Splunk rules: 0p

name: Anomalous usage of 7zip
id: 9364ee8e-a39a-11eb-8f1d-acde48001122
version: 15
creation_date: '2021-04-22'
modification_date: '2026-05-13'
author: Michael Haag, Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent processes. This activity is significant as it may indicate an adversary attempting to use 7-Zip for data exfiltration, often by renaming the executable to evade detection. If confirmed malicious, this could lead to unauthorized data archiving and exfiltration, compromising sensitive information and potentially leading to further system exploitation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (Processes.parent_process_name IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z*) AND NOT Processes.process_path = "C:\\Program Files\\VMware\\VMware Tools\\7za.exe"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `anomalous_usage_of_7zip_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as this behavior is not normal for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
references:
    - https://attack.mitre.org/techniques/T1560/001/
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
    - https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - NOBELIUM Group
    - BlackByte Ransomware
    - Cobalt Strike
    - Graceful Wipe Out Attack
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1560.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: AWS Bedrock Claude Cross Region Possible Inference Abuse
id: e3d3f27d-b08e-415a-9811-8f72a0905ca6
version: 1
creation_date: '2026-07-06'
modification_date: '2026-07-06'
author: Rod Soto
status: production
type: Anomaly
description: This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions.
data_source:
    - AWS Bedrock Claude
search: |-
    `aws_bedrock_claude`
    | rename "identity.arn" AS user_arn
    | rename "input.inputTokenCount" AS input_tokens
    | rename "output.outputTokenCount" AS output_tokens
    | rex field=user_arn "assumed-role/[^/]+/(?<user>[^\"]+)$"
    | rex field="input.inputBodyJson.metadata.user_id" "(?<session_user>user_[^_]+.*)"
    | eval input_tokens=tonumber(input_tokens)
    | eval output_tokens=tonumber(output_tokens)
    | eval token_ratio=round(output_tokens / max(input_tokens,1), 2)
    | eval model_short=replace(modelId,"^.*/","")
    | eval mismatch_detail=region." -> ".inferenceRegion
    | where isnotnull(user_arn) AND len(user_arn)>10
    | where isnotnull(session_user)
    | where region!=inferenceRegion
    | where input_tokens>=2000
    | table _time, user, user_arn, session_user, model_short, input_tokens, output_tokens, token_ratio, mismatch_detail, operation, host
    | sort - input_tokens
    | `aws_bedrock_claude_cross_region_possible_inference_abuse_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land.
known_false_positives: False positives may arise from legitimate use cases where users are accessing AWS Bedrock Claude models across different regions for valid reasons, such as multi-region deployments, testing, or development purposes. It is important to review the context of the detected events to determine if they represent actual abuse or benign usage.
references:
    - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/
    - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock
    - https://research.splunk.com/stories/aws_bedrock_security/
    - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Cross-region inference abuse detected from $user$ ($session_user$) using model $model_short$ with region mismatch $mismatch_detail$ and $input_tokens$ input tokens on $host$.
analytic_story:
    - Suspicious AWS Bedrock Claude Activities
asset_type: Web Application
mitre_attack_id:
    - T1599
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: AWS Disable Bucket Versioning
id: 657902a9-987d-4879-a1b2-e7a65512824b
version: 10
creation_date: '2023-05-01'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify `PutBucketVersioning` events with the `VersioningConfiguration.Status` set to `Suspended`. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.
data_source:
    - AWS CloudTrail PutBucketVersioning
search: |-
    `cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended
      | rename user_name as user, requestParameters.bucketName as bucket_name
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product bucket_name
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_disable_bucket_versioning_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs.
references:
    - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
    - https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Bucket Versioning is suspended for S3 buckets- $bucket_name$ by user $user$ from IP address $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious AWS S3 Activities
    - Data Exfiltration
asset_type: AWS Account
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '15032.22715'
title: Command Line .cmd Execution
description: 'Adversaries may attempt to manipulate features of their artifacts to
  make them appear legitimate or benign to users and/or security tools. Masquerading
  occurs when the name or location of an object, legitimate or malicious, is manipulated
  or abused for the sake of evading defenses and observation. This may include manipulating
  file metadata, tricking users into misidentifying the file type, and giving legitimate
  task or service names. This use case detects the use of cmd.exe /c to execute .cmd
  files. This technique has been used by BazaLoader to execute malware masquerading
  as a PDF inside a .zip file. -- Threat Actor Association: Andariel, APT28, APT40,
  APT-K-47/Mysterious Elephant, GoldenJackal, Kimsuky, Rhysida, Sandworm Team, Volt
  Typhoon -- Atomics T1036 Test #2 Atomics T1059.003 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "cmd.exe" "/c" ".cmd" | regex process="(?i)cmd.*\s+/c\s+.*?\w+\.cmd" | table _time,
  host, user, process, process_*, parent_process, parent_process_*, user | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md#atomic-test-2---malware-masquerading-and-execution-from-zip-file
- https://twitter.com/ffforward/status/1481672378639912960

name: Detect SharpHound Usage
id: dd04b29a-beed-11eb-87bc-acde48001122
version: 13
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process metadata and command-line executions. SharpHound is a tool used for Active Directory enumeration, often by attackers during the reconnaissance phase. If confirmed malicious, this activity could allow an attacker to map out the network, identify high-value targets, and plan further attacks, potentially leading to privilege escalation and lateral movement within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=sharphound.exe
            OR
            Processes.original_file_name=SharpHound.exe
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_sharphound_usage_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed.
references:
    - https://attack.mitre.org/software/S0521/
    - https://thedfirreport.com/?s=bloodhound
    - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
    - https://github.com/BloodHoundAD/SharpHound3
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
finding:
    title: Potential SharpHound binary identified on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Discovery Techniques
    - Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
    - T1069.002
    - T1087.001
    - T1087.002
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '30937.55362'
title: Hidden Scheduled Task Created - Windows
description: A hidden scheduled task in Windows is a task configured to run specified
  actions silently without displaying any visible program windows or interfaces to
  the user. Threat actors may abuse this feature to persistently execute malicious
  activities covertly, avoiding detection while maintaining a presence on the victim's
  system, as observed in breaches involving Industroyer2. This use case detects scheduled
  task creation events where the 'Hidden' setting is enabled.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4698) OR
  "<EventID>4698<") "hidden" "true" | where match(TaskContent, "(?i)Hidden(&gt;|>)true")
  | table _time, host, user, TaskName | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:scheduled task/job
technique_id: 
- T1053
data_category:
- Windows event logs
references:
- https://research.splunk.com/endpoint/0b730470-5fe8-4b13-93a7-fe0ad014d0cc/
- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
- https://cert.gov.ua/article/39518

name: Linux Gdrive Binary Activity
id: a42f8029-5472-4c33-8943-bb17bb07466a
version: 5
creation_date: '2022-04-26'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the 'gdrive' tool on a Linux host. This tool allows standard users to perform tasks associated with Google Drive via the command line. This is used by actors to stage tools as well as exfiltrate data. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. If confirmed malicious, this could lead to compromise of systems or sensitive data being stolen.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name="gdrive" Processes.process IN  ("* download *", "* upload *", "* list*", "* update *", "* sync *", "* share *", "* account add*", "* drives *", "* files *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_gdrive_binary_activity_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
finding:
    title: An instance of $process_name$ was identified attempting to interact with Google Drive on endpoint $dest$ by $user$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - China-Nexus Threat Activity
asset_type: Endpoint
mitre_attack_id:
    - T1567
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27585.50195'
title: NirCmd Execution
description: 'NirCmd is a command line utility with capabilities to delete files from
  Recycling Bin, delete registry keys, take screenshots and execute command without
  displaying a user interface. While it has legitimate administrative uses, threat
  actors including Mint Sandstorm aka PHOSPHORUS have been observed using renamed
  NirCmd to execute malicious code. This use case detects executions of NirCmd.exe
  or command line argument patterns consistent with abusive activities observed with
  NirCmd, accounting for instances where it has been renamed. Allowlisting is recommended
  for executables using the same command line arguments for best results. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "NirCmd" OR ((" execmd " OR ".exe script " OR ".exe shexec " OR " runinteractive
  " OR " runinteractivecmd " OR " savescreenshot " OR " savescreenshotfull " OR "savescreenshotwin
  " OR " regdelval " OR " regdelkey " OR " regsetval ") OR ((" exec " OR " exec2 ")
  (" show " OR " hide "))) | where match(process_name, "(?i)nircmd\.exe") or match(process,
  "(?i)\s(execcmd|runinteractive(cmd)?|savescreenshot(full|win)?|regdel(val|key)|regsetval|exec2?\s+(show|hide))\s|\.exe\s+(script|shexec)")
  | table _time, host, user, process, parent_process_name, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:screen capture
- execution:command and scripting interpreter
- defense-evasion:indicator removal
technique_id: 
- T1113
- T1059
- T1070
data_category:
- Windows Sysmon
references:
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
- https://asec.ahnlab.com/ko/45153/
- https://nircmd.nirsoft.net/
- https://www.nirsoft.net/utils/nircmd.html

name: O365 Email Reported By Admin Found Malicious
id: 94396c3e-7728-422a-9956-e4b77b53dbdf
version: 11
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by administrative users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission
      | search RescanVerdict IN (Phish,Malware)
      | rename Id as signature_id, SenderIP as src, Recipients{} as dest_user, P1Sender as src_user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product signature
           signature_id dest_user src_user
           Subject SubmissionContent
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_email_reported_by_admin_found_malicious_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: Administrators that submit known phishing training exercises.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide
finding:
    title: O365 security admin $user$ manually reported a suspicious email from $src_user$
    entity:
        field: src_user
        type: user
        score: 50
threat_objects:
    - field: Subject
      type: email_subject
analytic_story:
    - Spearphishing Attachments
    - Suspicious Emails
asset_type: O365 Tenant
mitre_attack_id:
    - T1566.001
    - T1566.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '6144.6642'
title: Output to File
description: 'Adversaries may stage collected data in a central location or directory
  on the local system prior to Exfiltration. This use case looks for indicators of
  commands being saved to a file such as ">" or ">>". Typically a new process
  is not created when executed from a command prompt, however adversaries may output
  process results to a txt document during discovery. -- Threat Actor Association:
  Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
  OilRig, TeamTNT - Software Association: Bazar, Clop, Conti, DarkWatchman, EagleEye,
  Hive, Koxic, Polyglot, SysJoker Atomics T1059.003 Test #2 Atomics T1059.003 Test
  #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  TERM(EventCode=4104) OR "<EventID>4103<" OR "<EventID>4104<")(TERM(Out-File) OR
  TERM(>) OR ">>") | regex process="(?i)(\s+|\;|\:\,|\d+|\|)(out-file|\>{1,2})(\s|\;|\:\,\|).{1,}"
  | table _time, host, user, signature_id, process_name, user, process | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
- defense-evasion:masquerading
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1074.001
- T1036
- T1059.003
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/

id: '16743.26618'
title: 'Permission Groups Discovery: Local Groups'
description: 'Adversaries may attempt to find local system groups and permission settings.
  The knowledge of local system permission groups can help adversaries determine which
  groups exist and which users belong to a particular group. Adversaries may use this
  information to determine which users have elevated permissions, such as the users
  found within the local administrators group. Atomics T1069.001 Test #3 Atomics T1069.001
  Test #5 Atomics T1069.001 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(Get-LocalGroup)
  OR TERM(Get-LocalGroupMember) OR (("wmic" OR TERM(Get-WMIObject) AND TERM(group)))
  | table _time, host, user, process, process_*, parent_process | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- discovery:permission groups discovery
technique_id: 
- T1069
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md#atomic-test-3---permission-groups-discovery-powershell-local

id: '27535.50074'
title: Potential PowerShell Post-Exploitation Activity
description: 'Threat actors may perform post-exploitation activities using PowerShell
  scripts such as ADRecon. When running ADRecon, PowerShell launches child processes
  to compile and execute payloads and creates several .cmdline files in AppData\Local\Temp
  directories. This use case detects PowerShell-invoked compilations involving csc.exe
  and cvtres.exe referencing multiple .cmdline files from temp directories within
  a 5 minute time period. This may that a malicious script like ADRecon has been executed,
  regardless of the script title name or cmdlets invoked. Atomics T1087.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("powershell.exe" OR "pwsh.exe") ("csc.exe" OR "cvtres.exe") ".cmdline" | regex
  parent_process_name="(?i)(powershell|pwsh)\.exe"| regex process_name="(?i)(csc|cvtres)\.exe"|
  regex process="(?i)\x5cAppData\x5cLocal\x5cTemp.+\.cmdline" | table _time, host,
  user process, parent_process_name, event_count | bin span=300s | stats values(*)
  as * by _time, host | eventstats dc(process) as dc_process by host, _time| where
  dc_process > 3 '
techniques:
- execution:command and scripting interpreter:powershell
- discovery:account discovery
- discovery:system information discovery
technique_id:
- T1059.001
- T1087
- T1082
data_category:
- Windows Sysmon
references:
- https://github.com/sense-of-security/ADRecon/tree/master
- https://www.dnif.it/en/blog/strategies-to-detect-post-exploitation-active-directory-reconnaissance
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker

id: '21901.38720'
title: ProtocolHandler.exe File Download
description: ProtocolHandler.exe is a component of Microsoft Office and is typically
  used for accessing Microsoft Office documents from Outlook and Sharepoint. Adversaries
  can use ProtocolHandler.exe to download files. This use case detects executions
  of ProtocolHandler.exe followed by URLs in the command line. Allowlisting of expected
  Sharepoint domains is recommended to reduce false positives. LOLBINS/LOLBAS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "ProtocolHandler.exe" | regex process="(?i)ProtocolHandler\.exe\"?\s+\"?[A-Za-z0-9]{2,6}:\/\/"
  | table _time, host, user, signature_id, process, process_*, parent_process_path,
  parent_process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://pentera.io/blog/the-lol-isnt-so-funny-when-it-bites-you-in-the-bas/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/ProtocolHandler/

name: Python PTH File Creation During Package Installation
id: bf581b86-39cd-48b7-9312-d9affb48a8bc
version: 1
creation_date: '2026-08-21'
modification_date: '2026-08-21'
author: Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
    Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
    This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 11
search: |-
    `sysmon`
    EventID IN (1,11)
    process_name="python.exe"
    (
        process="* install *"
        OR
        (
            file_name="*.pth"
            action="created"
        )
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(parent_process_id) as parent_process_id
                  values(parent_process_path) as parent_process_path
                  values(parent_process_name) as parent_process_name
                  values(parent_process) as parent_process
                  values(process_path) as process_path
                  values(process_name) as process_name
                  values(process) as process
                  values(file_name) as file_name
                  values(file_path) as file_path
                  dc(EventID) as dc_event_id

      by dest source process_id

    | search dc_event_id>1 AND process!="*-- setuptools*"

    | table firstTime lastTime
            parent_process_id parent_process_path parent_process_name parent_process
            process_id process_path process_name process
            file_name file_path
            dest source

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `python_pth_file_creation_during_package_installation_filter`
how_to_implement: |-
    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
    and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .pth
    extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the
    Splunk Common Information Model (CIM).
known_false_positives: |-
    Legitimate packages, such as those managing namespace packages or editable installs, may create `.pth` files as part of normal installation.
    Investigate the file contents and parent process to determine legitimacy.
references:
    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 30
          message: A Python .pth file called [$file_name$] located at [$file_path$] was created on [$dest$] during package installation using [$process$].
threat_objects:
    - field: process
      type: process
    - field: file_name
      type: file_name
    - field: file_path
      type: file_path
analytic_story:
    - Malicious Python Package Installation
    - Compromised Windows Host
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1546
    - T1195.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1041.11628'
title: Suspicious Executable by Powershell
description: 'Detect when an executable has been launched by powershell and similar
  processes. Such as powershell cscript or cmd and similar processes spawning cmd.exe,
  cscript rundll32 and similar processes being a child process of powershell. - Threat
  Actor Association: APT29/Nobelium/Cozy Bear, APT34/OilRig, APT41, APT43, FIN7, Flax
  Typhoon, Lancefly, MuddyWater, RedEyes - Software Association: Bazarloader, Blackbyte,
  IcedID, Qakbot/Qbot - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "powershell.exe" ("cmd.exe" OR "services.exe" OR "dllhost.exe" OR "rundll32.exe"
  OR "cscript.exe" OR "mshta.exe" OR "regsvr32.exe") | regex parent_process_name="(?i)(powershell\.exe)"
  | regex process_path="(?i)((cmd)|(services)|(dllhost)|(rundll32)|(mshta)|(regsvr32)|(cscript))\.exe"
  | table _time, host, user event_id, parent_*, process_*, process, signature_id,
  src_*, dest_* | bin span=1s | stats values(*) as * by _time, host | where isnotnull(user) '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1059.003
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://docs.broadcom.com/doc/increased-use-of-powershell-in-attacks-16-en
- https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf

id: '5454.5609'
title: WebLogic CVE-2017-10271
description: 'A reverse shell is a shell session established on a connection that
  is initiated from a remote machine, not from the local host and in this case the
  session is created using the vulnerability of Weblogic app - wls-wsat Component
  Deserialization - Threat Actor Association: APT29/Nobelium/Cozy Bear -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(powershell) TERM(-w)
  TERM(hidden) TERM(-nop) TERM(-c) TERM(function) TERM(RSC) AND "system.net.sockets.tcpclient"
  AND "cmd.exe" AND "UseShellExecute" AND EventCode=4103 | rex field=process "\$a\=\''(?<src_ip>(?i)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
  | rex field=process "\$p\=\''(?<dest_port>(?i)\d{1,5}") | table _time, host, user,
  signature_id, process, src_ip, dest_port | bin span=1s | stats values(*) as * by
  _time, host | lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns |
  iplocation prefix="src_" src_ip| rename src_Country as src_country '
techniques:
- initial-access:exploit public-facing application
- execution:command and scripting interpreter:powershell
technique_id:
- T1190
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references: null

name: Windows AD Privileged Object Access Activity
id: dc2f58bc-8cd2-4e51-962a-694b963acde0
version: 10
creation_date: '2023-08-18'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects access attempts to privileged Active Directory objects, such as Domain Admins or Enterprise Admins. It leverages Windows Security Event Code 4662 to identify when these sensitive objects are accessed. This activity is significant because such objects should rarely be accessed by normal users or processes, and unauthorized access attempts may indicate attacker enumeration or lateral movement within the domain. If confirmed malicious, this activity could allow attackers to escalate privileges, persist in the environment, or gain control over critical domain resources.
data_source:
    - Windows Event Log Security 4662
search: |-
    `wineventlog_security` EventCode=4662 ObjectName IN ( "CN=Account Operators,*", "CN=Administrators,*", "CN=Backup Operators,*", "CN=Cert Publishers,*", "CN=Certificate Service DCOM Access,*", "CN=Domain Admins,*", "CN=Domain Controllers,*", "CN=Enterprise Admins,*", "CN=Enterprise Read-only Domain Controllers,*", "CN=Group Policy Creator Owners,*", "CN=Incoming Forest Trust Builders,*", "CN=Microsoft Exchange Servers,*", "CN=Network Configuration Operators,*", "CN=Power Users,*", "CN=Print Operators,*", "CN=Read-only Domain Controllers,*", "CN=Replicators,*", "CN=Schema Admins,*", "CN=Server Operators,*", "CN=Exchange Trusted Subsystem,*", "CN=Exchange Windows Permission,*", "CN=Organization Management,*")
      | rex field=ObjectName "CN\=(?<object_name>[^,]+)"
      | stats values(Computer) as dest, values(object_name) as object_name, dc(ObjectName) as object_count, min(_time) as firstTime, max(_time) as lastTime, count
        BY SubjectUserName
      | rename SubjectUserName as user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_ad_privileged_object_access_activity_filter`
how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662. The required SACLs need to be created for the relevant objects. Be aware Splunk filters this event by default on the Windows TA.
known_false_positives: Service accounts or applications that routinely query Active Directory for information.
references:
    - https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
    - https://attack.mitre.org/tactics/TA0007/
finding:
    title: The account $user$ accessed $object_count$ privileged AD object(s).
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Active Directory Discovery
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Content Copied from Browser was Executed
id: 5d1fdbcb-5ed9-4190-85c8-7f9026450a0b
version: 1
creation_date: '2026-09-07'
modification_date: '2026-09-07'
author: Onur Mustafa Erdogan, Splunk
status: production
type: TTP
description: |-
    The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content
    changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied
    from a browser are subsequently executed on the Windows system through the Run dialog box.
data_source:
    - Sysmon EventID 13 AND Sysmon EventID 24
search: |-
    `sysmon`
    EventID IN (13, 24)
    (
        registry_key_name=*RunMRU*
        OR
        process_name IN (
        "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe",
        "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe",
        "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe",
        "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe",
        "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe"
        )
    )
    | eval trimmed_command = rtrim(registry_value_data, "\1")
    | eval utf16le_command = urldecode(replace(trimmed_command, "(.)", "\1%00"))
    | eval sha256_process=upper(sha256(utf16le_command))
    | eval hash_command=coalesce(SHA256,sha256_process)
    | stats min(_time) as firstTime max(_time) as lastTime values(process_name) as process_name
        values(trimmed_command) as process values(EventID) as EventID dc(EventID) as dc_EventID count
        by hash_command dest user
    | search dc_EventID>1
    | eval process_name = mvfilter(
        process_name IN (
        "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe",
        "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe",
        "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe",
        "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe",
        "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe"
        )
      )
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_content_copied_from_browser_was_executed_filter`
how_to_implement: |-
    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon registry modification (Event ID 13)
    and clipboard change (Event ID 24) events. Ensure that registry modification events are collected for the RunMRU registry key
    and clipboard change events are collected from common browser processes. Ingest the data through the appropriate Splunk technology
    add-on and normalize field names using the Splunk Common Information Model (CIM).
known_false_positives: No false positives have been identified at this time.
references:
    - https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/
    - https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis
finding:
    title: The content [$process$] was copied from [$process_name$] to the clipboard and was executed through the Run dialog box on [$dest$]
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process
      type: process
    - field: hash_command
      type: process_hash
analytic_story:
    - Fake CAPTCHA Campaigns
asset_type: Endpoint
mitre_attack_id:
    - T1202
    - T1059.001
    - T1059.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Credentials from Password Stores Creation
id: c0c5a479-bf57-4ca0-af3a-4c7081e5ba05
version: 12
creation_date: '2022-12-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the Windows OS tool cmdkey.exe, which is used to create stored usernames, passwords, or credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because cmdkey.exe is often abused by post-exploitation tools and malware, such as Darkgate, to gain unauthorized access. If confirmed malicious, this behavior could allow attackers to escalate privileges and maintain persistence on the targeted host, facilitating further attacks and potential data breaches.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name="cmdkey.exe"
        OR
        Processes.original_file_name = "cmdkey.exe"
        AND
        Processes.process = "*/generic*" Processes.process IN ("*/user*", "*/password*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_credentials_from_password_stores_creation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network administrator can use this tool for auditing process.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
finding:
    title: a process $process_name$ was executed on $dest$ to create stored credentials
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Compromised Windows Host
    - DarkGate Malware
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1555
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint