Splunk rules: 0m

id: '8622.11071'
title: Account set to active via Net.exe
description: 'Adversaries may obtain and abuse credentials of a default or disabled
  account as a means of gaining Initial Access, Persistence, Privilege Escalation,
  or Defense Evasion. Default accounts are those that are built-into an OS, such as
  the Guest or Administrator accounts on Windows systems. -- Threat Actor Association:
  Unfading Sea Haze - Software Association: RansomHub -- Atomics T1078.001 Test#1
  Atomics T1078.001 Test#2 Atomics T1564 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<") ("/active:yes" OR "/active:y") | table _time, host, user, signature_id,
  process, process_*, parent_process_*, src_ip, dest_ip, dest_port `group_events("host",
  1)` '
techniques:
- privilege-escalation:valid accounts:default accounts
- persistence:account manipulation
- defense-evasion:valid accounts:default accounts
- persistence:valid accounts:default accounts
technique_id:
- T1078.001
- T1098
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.001/T1078.001.md

name: Detect Unauthorized Assets by MAC address
id: dcfd6b40-42f9-469d-a433-2e53f7489ff4
version: 9
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: The following analytic identifies unauthorized devices attempting to connect to the organization's network by inspecting DHCP request packets. It detects this activity by comparing the MAC addresses in DHCP requests against a list of known authorized devices stored in the assets_by_str.csv file. This activity is significant for a SOC because unauthorized devices can pose security risks, including potential data breaches or network disruptions. If confirmed malicious, this activity could allow an attacker to gain unauthorized network access, potentially leading to further exploitation or data exfiltration.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Network_Sessions
      WHERE nodename=All_Sessions.DHCP All_Sessions.tag=dhcp
      BY All_Sessions.dest_ip All_Sessions.dest_mac
    | dedup All_Sessions.dest_mac
    | `drop_dm_object_name("Network_Sessions")`
    | `drop_dm_object_name("All_Sessions")`
    | search NOT [
    | inputlookup asset_lookup_by_str
    | rename mac as dest_mac
    | fields + dest_mac]
    | `detect_unauthorized_assets_by_mac_address_filter`
how_to_implement: This search uses the Network_Sessions data model shipped with Enterprise Security. It leverages the Assets and Identity framework to populate the assets_by_str.csv file located in SA-IdentityManagement, which will contain a list of known authorized organizational assets including their MAC addresses. Ensure that all inventoried systems have their MAC address populated.
known_false_positives: This search might be prone to high false positives. Please consider this when conducting analysis or investigations. Authorized devices may be detected as unauthorized. If this is the case, verify the MAC address of the system responsible for the false positive and add it to the Assets and Identity framework with the proper information.
references: []
finding:
    title: Potentially Unauthorized Device observed [ $dest_ip$ ]
    entity:
        field: dest_ip
        type: system
        score: 50
analytic_story:
    - Asset Tracking
asset_type: Infrastructure
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network
baselines:
    - Count of assets by category

name: Email Attachments With Lots Of Spaces
id: 56e877a6-1455-4479-ada6-0550dc1e22f8
version: 11
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
description: The following analytic detects email attachments with an unusually high number of spaces in their file names, which is a common tactic used by attackers to obfuscate file extensions. It leverages the Email data model to identify attachments where the ratio of spaces to the total file name length exceeds 10%. This behavior is significant as it may indicate an attempt to bypass security filters and deliver malicious payloads. If confirmed malicious, this activity could lead to the execution of harmful code or unauthorized access to sensitive information within the recipient's environment.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count values(All_Email.recipient) as recipient_address min(_time) as firstTime max(_time) as lastTime FROM datamodel=Email
      WHERE All_Email.file_name="*"
      BY All_Email.src_user, All_Email.file_name All_Email.message_id
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name("All_Email")`
    | eval space_ratio = (mvcount(split(file_name," "))-1)/len(file_name)
    | search space_ratio >= 0.1
    | rex field=recipient_address "(?<recipient_user>.*)@"
    | `email_attachments_with_lots_of_spaces_filter`
how_to_implement: "You need to ingest data from emails. Specifically, the sender's address and the file names of any attachments must be mapped to the Email data model. The threshold ratio is set to 10%, but this value can be configured to suit each environment.\n**Splunk Phantom Playbook Integration**\nIf Splunk Phantom is also configured in your environment, a playbook called \"Suspicious Email Attachment Investigate and Delete\" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search. The finding based event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox."
known_false_positives: No false positives have been identified at this time.
references: []
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 20
          message: Abnormal number of spaces present in attachment filename from $src_user$
analytic_story:
    - Data Destruction
    - Emotet Malware DHS Report TA18-201A
    - Hermetic Wiper
    - Suspicious Emails
asset_type: Endpoint
mitre_attack_id:
    - T1566.001
    - T1036.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '6147.10087'
title: Esentutl Execution
description: 'Esentutl is a command-line tool that provides database utilities for
  the Windows Extensible Storage Engine. This use case looks for esentutl execution
  or from an executable running common process command line switches used by adversaries.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat Actor Association:
  Wizard Spider Software Association: Bazar, Conti, Trickbot Atomics T1003.002 Test
  #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ( "esentutl.exe" OR (".exe" "/y" "/d") OR "esentutl" ) | regex process="(?i)(esentutl|\.exe)\"?\s.*\/y\s.*\/d\s"
  | table _time, host, user, signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping:ntds
- lateral-movement:lateral tool transfer
- defense-evasion:hide artifacts
technique_id:
- T1105
- T1003.002
- T1003.003
- T1570
- T1564
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html

name: Fortinet Appliance Auth bypass
id: a83122f2-fa09-4868-a230-544dbc54bc1c
version: 10
creation_date: '2022-10-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects attempts to exploit CVE-2022-40684, a Fortinet appliance authentication bypass vulnerability.
    It identifies REST API requests to the /api/v2/ endpoint using various HTTP methods (GET, POST, PUT, DELETE) that may indicate unauthorized modifications, such as adding SSH keys or creating new users.
    This detection leverages the Web datamodel to monitor specific URL patterns and HTTP methods.
    This activity is significant as it can lead to unauthorized access and control over the appliance.
    If confirmed malicious, attackers could gain persistent access, reroute network traffic, or capture sensitive information.
data_source:
    - Palo Alto Network Threat
search: |-
    | tstats `security_content_summariesonly`
             count min(_time) as firstTime
                   max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url = "*/api/v2/cmdb/system/admin*"
    Web.http_method IN ("GET", "PUT")
    BY Web.http_user_agent
       Web.http_method Web.url
       Web.url_length
       Web.src Web.dest
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `fortinet_appliance_auth_bypass_filter`
how_to_implement: |
    This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache. Splunk for Nginx, or Splunk for Palo Alto.
known_false_positives: |
    GET requests will be noisy and need to be filtered out or removed from the query based on volume.
    Restrict analytic to known publicly facing Fortigates, or run analytic as a Hunt until properly tuned.
    It is also possible the user agent may be filtered on Report Runner or Node.js only for the exploit, however, it is unknown at this if other user agents may be used.
references:
    - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/
    - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/
    - https://github.com/horizon3ai/CVE-2022-40684
    - https://www.horizon3.ai/fortinet-iocs-cve-2022-40684/
    - https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis
    - https://github.com/rapid7/metasploit-framework/pull/17143
finding:
    title: Potential CVE-2022-40684 against a Fortinet appliance may be occurring against $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - CVE-2022-40684 Fortinet Appliance Auth bypass
asset_type: Network
cve:
    - CVE-2022-40684
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: GCP Successful Single-Factor Authentication
id: 40e17d88-87da-414e-b253-8dc1e4f9555b
version: 13
creation_date: '2022-10-14'
modification_date: '2026-05-13'
author: Bhavin Patel, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies a successful single-factor authentication event against Google Cloud Platform (GCP) for an account without Multi-Factor Authentication (MFA) enabled. It uses Google Workspace login event data to detect instances where MFA is not utilized. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to GCP resources, potentially leading to data breaches, service disruptions, or further exploitation within the cloud environment.
data_source:
    - Google Workspace
search: |-
    `gws_reports_login` event.name=login_success NOT `gws_login_mfa_methods`
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY user, src_ip, login_challenge_method,
           app, event.name, vendor_account,
           action
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gcp_successful_single_factor_authentication_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events.
known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
references:
    - https://attack.mitre.org/techniques/T1078/004/
    - https://support.google.com/a/answer/175197?hl=en
    - https://www.forbes.com/sites/daveywinder/2020/07/08/new-dark-web-audit-reveals-15-billion-stolen-logins-from-100000-breaches-passwords-hackers-cybercrime/?sh=69927b2a180f
finding:
    title: Successful authentication for user $user$ without MFA
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - GCP Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Google Cloud Platform tenant
mitre_attack_id:
    - T1078.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Get ADDefaultDomainPasswordPolicy with Powershell
id: 36e46ebe-065a-11ec-b4c7-acde48001122
version: 10
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: |-
    The following analytic detects the execution of `powershell.exe` running the `Get-ADDefaultDomainPasswordPolicy` cmdlet, which is used to retrieve the password policy in a Windows domain.
    This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
    Monitoring this activity is crucial as it can indicate attempts by adversaries to gather information about domain policies for situational awareness and Active Directory discovery.
    If confirmed malicious, this activity could lead to further reconnaissance and potential exploitation of domain security settings.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    (
        `process_powershell`
        OR
        `process_cmd`
    )
    Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `get_addefaultdomainpasswordpolicy_with_powershell_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
    - https://attack.mitre.org/techniques/T1201/
    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1201
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Ingress Tool Transfer with Curl
id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857
version: 14
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the curl command with specific switches (-O, -sO, -ksO, --output) commonly used to download remote scripts or binaries. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it may indicate an attempt to download and execute potentially malicious files, often used in initial stages of an attack. If confirmed malicious, this could lead to unauthorized code execution, enabling attackers to compromise the system further.
data_source:
    - Sysmon for Linux EventID 1
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_name=curl
    Processes.process IN ("*-O*","*-sO*","*-ksO*","*--output*")
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id
       Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where match(process, "(?i)(-O|-sO|-ksO|--output)")
    | `linux_ingress_tool_transfer_with_curl_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will be present. Tune and then change type to TTP.
references:
    - https://gtfobins.github.io/gtfobins/curl/
    - https://curl.se/docs/manpage.html#-I
    - https://gtfobins.github.io/gtfobins/curl/
    - https://github.com/rapid7/metasploit-framework/search?q=curl
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ to download a remote file. Review activity for further details.
        - field: dest
          type: system
          score: 20
          message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ to download a remote file. Review activity for further details.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Ingress Tool Transfer
    - Linux Living Off The Land
    - XorDDos
    - NPM Supply Chain Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '19656.34274'
title: LSA Authentication Packages Registry Key Modified
description: 'Adversaries can use the autostart mechanism provided by Local Security
  Authority (LSA) authentication packages for persistence or privilege escalation
  by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\.
  The binary will then be executed by the system when the authentication packages
  are loaded. This use case detects modifications to registry values involving LSA
  authentication package configurations. -- Software Association: Cactus -- Atomics
  T1547.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ((TERM(Set-ItemProperty)
  OR TERM(sp) OR (TERM(reg) TERM(add)))) ("HKLM" OR "HKEY_LOCAL_MACHINE") ("lsa" "Authenticaton
  Packages") | table _time, host, user, parent_process*, process, process_*, signature_id,
  user_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:boot or logon autostart execution:authentication package
- persistence:boot or logon autostart execution:authentication package
technique_id:
- T1547.002
data_category:
- PowerShell logs
references:
- https://www.crysys.hu/publications/files/skywiper.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.002/T1547.002.md#atomic-test-1---authentication-package

id: '36445.64013'
title: masscan Execution - Windows
description: Masscan is a high-performance, open-source network scanning tool designed
  to scan large ranges of IP addresses for open ports, offering similar functionality
  to Nmap but with significantly faster scanning capabilities. Threat actors may use
  port and vulnerability scanning tools to identify running services and potential
  exploits on remote hosts and network devices. This use case detects masscan executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(masscan) OR
  "masscan.exe") | table _time, host, user, process | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- PowerShell logs
references:
- https://github.com/robertdavidgraham/masscan/tree/master
- https://attack.mitre.org/techniques/T1046/
- https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera
- https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
- https://www.kali.org/tools/masscan/

id: '1033.1042'
title: Mimikatz
description: 'Mimikatz is used to extract plaintexts passwords, hash, PIN code and
  Kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket
  or build Golden tickets. -- Threat Actor Association: APT10/Cicada, APT27/Emissary
  Panda, APT29/Nobelium, APT41/Wicked Panda, Carbanak, DarkSide, BlackMatter, FamousSparrow,
  FIN7, FIN12, Hello Kitty / Five Hands, Karakurt, Lapsus$, LockBit, Memento Team,
  TRACER KITTEN, TRAVELING SPIDER, SILENCE, UNC2596, Witchetty -- Software Association:
  Blackcat/ALPHV, Conti, Cuba, Midas, Lockbit, LV, Nefilim, Play, Qakbot, Revil, SamSam,
  Stonefly, WASTEDLOCKER -- Atomics T1003.001 Test #6 Atomics T1003.001 Test #10 Atomics
  T1550.002 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("cmd.exe" OR "powershell.exe") OR ((TERM(EventCode=4690)
  OR "<EventID>4690<") Target_Process_ID="0x4") OR ((TERM(EventCode=4656) OR "<EventID>4656<")
  "lsass.exe" TERM(Read) TERM(from) TERM(process) TERM(memory)) | eval Source_Process_ID=if(like(Source_Process_ID,"%x%"),tonumber(Source_Process_ID,16),Source_Process_ID)|
  eval process_id=mvappend(process_id, Source_Process_ID) | table _time, host, user
  signature_id, user, process_id, process_name, process_path, process, parent_process_id,
  parent_process_name, parent_process_path | bin span=5s | stats values(*) as * by
  _time, host, user | eventstats dc(signature_id) as dc_signature_id by process_id,
  _time| where dc_signature_id=3 '
techniques:
- credential-access:os credential dumping:lsass memory
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping:dcsync
- credential-access:os credential dumping:lsa secrets
- credential-access:steal or forge kerberos tickets:golden ticket
- credential-access:steal or forge kerberos tickets:silver ticket
- credential-access:unsecured credentials:credentials in registry
technique_id:
- T1552.002
- T1003.006
- T1003.004
- T1003.002
- T1558.002
- T1558.001
- T1003.001
data_category:
- Windows event logs
references:
- https://www.sans.org/reading-room/whitepapers/detection/mimikatz-overview-defenses-detection-36780

name: PetitPotam Network Share Access Request
id: 95b8061a-0a67-11ec-85ec-acde48001122
version: 10
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects network share access requests indicative of the PetitPotam attack (CVE-2021-36942). It leverages Windows Event Code 5145, which logs attempts to access network share objects. This detection is significant as PetitPotam can coerce authentication from domain controllers, potentially leading to unauthorized access. If confirmed malicious, this activity could allow attackers to escalate privileges or move laterally within the network, posing a severe security risk. Ensure Event Code 5145 is enabled via Group Policy to utilize this analytic effectively.
data_source:
    - Windows Event Log Security 5145
search: |-
    `wineventlog_security` SubjectUserName="ANONYMOUS LOGON" EventCode=5145 RelativeTargetName=lsarpc
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, SubjectUserSid, ShareName,
           src, AccessMask, AccessReason
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `petitpotam_network_share_access_request_filter`
how_to_implement: Windows Event Code 5145 is required to utilize this analytic and it may not be enabled in most environments.
known_false_positives: False positives have been limited when the Anonymous Logon is used for Account Name.
references:
    - https://attack.mitre.org/techniques/T1187/
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5145
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
finding:
    title: A remote host is enumerating a $dest$ to identify permissions. This is a precursor event to CVE-2021-36942, PetitPotam.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - PetitPotam NTLM Relay on Active Directory Certificate Services
asset_type: Endpoint
cve:
    - CVE-2021-36942
mitre_attack_id:
    - T1187
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '8620.11045'
title: Potential SSH with System User
description: 'NIX System users, typically 1…999 are users that do not map to actual
  “human” users, but are used as security identities for system daemons, in order
  to implement privilege separation and run system daemons with minimal privileges.
  This use case looks for attempts to ssh into and user account with a "Default" user
  id for most NIX distributions. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` type=USER_START | regex auid=^\d+|
  regex auid!="0|\d{4,}"| regex exe="(?i)ssh" | eval src_ip=addr, user=coalesce(acct,
  id, ID) | table _time, host, user src_ip, process_*, user `group_events(host, 1)`
  | lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns | iplocation
  prefix="src_" src_ip | rename src_Country as src_country '
techniques:
- privilege-escalation:valid accounts:default accounts
- defense-evasion:valid accounts:default accounts
- persistence:valid accounts:default accounts
technique_id:
- T1078.001
data_category:
- Linux audit logs
references:
- https://systemd.io/UIDS-GIDS/

name: Powershell Remote Services Add TrustedHost
id: bef21d24-297e-45e3-9b9a-c6ac45450474
version: 11
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a PowerShell script that modifies the 'TrustedHosts' configuration via EventCode 4104. It leverages PowerShell Script Block Logging to identify commands targeting WSMan settings, specifically those altering or concatenating trusted hosts. This activity is significant as it can indicate attempts to manipulate remote connection settings, potentially allowing unauthorized remote access. If confirmed malicious, this could enable attackers to establish persistent remote connections, bypass security protocols, and gain unauthorized access to sensitive systems and data.
data_source:
    - Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104  ScriptBlockText = "*WSMan:\\localhost\\Client\\TrustedHosts*" ScriptBlockText IN ("* -Value *", "* -Concatenate *") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_services_add_trustedhost_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: user and network administrator may used this function to add trusted host.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
finding:
    title: a powershell script adding a remote trustedhost on $dest$ .
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: a powershell script adding a remote trustedhost on $dest$ .
analytic_story:
    - DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
    - T1021.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Process Writing DynamicWrapperX
id: b0a078e4-2601-11ec-9aec-acde48001122
version: 9
creation_date: '2021-10-05'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects a process writing the dynwrapx.dll file to disk and registering it in the registry. It leverages data from the Endpoint datamodel, specifically monitoring process and filesystem events. This activity is significant because DynamicWrapperX is an ActiveX component often used in scripts to call Windows API functions, and its presence in non-standard locations is highly suspicious. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment. Immediate investigation of parallel processes and registry modifications is recommended.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_name="dynwrapx.dll"
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `process_writing_dynamicwrapperx_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
references:
    - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
    - https://www.script-coding.com/dynwrapx_eng.html
    - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
    - https://tria.ge/210929-ap75vsddan
    - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
analytic_story:
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1059
    - T1559.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Splunk Authentication Token Exposure in Debug Log
id: 9a67e749-d291-40dd-8376-d422e7ecf8b5
version: 9
creation_date: '2024-03-27'
modification_date: '2026-06-24'
author: Rod Soto, Chase Franklin
status: production
type: TTP
description: |-
    The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise.
    It leverages logs from the `splunkd` component with a DEBUG log level, specifically searching for event messages that validate tokens. This activity is significant because exposed tokens can be exploited by attackers to gain unauthorized access to the Splunk environment.
    If confirmed malicious, this exposure could lead to unauthorized data access, privilege escalation, and potential compromise of the entire Splunk infrastructure.
    Monitoring and addressing this vulnerability is crucial for maintaining the security and integrity of the Splunk deployment.
data_source: []
search: |-
    `splunkd`
    component=JsonWebToken
    log_level=DEBUG
    eventtype="splunkd-log"
    event_message="Validating token:*"
    | rex "Validating token: (?<token>.*)\.$"
    | search token!=None
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(log_level) as log_level
                  values(event_message) as event_message
      by index, sourcetype, host, token
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `splunk_authentication_token_exposure_in_debug_log_filter`
how_to_implement: Requires access to internal Splunk indexes.
known_false_positives: Only applies to affected versions of Splunk Enterprise below 9.2.1, 9.1.4, and 9.0.9
references:
    - https://advisory.splunk.com/advisories/SVD-2024-0301
finding:
    title: Possible JsonWebToken exposure, please investigate affected $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Splunk Vulnerabilities
asset_type: Splunk Server
cve:
    - CVE-2024-29945
mitre_attack_id:
    - T1654
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: application
security_domain: endpoint

name: Suspicious Email Attachment Extensions
id: 473bd65f-06ca-4dfe-a2b8-ba04ab4a0084
version: 12
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
description: The following analytic detects emails containing attachments with suspicious file extensions. It leverages the Email data model in Splunk, using the tstats command to identify emails where the attachment filename is not empty. This detection is significant for SOC analysts as it highlights potential phishing or malware delivery attempts, which are common vectors for data breaches and malware infections. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, system compromise, or data exfiltration. Immediate review and analysis of the identified emails and attachments are crucial to mitigate these risks.
data_source: []
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Email.All_Email where All_Email.file_name="*"

    by All_Email.src_user All_Email.file_name All_Email.file_size All_Email.message_id
       All_Email.message_info All_Email.process All_Email.process_id All_Email.orig_dest
       All_Email.orig_recipient

    | `drop_dm_object_name(All_Email)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious
    | search suspicious=true
    | `suspicious_email_attachment_extensions_filter`
how_to_implement: |
    You need to ingest data from emails. Specifically, the sender's address and the file names of any attachments must be mapped to the Email data model.
    **Splunk Phantom Playbook Integration**\nIf Splunk Phantom is also configured in
    your environment, a Playbook called \"Suspicious Email Attachment Investigate and
    Delete\" can be configured to run when any results are found by this detection search.
    To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`,
    and add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response
    Actions when configuring this detection search. The finding event will be sent to
    Phantom and the playbook will gather further information about the file attachment
    and its network behaviors. If Phantom finds malicious behavior and an analyst approves
    of the results, the email will be deleted from the user's inbox.'"
known_false_positives: No false positives have been identified at this time.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Email attachment $file_name$ with suspicious extension from $src_user$
analytic_story:
    - Data Destruction
    - Emotet Malware DHS Report TA18-201A
    - Hermetic Wiper
    - Suspicious Emails
asset_type: Endpoint
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '33701.59575'
title: Suspicious Execution via Microsoft Common Console
description: 'Microsoft Management Console (MMC) can be used to create, open, and
  save custom consoles that contain administrative tools created by Microsoft, called
  snap-ins. These snap-ins may be used to manage Windows systems locally or remotely.
  MMC can also be used to open Microsoft created .msc files to manage system configuration.
  Threat actors may leverage malicious .msc files to gain full code execution via
  mmc.exe as observed in the GrimResource technique. This use case child processes
  created by mmc.exe that do not originate from common system directories or standard
  application paths. NOTE: Due to its extended logging capabilities for parent process
  behaviors and attributes, Sysmon is recommended for best rule fidelity.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(mmc) OR "mmc.exe") | where match(parent_process_name,
  "(?i)mmc\.exe") and !match(process_path, "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(mmc|wermgr|WerFault)\.exe)|Program\sFiles(\s\(x86\))?\x5c.*\.exe|Windows\x5cSystem32\x5cspool\x5cdrivers\x5cx64\x5c3\x5c\S+\.exe")
  and !match(process, "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(wermgr|WerFault)\.exe)")
  | table _time, host, user, process, parent_process, parent_process_*, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218.014
data_category:
- Windows event logs
references:
- https://www.elastic.co/security-labs/grimresource

name: Windows Enable Win32 ScheduledJob via Registry
id: 12c80db8-ef62-4456-92df-b23e1b3219f6
version: 10
creation_date: '2023-03-27'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of a new DWORD value named "EnableAt" in the registry path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration". This modification enables the use of the at.exe or wmi Win32_ScheduledJob commands to add scheduled tasks on a Windows endpoint. The detection leverages registry event data from the Endpoint datamodel. This activity is significant because it may indicate that an attacker is enabling the ability to schedule tasks, potentially to execute malicious code at specific times or intervals. If confirmed malicious, this could allow persistent code execution on the system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Schedule\\Configuration*" Registry.registry_value_name=EnableAt by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_enable_win32_scheduledjob_via_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: In some cases, an automated script or system may enable this setting continuously, leading to false positives. To avoid such situations, it is recommended to monitor the frequency and context of the registry modification and modify or filter the detection rules as needed. This can help to reduce the number of false positives and ensure that only genuine threats are identified. Additionally, it is important to investigate any detected instances of this modification and analyze them in the broader context of the system and network to determine if further action is necessary.
references:
    - https://securityonline.info/wmiexec-regout-get-outputdata-response-from-registry/
    - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A process has modified the schedule task registry value - EnableAt - on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: A process has modified the schedule task registry value - EnableAt - on endpoint $dest$ by user $user$.
analytic_story:
    - Active Directory Lateral Movement
    - Scheduled Tasks
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Process With NetExec Command Line Parameters
id: adbff89c-c1f2-4a2e-88a4-b5e645856510
version: 11
creation_date: '2024-12-27'
modification_date: '2026-05-13'
author: Steven Dick, Github Community
status: production
type: TTP
description: The following analytic detects the use of NetExec (formally CrackmapExec) a toolset used for post-exploitation enumeration and attack within Active Directory environments through command line parameters. It leverages Endpoint Detection and Response (EDR) data to identify specific command-line arguments associated with actions like ticket manipulation, kerberoasting, and password spraying. This activity is significant as NetExec is used by adversaries to exploit Kerberos for privilege escalation and lateral movement. If confirmed malicious, this could lead to unauthorized access, persistence, and potential compromise of sensitive information within the network.
data_source:
    - Windows Event Log Security 4688
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes
      WHERE NOT Processes.os="Linux" Processes.process_name IN ("nxc.exe")
        OR
        Processes.original_file_name IN ("nxc.exe")
        OR
        (Processes.process IN ("* smb *","* ssh *","* ldap *","* ftp *","* wmi *","* winrm *","* rdp *","* vnc *","* mssql *","* nfs *")
        AND
        ((Processes.process = "* -p *"
        AND
        Processes.process = "* -u *")
        OR
        Processes.process IN ("* -x *","* -M *","* --*")))
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_process_with_netexec_command_line_parameters_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as NetExec. Filter as needed.
references:
    - https://www.netexec.wiki/
    - https://www.johnvictorwolfe.com/2024/07/21/the-successor-to-crackmapexec/
    - https://attack.mitre.org/software/S0488/
finding:
    title: NetExec command line parameters were used on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: NetExec command line parameters were used on $dest$ by $user$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Active Directory Kerberos Attacks
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1550.003
    - T1558.003
    - T1558.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint