Splunk rules: 0o

name: CMD Echo Pipe - Escalation
id: eb277ba0-b96b-11eb-b00e-acde48001122
version: 16
creation_date: '2021-05-27'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. It detects command-line executions where `cmd.exe` uses `echo` to write to a named pipe, such as `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant as it indicates potential privilege escalation attempts. If confirmed malicious, attackers could gain elevated privileges, enabling further compromise and persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_cmd`
        OR
        Processes.process=*%comspec%* (Processes.process=*echo*
        AND
        Processes.process=*pipe*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cmd_echo_pipe___escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time. fidelity.
references:
    - https://redcanary.com/threat-detection-report/threats/cobalt-strike/
    - https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Graceful Wipe Out Attack
    - Cobalt Strike
    - Compromised Windows Host
    - BlackByte Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1059.003
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '7833.9440'
title: Finger Execution
description: 'Finger.exe, a command that ships with Windows to retrieve information
  about users on remote computers running the Finger service or daemon. Communication
  is carried via the Name/Finger network communication protocol.As this is a common
  component on Windows, it can be leveraged to perform living-off-the-land attacks.
  -- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Software Association:
  MINEBRIDGE -- Atomics T1105 Test #16 '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("finger.exe" OR (".exe" "@")) | table _time,
  host, user process, process_*, signature_id, parent_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process_name,"(?i)finger") OR match(process,"(?i)(finger)|\S+@(.*?\.\w{2,4}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows event logs
references:
- https://dmfrsecurity.com/2020/12/31/using-finger-exe-to-transfer-files/
- https://strontic.github.io/xcyclopedia/library/finger.exe-8E9AFA491D704EAF9183B15A189BBDE2.html

id: '32477.57725'
title: iphlpapi.dll File Write to Appdata_Local_Microsoft
description: Adversaries may execute their own malicious payloads by side-loading
  DLLs. Similar to DLL Search Order Hijacking, side-loading involves hijacking which
  DLL a program loads. But rather than just planting the DLL within the search order
  of a program then waiting for the victim application to be invoked, adversaries
  may directly side-load their payloads by planting then invoking a legitimate application
  that executes their payload(s). Researchers have reported that malicious documents
  can use DLL sideloading using Teams or OneDrive to establish C&C. This use case
  iphlpapi.dll file writes in a subfolder under the AppData\Local\Microsoft path,
  indicating potential abuse of Microsoft applications to sideload malicious DLLs.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=11) OR "<EventID>11<")
  "iphlpapi.dll" "\\AppData\\Local\\Microsoft" | regex TargetFilename="(?i)\x5cAppData\x5cLocal\x5cMicrosoft\x5c.*iphlpapi\.dll"
  | table _time, host, user, process, process_*, file_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- persistence:hijack execution flow:dll side-loading
technique_id:
- T1574.002
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1574/002/
- https://detection.fyi/sigmahq/sigma/windows/file/file_event/file_event_win_iphlpapi_dll_sideloading/
- https://cyble.com/blog/targeted-attacks-being-carried-out-via-dll-sideloading/

name: Linux Auditd Setuid Using Chmod Utility
id: 8230c407-1b47-4d95-ac2e-718bd6381386
version: 10
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This detection leverages data from Linux Auditd, focusing on process names and command-line arguments related to chmod. This activity is significant as it can indicate an attempt to escalate privileges or maintain persistence on a system. If confirmed malicious, an attacker could gain elevated access, potentially compromising sensitive data or critical system functions.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd`  proctitle IN ("*chmod *")  AND proctitle IN ("* u+s *", "* g+s *", "* 4777 *", "* 4577 *")
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_setuid_using_chmod_utility_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to set the SUID or SGID bit on files using the chmod utility.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1548.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Loading Of Dynwrapx Module
id: eac5e8ba-4857-11ec-9371-acde48001122
version: 10
creation_date: '2021-10-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the loading of the dynwrapx.dll module, which is associated with the DynamicWrapperX ActiveX component. This detection leverages Sysmon EventCode 7 to identify processes that load or register dynwrapx.dll. This activity is significant because DynamicWrapperX can be used to call Windows API functions in scripts, making it a potential tool for malicious actions. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence on the host. Immediate investigation of parallel processes and registry modifications is recommended.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR  Product = "DynamicWrapperX") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `loading_of_dynwrapx_module_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
references:
    - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
    - https://www.script-coding.com/dynwrapx_eng.html
    - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
    - https://tria.ge/210929-ap75vsddan
    - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
finding:
    title: dynwrapx.dll loaded by process $process_name$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Remcos
    - AsyncRAT
asset_type: Endpoint
mitre_attack_id:
    - T1055.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Microsoft Defender Incident Alerts
id: 13435b55-afd8-46d4-9045-7d5457f430a5
version: 9
creation_date: '2024-10-30'
modification_date: '2026-05-13'
author: Bryan Pluta, Bhavin Patel, Splunk, lyonheart14, Github Community
status: production
type: TTP
description: The following analytic is to leverage alerts from Microsoft Defender O365 Incidents. This query aggregates and summarizes all alerts from Microsoft Defender O365 Incidents, providing details such as the destination, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk object, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a static mapping to set the risk score based on the severity of the alert.
data_source:
    - MS365 Defender Incident Alerts
search: "`ms365_defender_incident_alerts`  (dest=* OR user=*)\n  | eval tmp_entities=json_extract(_raw, \"entities\"), tmp_entitymv=json_array_to_mv(tmp_entities), tmp_filtered_mv=mvfilter(json_extract(tmp_entitymv, \"verdict\") != \"Clean\"), entityType = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"entityType\")), filePath = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"filePath\")), processCommandLine = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"processCommandLine\")), ipAddress = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"ipAddress\")), registryKey = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"registryKey\")), url = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"url\"))\n  | eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, \"entityType\") = \"File\"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"fileName\"))\n  | eval risk_score=case(severity=\"informational\", 5, severity=\"low\", 15, severity=\"medium\", 25, severity=\"high\", 50, true(), 2)\n  | stats count  min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(dest) as dest values(user) as user values(risk_score) as risk_score\n    BY id description\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `microsoft_defender_incident_alerts_filter`"
how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype.
known_false_positives: False positives may vary based on Microsoft Defender configuration; monitor and filter out the alerts that are not relevant to your environment.
references:
    - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide
    - https://learn.microsoft.com/en-us/graph/api/resources/security-alert?view=graph-rest-1.0
    - https://splunkbase.splunk.com/app/6207
    - https://jasonconger.com/splunk-azure-gdi/
finding:
    title: $severity$ alert for $dest$ - $signature$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: $severity$ alert for $dest$ - $signature$
threat_objects:
    - field: file_name
      type: file_name
    - field: ip_address
      type: ip_address
    - field: process
      type: process_name
    - field: registry_key
      type: registry_path
    - field: url
      type: url
analytic_story:
    - Critical Alerts
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Recon Using WMI Class
id: 018c1972-ca07-11eb-9473-acde48001122
version: 16
creation_date: '2021-06-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious PowerShell activity via EventCode 4104, where WMI performs event queries to gather information on running processes or services. This detection leverages PowerShell Script Block Logging to identify specific WMI queries targeting system information classes like Win32_Bios and Win32_OperatingSystem. This activity is significant as it often indicates reconnaissance efforts by an adversary to profile the compromised machine. If confirmed malicious, the attacker could gain detailed system information, aiding in further exploitation or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: "`powershell` EventCode=4104 AND ScriptBlockText IN (\"*SELECT*\", \"*Get-WmiObject*\") AND ScriptBlockText IN (\"*Win32_Bios*\", \"*Win32_OperatingSystem*\", \"*Win32_Processor*\", \"*Win32_ComputerSystem*\", \"*Win32_PnPEntity*\", \"*Win32_ShadowCopy*\", \"*Win32_DiskDrive*\", \"*Win32_PhysicalMemory*\", \"*Win32_BaseBoard*\", \"*Win32_DisplayConfiguration*\")\n  | fillnull\n  | stats count min(_time) as firstTime max(_time) as lastTime\n    BY dest signature signature_id\n       user_id vendor_product EventID\n       Guid Opcode Name\n       Path ProcessID ScriptBlockId\n       ScriptBlockText\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `recon_using_wmi_class_filter`"
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: network administrator may used this command for checking purposes
references:
    - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script contains host recon commands detected on host $dest$
        - field: user_id
          type: user
          score: 20
          message: A suspicious powershell script contains host recon commands detected on host $dest$
analytic_story:
    - Hermetic Wiper
    - Quasar RAT
    - Malicious PowerShell
    - Data Destruction
    - AsyncRAT
    - MoonPeak
    - LockBit Ransomware
    - Malicious Inno Setup Loader
    - Qakbot
    - Industroyer2
    - Scattered Spider
    - BlankGrabber Stealer
    - Axios Supply Chain Post Compromise
    - VIP Keylogger
asset_type: Endpoint
mitre_attack_id:
    - T1592
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Sdclt UAC Bypass
id: d71efbf6-da63-11eb-8c6e-acde48001122
version: 12
creation_date: '2021-07-08'
modification_date: '2026-05-13'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious modifications to the sdclt.exe registry, a technique often used to bypass User Account Control (UAC). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific registry paths and values associated with sdclt.exe. This activity is significant because UAC bypasses can allow attackers to execute payloads with elevated privileges without user consent. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, and potential persistence within the environment, posing a severe security risk.
data_source:
    - Sysmon EventID 12
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited to no false positives are expected.
references:
    - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
    - https://github.com/hfiref0x/UACME
    - https://www.cyborgsecurity.com/cyborg-labs/threat-hunt-deep-dives-user-account-control-bypass-via-registry-modification/
finding:
    title: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '43757.85557'
title: Security Software Discovery via Findstr.exe
description: Threat actors may enumerate security software, configurations, and monitoring
  tools on a system or cloud environment to evade defenses or tailor their attack.
  This can involve querying registry keys, running system commands, or checking for
  specific processes related to security tools. This use case detects instances where
  findstr.exe or find.exe are executed to search for security software on the host.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("findstr.exe" OR
  TERM(findstr) OR "find.exe" OR TERM(find)) ("avira" OR "cb" OR "cylance" OR "defender"
  OR "kaspersky" OR "kes" OR "mc" OR "sec" OR "sentinel" OR "symantec" OR "virus"
  OR "wrsa" OR "opssvc" OR "avastui" OR "avgui" OR "bdservicehost" OR "nsWscSvc" OR
  "ekrn" OR "sophoshealth" OR "falcon") | where match(process, "(?i)\w+(\.exe)?\x22?\s+(avira|cb|cylance|defender|kaspersky|kes|mc|sec|sentinel|symantec|virus|wrsa|opssvc|avastui|avgui|bdservicehost|nsWscSvc|ekrn|sophoshealth|falcon)\x22?$")|
  table _time, host, user, process, process_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- discovery:software discovery:security software discovery
technique_id:
- T1518.001
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1518/001/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/findstr
- https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/

id: '6176.6730'
title: Suspicious DLLhost Execution
description: 'Used by Windows to DLL Surrogate COM Objects, “dllhost.exe” process
  has been used by malware in the past (especially trickbot) and can be used to load
  a registered or hijacked COM Server payload. -- Living Off the Land Binary and Scripts
  (LOLBAS) (LOLBIN) -- Threat Actor Association: APT29, Wizard Spider - Software Association:
  Avaddon, Bazarloader, Blackcat/ALPHV, Conti, Quantum'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") (TERM(dllhost) OR
  "dllhost.exe") | table _time, host, user, signature_id, process | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- privilege-escalation:event triggered execution:component object model hijacking
- persistence:event triggered execution:component object model hijacking
technique_id:
- T1546.015
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/Binaries/Dllhost/
- https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08

id: '31925.57027'
title: Suspicious Execution of Accessibility Tool Debuggers
description: Threat actors may establish persistence or elevate privileges by executing
  malicious content through accessibility features. Windows accessibility features
  can be launched with a key combination before user login, such as from the Windows
  logon screen. Threat actors can modify the launch process of these programs to gain
  a command prompt or backdoor access without logging into the system. This use case
  detects the execution of accessibility tools by a debugger process, which can indicate
  an attempt to gain unauthorized access or persistence through malicious use of these
  tools.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "winlogon.exe" ("cmd.exe" OR "cscript.exe" OR "mshta.exe" OR "powershell.exe" OR
  "pwsh.exe" OR "regsvr32.exe" OR "rundll32.exe" OR "wscript.exe" OR "wt.exe") ("sethc.exe"
  OR "utilman.exe" OR "osk.exe" OR "Magnify.exe" OR "Narrator.exe" OR "DisplaySwitch.exe"
  OR "atbroker.exe" OR "HelpPane.exe") | regex parent_process_name="(?i)winlogon\.exe"|
  regex process_name="(?i)(cmd|cscript|mshta|powershell|pwsh|regsvr32|rundll32|wscript|wt)\.exe"|
  regex process="(?i)(sethc|utilman|osk|Magnify|Narrator|DisplaySwitch|atbroker|HelpPane)\.exe"
  | table _time, host, user, parent_process_name, process, process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution:accessibility features
technique_id:
- T1546.008
data_category:
- Windows Sysmon
references:
- https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml

name: Windows Protocol Tunneling with Plink
id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed
version: 13
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic detects the use of Plink (including renamed versions like pvhost.exe) for protocol tunneling, which may be used for egress or lateral movement within an organization. It identifies specific command-line options (-R, -L, -D, -l, -N, -P, -pw) commonly used for port forwarding and tunneling by analyzing process execution logs from Endpoint Detection and Response (EDR) agents. This activity is significant as it may indicate an attempt to bypass network security controls or establish unauthorized connections. If confirmed malicious, this could allow an attacker to exfiltrate data, move laterally across the network, or maintain persistent access, posing a severe threat to the organization's security. The detection covers both the original Plink executable and potential renamed versions, enhancing its ability to catch evasion attempts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=plink.exe
            OR
            Processes.process_name=pvhost.exe
            OR
            Processes.original_file_name=Plink
        )
        AND Processes.process IN ("*-R *", "*-L *", "*-D *", "*-l *", "*-N *", "*-P *", "*-pw *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_protocol_tunneling_with_plink_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
references:
    - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
    - https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
    - https://attack.mitre.org/techniques/T1572/
    - https://documentation.help/PuTTY/using-cmdline-portfwd.html#S3.8.3.5
    - https://media.defense.gov/2024/Jul/25/2003510137/-1/-1/0/Joint-CSA-North-Korea-Cyber-Espionage-Advance-Military-Nuclear-Programs.PDF
    - https://blog.talosintelligence.com/lazarus-three-rats/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - CISA AA22-257A
asset_type: Endpoint
mitre_attack_id:
    - T1572
    - T1021.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Proxy Via Registry
id: 0270455b-1385-4579-9ac5-e77046c508ae
version: 12
creation_date: '2023-05-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the modification of registry keys related to the Windows Proxy settings via netsh.exe. It leverages data from the Endpoint.Registry data model, focusing on changes to the registry path "*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*". This activity is significant because netsh.exe can be used to establish a persistent proxy, potentially allowing an attacker to execute a helper DLL whenever netsh.exe runs. If confirmed malicious, this could enable the attacker to maintain persistence, manipulate network configurations, and potentially exfiltrate data or further compromise the system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_proxy_via_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A registry modification for port proxy in$dest$
analytic_story:
    - Volt Typhoon
asset_type: Endpoint
atomic_guid:
    - b8223ea9-4be2-44a6-b50a-9657a3d4e72a
mitre_attack_id:
    - T1090.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Registry Entries Restored Via Reg
id: a17af481-e2ad-494c-9da6-afb4d243a019
version: 5
creation_date: '2022-12-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of reg.exe with the "restore" parameter, indicating an attempt to restore registry backup data on a host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate post-exploitation actions, such as those performed by tools like winpeas, which use "reg save" and "reg restore" to manipulate registry settings. If confirmed malicious, this could allow an attacker to revert registry changes, potentially bypassing security controls and maintaining persistence.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_reg`
        AND
        Processes.process = "* restore *"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_registry_entries_restored_via_reg_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser
    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
analytic_story:
    - Windows Post-Exploitation
    - Prestige Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Sensitive Registry Hive Dump Via CommandLine
id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e
version: 11
creation_date: '2021-05-12'
modification_date: '2026-05-13'
author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `save` or `export` actions targeting the `sam`, `system`, or `security` hives. This activity is significant as it indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (
      (
        (Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)
        Processes.process IN ("*save*", "*export*")
      )
      OR
      (
        (Processes.process_name=regedit.exe OR Processes.original_file_name=REGEDIT.exe)
        Processes.process IN ("*/E *", "*-E *")
      )
    )
    Processes.process IN (
      "*HKEY_LOCAL_MACHINE\\SAM*",
      "*HKEY_LOCAL_MACHINE\\Security*",
      "*HKEY_LOCAL_MACHINE\\System*",
      "*HKLM\\SAM*",
      "*HKLM\\Security*",
      "*HKLM\\System*",
    )
    by Processes.action Processes.dest Processes.original_file_name
    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
    Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_sensitive_registry_hive_dump_via_commandline_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible some agent based products will generate false positives. Filter as needed.
references:
    - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md
    - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
finding:
    title: Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - CISA AA22-257A
    - CISA AA23-347A
    - Compromised Windows Host
    - Credential Dumping
    - DarkSide Ransomware
    - Data Destruction
    - Industroyer2
    - Volt Typhoon
    - Windows Registry Abuse
    - Seashell Blizzard
asset_type: Endpoint
mitre_attack_id:
    - T1003.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Steal Authentication Certificates CryptoAPI
id: 905d5692-6d7c-432f-bc7e-a6b4f464d40e
version: 10
creation_date: '2023-02-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the extraction of authentication certificates using Windows Event Log - CAPI2 (CryptoAPI 2). It leverages EventID 70, which is generated when a certificate's private key is acquired. This detection is significant because it can identify potential misuse of certificates, such as those extracted by tools like Mimikatz or Cobalt Strike. If confirmed malicious, this activity could allow attackers to impersonate users, escalate privileges, or access sensitive information, posing a severe risk to the organization's security.
data_source:
    - Windows Event Log CAPI2 70
search: |-
    `capi2_operational` EventCode=70
      | xmlkv UserData_Xml
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY Computer, UserData_Xml
      | rename Computer as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_steal_authentication_certificates_cryptoapi_filter`
how_to_implement: To implement this analytic, one will need to enable the Microsoft-Windows-CAPI2/Operational log within the Windows Event Log. Note this is a debug log for many purposes, and the analytic only focuses in on EventID 70. Review the following gist for additional enabling information.
known_false_positives: False positives may be present in some instances of legitimate applications requiring to export certificates. Filter as needed.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749296(v=ws.10)
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Certificates were exported via the CryptoAPI 2 on $dest$.
analytic_story:
    - Windows Certificate Services
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1649
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows WPDBusEnum Registry Key Modification
id: 52b48e8b-eb6e-48b0-b8f1-73273f6b134e
version: 8
creation_date: '2025-01-17'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: This analytic is used to identify when a USB removable media device is attached to a Windows host. In this scenario we are querying the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ . Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
data_source:
    - Sysmon EventID 12
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime, max(_time) as lastTime, count FROM datamodel=Endpoint.Registry
      WHERE Registry.registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*")
        AND
        Registry.registry_value_name ="FriendlyName"
        AND
        Registry.registry_path="*USBSTOR*"
      BY Registry.action Registry.dest Registry.process_guid
         Registry.process_id Registry.registry_hive Registry.registry_path
         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
         Registry.registry_value_type Registry.status Registry.user
         Registry.vendor_product
    | `drop_dm_object_name(Registry)`
    | eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&"),2),"PROD_","")
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_wpdbusenum_registry_key_modification_filter`
how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model.
known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
references:
    - https://attack.mitre.org/techniques/T1200/
    - https://www.cisa.gov/news-events/news/using-caution-usb-drives
    - https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A removable storage device named [$object_name$] with drive letter [$object_handle$] was attached to $dest$
threat_objects:
    - field: object_handle
      type: registry_value_text
    - field: object_name
      type: registry_value_name
analytic_story:
    - Data Protection
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1200
    - T1025
    - T1091
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint