time, host, user process, process_*, parent_process_*, signature_id | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:process injection
technique_id: 
- T1055
data_category:
- Windows event logs
references:
- https://redcanary.com/threat-detection-report/techniques/process-injection/