Splunk rules: 0q

name: Cisco Secure Firewall - Intrusion Events by Threat Activity
id: b71e57e8-c571-4ff1-ae13-bc4384a9e891
version: 10
creation_date: '2025-05-12'
modification_date: '2026-05-13'
author: Bhavin Patel, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events.
    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
    associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
    lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
    When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
    unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
    This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
    events that occur in close temporal proximity.

    Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:

    * AgentTesla
    * Amadey
    * ArcaneDoor
    * AsyncRAT
    * CastleRAT
    * Chafer
    * DCRAT
    * LokiBot
    * Lumma Stealer
    * Nobelium
    * Quasar
    * Remcos
    * Snake
    * Static Tundra
    * Xworm

    To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent
    | stats count AS total_alerts, dc(signature_id) AS sig_count, values(SnortRuleGroups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest signature_id
    | lookup cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message
    | where isnotnull(threat)
    | bin _time span=1d
    | stats count AS Total_Alerts, dc(signature_id) AS sig_count, values(signature_id) AS signature_id, values(category) AS category, values(message) AS message, values(snort_rule_groups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest threat
    | lookup threat_snort_count threat OUTPUT description, distinct_count_snort_ids
    | table _time, dest, src, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app
    | where sig_count >= distinct_count_snort_ids
    | `cisco_secure_firewall___intrusion_events_by_threat_activity_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured. This detection is based on the cisco_snort_ids_to_threat_mapping.csv mapping file - please update the lookup file with the latest Snort IDs to Threat Actors if you would like to modify the distinct count of Snort IDs needed to trigger the detection or if you would like to add new Snort IDs to Threat Actors.
known_false_positives: False positives may occur due to legitimate security testing or research activities.
references:
    - https://www.cisco.com/c/en/us/products/security/firewalls/index.html
    - https://blog.talosintelligence.com/static-tundra/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential $threat$ activity detected on $dest$ originating from $src$.
threat_objects:
    - field: signature
      type: signature
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - ArcaneDoor
asset_type: Network
mitre_attack_id:
    - T1041
    - T1573.002
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

id: '5380.5489'
title: Clear Windows Event Logs
description: 'Adversaries may clear Windows Event Logs to hide the activity of an
  intrusion. Windows Event Logs are a record of a computer''s alerts and notifications.
  There are three system-defined sources of events: System, Application, and Security,
  with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
  -- Threat Actor Association: APT29/Nobelium, Cadet Blizzard, Lazarus, Memento Team,
  Redfly, Vice Society, Volt Typhoon - Software Association: Blackcat/ALPHV, Cring,
  Lockbit, Lorenz, Ransom Cartel, Rhysida, Trigona - Atomics T1070.001 Test#1 Atomics
  T1070.001 Test#2 Atomics T1070.001 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=1102 OR "<EventID>1102<"
  OR EventCode=517 OR "<EventID>517<" OR EventCode=104 OR "<EventID>104<") | table
  _time, host, user, signature_id, process_name, process, user, name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indicator removal:clear windows event logs
technique_id:
- T1070.001
data_category:
- Windows event logs
references:
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
- https://www.justice.gov/file/1080281/download

name: Detect AzureHound Command-Line Arguments
id: 26f02e96-c300-11eb-b611-acde48001122
version: 16
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because AzureHound is often used for reconnaissance in Azure environments, potentially exposing sensitive information. If confirmed malicious, this activity could allow an attacker to map out Azure Active Directory structures, aiding in further attacks and privilege escalation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process IN ("*invoke-azurehound*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_azurehound_command_line_arguments_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://attack.mitre.org/software/S0521/
    - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
    - https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
    - https://github.com/BloodHoundAD/Legacy-AzureHound.ps1/blob/master/AzureHound.ps1
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Windows Discovery Techniques
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
    - T1069.002
    - T1087.001
    - T1087.002
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disable Show Hidden Files
id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
version: 18
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows registry that disable the display of hidden files. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with hidden file settings. This activity is significant because malware, such as worms and trojan spyware, often use hidden files to evade detection. If confirmed malicious, this behavior could allow an attacker to conceal malicious files on the system, making it harder for security tools and analysts to identify and remove the threat.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000" )) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Disabled 'Show Hidden Files' on $dest$
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1685
    - T1564.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6147.6667'
title: Esentutl Execution
description: 'Esentutl is a command-line tool that provides database utilities for
  the Windows Extensible Storage Engine. This use case looks for esentutl execution
  or from an executable running common process command line switches used by adversaries.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat Actor Association:
  Wizard Spider Software Association: Bazar, Conti, Trickbot Atomics T1003.002 Test
  #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") ( "esentutl.exe" OR
  (".exe" "/y" "/d") OR "esentutl" ) | table _time, host, user user, process, process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping:ntds
- lateral-movement:lateral tool transfer
- defense-evasion:hide artifacts
technique_id:
- T1105
- T1003.002
- T1003.003
- T1570
- T1564
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html

id: '29486.53149'
title: File Written to Startup Folder - Windows
description: Adversaries may achieve persistence by adding a program to a startup
  folder. Adding an entry to the startup folder will cause the program referenced
  to be executed when a user logs in. These programs will be executed under the context
  of the user and will have the account's associated permissions level. This use case
  detects file writes to \Microsoft\Windows\Start Menu\Programs\StartUp.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=11) OR "<EventID>11<")
  "Microsoft\\Windows\\Start Menu\\Programs\\Startup" | where !match(process_name,
  "(?i)wuauclt\.exe") and !match(TargetFile, "(?i)C:\x5c\$Windows\.~BT\x5cNewOS\x5c")
  | table _time, host, user, process, parent_process_name, process_exec | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
technique_id:
- T1547.001
data_category:
- Windows Sysmon
references:
- https://www.uptycs.com/blog/cryptocurrency-entities-at-risk-threat-actor-uses-parallax-rat-for-infiltration
- https://attack.mitre.org/techniques/T1547/001/
- https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml

id: '32307.57462'
title: Git Submodule Cloned - Windows
description: 'Adversaries may abuse a bug in Git whereby it can be fooled into writing
  files not into the submodule''s worktree but into a `.git/` directory. This allows
  writing a hook that will be executed while the clone operation is still running,
  giving the user no opportunity to inspect the code that is being executed. This
  use case detects when a submodule from a GitHub repository was cloned onto the system
  Vulnerability Association: CVE-2024-32002'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(git) OR TERM(gh)) TERM(submodule) TERM(clone) | table _time, host, user, process,
  process_path, signature_id, parent_process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://github.com/amalmurali47/git_rce/tree/main
- https://nvd.nist.gov/vuln/detail/CVE-2024-32002
- https://amalmurali.me/posts/git-rce/

name: Linux pkexec Privilege Escalation
id: 03e22c1c-8086-11ec-ac2e-acde48001122
version: 12
creation_date: '2022-02-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `pkexec` without any command-line arguments. This behavior leverages data from Endpoint Detection and Response (EDR) agents, focusing on process telemetry. The significance lies in the fact that this pattern is associated with the exploitation of CVE-2021-4034 (PwnKit), a critical vulnerability in Polkit's pkexec component. If confirmed malicious, this activity could allow an attacker to gain full root privileges on the affected Linux system, leading to complete system compromise and potential unauthorized access to sensitive information.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=pkexec
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | regex process="(^.{1}$)"
    | `linux_pkexec_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/
    - https://linux.die.net/man/1/pkexec
    - https://www.bleepingcomputer.com/news/security/linux-system-service-bug-gives-root-on-all-major-distros-exploit-released/
    - https://access.redhat.com/security/security-updates/#/?q=polkit&p=1&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&documentKind=PortalProduct
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit pkexec.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit pkexec.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
cve:
    - CVE-2021-4034
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Setuid Using Chmod Utility
id: bf0304b6-6250-11ec-9d7c-acde48001122
version: 11
creation_date: '2021-12-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments related to chmod. This activity is significant as it can indicate an attempt to escalate privileges or maintain persistence on a system. If confirmed malicious, an attacker could gain elevated access, potentially compromising sensitive data or critical system functions.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name = chmod
            OR
            Processes.process = "*chmod *"
        )
        AND Processes.process IN("* g+s *", "* u+s *", "* 4777 *", "* 4577 *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_setuid_using_chmod_utility_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a commandline $process$ that may set suid or sgid on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Suspicious React or Next.js Child Process
id: cda04e9c-1950-43ab-87d6-e333a3d7f107
version: 4
creation_date: '2025-12-08'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    This analytic detects Linux processes such as sh, bash, and common Linux LOLBINs being spawned by React or Next.js application servers.
    In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is commonly used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
    Public proof-of-concept payloads and observed in-the-wild exploit traffic show patterns where the vulnerable React Server Components handler triggers process.mainModule.require('child_process').execSync() to execute binaries such as ping, curl, or arbitrary shells on the underlying host.
    This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
    Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
data_source:
    - Sysmon for Linux EventID 1
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
      from datamodel=Endpoint.Processes
      where
        Processes.parent_process_name = "node"
        Processes.parent_process IN (
          "*--experimental-https*",
          "*--experimental-next-config-strip-types*",
          "*/node_modules/next*",
          "*next dev*",
          "*next start*",
          "*node_modules/.bin*",
          "*react-scripts start*",
          "*start-server.js*"
        )
        AND (
          Processes.process_name IN (
            "awk",
            "gawk",
            "ifconfig",
            "lua",
            "nc",
            "ncat",
            "netcat",
            "openssl",
            "perl",
            "php",
            "python",
            "python2",
            "python3",
            "ruby",
            "socat",
            "telnet"
          )
          OR (
            Processes.process_name IN ("curl", "wget")
            Processes.process = "*|*"
          )
          OR (
            Processes.process_name IN (
              "bash",
              "dash",
              "sh"
            )
            NOT Processes.process = "*-c*"
          )
          OR (
            Processes.process_name IN (
              "bash",
              "dash",
              "ksh",
              "sh",
              "zsh"
            )
            Processes.process IN (
              "*/dev/tcp/*",
              "*/dev/udp/*",
              "*0>&1*",
              "*curl*",
              "*exec *>&*",
              "*fsockopen*",
              "*ifconfig*",
              "*mkfifo*",
              "*nc *",
              "*ncat*",
              "*netcat*",
              "*proc_open*",
              "*s_client*",
              "*socat*",
              "*socket*",
              "*subprocess*",
              "*TCPSocket*",
              "*wget*"
            )
          )
        )

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_suspicious_react_or_next_js_child_process_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
    These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
    To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions.
    These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Rare false positives might show up from child processes such as sh. Apply additional filters as needed.
references:
    - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
    - https://nextjs.org/blog/CVE-2025-66478
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55182
    - https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3
    - https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182
finding:
    title: A Node-based server process ($parent_process_name$) on Linux spawned the child process $process_name$ with command-line $process$ on host $dest$ by user $user$, which may indicate remote code execution via React Server Components (CVE-2025-55182 / React2Shell) or abuse of a similar Node.js RCE vector.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A Node-based server process ($parent_process_name$) on Linux spawned the child process $process_name$ with command-line $process$ on host $dest$ by user $user$, which may indicate remote code execution via React Server Components (CVE-2025-55182 / React2Shell) or abuse of a similar Node.js RCE vector.
threat_objects:
    - field: parent_process_name
      type: process
    - field: process
      type: process
    - field: process_name
      type: process
analytic_story:
    - React2Shell
asset_type: Endpoint
mitre_attack_id:
    - T1190
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: M365 Copilot Jailbreak Attempts
id: b05a4f25-e07d-436f-ab03-f954afa922c0
version: 6
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption.
data_source:
    - M365 Exported eDiscovery Prompts
search: |
    `m365_exported_ediscovery_prompt_logs`
    | search Subject_Title IN (
                                "*act as*",
                                "*bypass*",
                                "*ignore*",
                                "*override*",
                                "*pretend you are*",
                                "*rules=*"
                              )
    | eval user = Sender
    | eval jailbreak_score=case(
                                match(Subject_Title, "(?i)pretend you are.*amoral"), 4,
                                match(Subject_Title, "(?i)act as.*entities"), 3,
                                match(Subject_Title, "(?i)(ignore|bypass|override)"), 3,
                                match(Subject_Title, "(?i)rules\s*="), 4, 1=1, 1
    )
    | where jailbreak_score >= 2
    | table _time, user, Subject_Title, jailbreak_score, Workload, Size
    | sort -jailbreak_score, -_time
    | `m365_copilot_jailbreak_attempts_filter`
how_to_implement: To export M365 Copilot prompt logs, navigate to the Microsoft Purview compliance portal (compliance.microsoft.com) and access eDiscovery. Create a new eDiscovery case, add target user accounts or date ranges as data sources, then create a search query targeting M365 Copilot interactions across relevant workloads. Once the search completes, export the results to generate a package containing prompt logs with fields like Subject_Title (prompt text), Sender, timestamps, and workload metadata. Download the exported files using the eDiscovery Export Tool and ingest them into Splunk for security analysis and detection of jailbreak attempts, data exfiltration requests, and policy violations.
known_false_positives: Legitimate users discussing AI ethics research, security professionals testing system robustness, developers creating training materials for AI safety, or academic discussions about AI limitations and behavioral constraints may trigger false positives.
references:
    - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ attempted M365 Copilot Jailbreak with score $jailbreak_score$ using prompt injection techniques to bypass AI safety controls and manipulate system behavior, potentially violating acceptable use policies.
analytic_story:
    - Suspicious Microsoft 365 Copilot Activities
asset_type: Web Application
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '1106.1171'
title: RDP Enabled
description: 'Detects if RDP service has been enabled on Windows host -- Threat Actor
  Association: APT35/Phosphorus/Magic Hound, DarkSide, BlackMatter, FIN7, TA551, Wizard
  Spider, Yanluowang -- Software Association: BianLian, Black Basta, Conti, Hive,
  IcedID, Insekt, Lockbit, Nefilim, Ryuk Ransomware, Sodinokibi/REvil'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ( ("reg.exe" AND TERM(add) AND TERM(fDenyTSConnections)
  AND TERM(REG_DWORD) AND TERM(/d) AND TERM(0) AND TERM(Terminal) AND TERM(SERVER)
  ) OR ("netsh.exe" AND TERM(remote) AND TERM(desktop) AND TERM(enable=yes)) ) | table
  _time, host, user process, process_name, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:modify registry
- lateral-movement:remote services:remote desktop protocol
technique_id:
- T1112
- T1021.001
data_category:
- Windows event logs
references:
- https://pureinfotech.com/enable-remote-desktop-command-prompt-windows-10/

id: '38206.68754'
title: Sliver C2 Implant Activity Pattern
description: Adversaries may abuse command and script interpreters to execute commands,
  scripts, or binaries. These interfaces and languages provide ways of interacting
  with computer systems and are a common feature across many different platforms.
  Most systems come with some built-in command-line interface and scripting capabilities,
  for example, macOS and Linux distributions include some flavor of Unix Shell while
  Windows installations include the Windows Command Shell and PowerShell. This use
  case detects process activity patterns related to Sliver C2 framework implants when
  spawning PowerShell.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "-NoExit" "-Command" "[Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8"
  | table _time, host, user, parent_*, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1059/
- https://github.com/BishopFox/sliver/blob/master/implant/sliver/shell/shell_windows.go#L39
- https://sliver.sh/docs?name=Compile+from+Source
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml

name: SMB Traffic Spike
id: 7f5fb3e1-4209-4914-90db-0ec21b936378
version: 11
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
description: The following analytic detects spikes in Server Message Block (SMB) traffic connections, which are used for sharing files and resources between computers. It leverages network traffic logs to monitor connections on ports 139 and 445, and SMB application usage. By calculating the average and standard deviation of SMB connections over the past 70 minutes, it identifies sources exceeding two standard deviations from the average. This activity is significant as it may indicate potential SMB-based attacks, such as ransomware or data theft. If confirmed malicious, attackers could exfiltrate data or spread malware within the network.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic
      WHERE All_Traffic.dest_port=139
        OR
        All_Traffic.dest_port=445
        OR
        All_Traffic.app=smb
      BY _time span=1h, All_Traffic.src
    | `drop_dm_object_name("All_Traffic")`
    | eventstats max(_time) as maxtime
    | stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-70m@m"), count, null))) as count avg(eval(if(_time<relative_time(maxtime, "-70m@m"), count, null))) as avg stdev(eval(if(_time<relative_time(maxtime, "-70m@m"), count, null))) as stdev
      BY src
    | eval upperBound=(avg+stdev*2), isOutlier=if(count > upperBound AND num_data_samples >=50, 1, 0)
    | where isOutlier=1
    | table src count
    | `smb_traffic_spike_filter`
how_to_implement: This search requires you to be ingesting your network traffic logs and populating the `Network_Traffic` data model.
known_false_positives: A file server may experience high-demand loads that could cause this analytic to trigger.
references: []
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Anomalous splike of SMB traffic sent from $src$
analytic_story:
    - Emotet Malware DHS Report TA18-201A
    - Hidden Cobra Malware
    - Ransomware
    - DHS Report TA18-074A
asset_type: Endpoint
mitre_attack_id:
    - T1021.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Windows CAB File on Disk
id: 622f08d0-69ef-42c2-8139-66088bc25acd
version: 12
creation_date: '2023-11-16'
modification_date: '2026-08-24'
author: Michael Haag, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects .cab files being written to disk.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'.
    This activity can be significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code.
    If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise.
    Analysts should review the file path and associated artifacts for further investigation.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count values(Filesystem.file_path) as file_path
            min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Filesystem WHERE

    Filesystem.action IN ("created", "modified")
    Filesystem.file_name="*.cab"
    NOT Filesystem.file_path IN (
        "*\\AppData\\Local\\Microsoft\\*",
        "*\\Windows Kits\\10\\ADK\\Installers\\*",
        "C:\\Program Files (x86)\\*",
        "C:\\Program Files\\*",
        "C:\\ProgramData\\Microsoft\\*",
        "C:\\ProgramData\\Package Cache\\*",
        "C:\\Windows\\appcompat\\*",
        "C:\\Windows\\Logs\\CBS\\*",
        "C:\\Windows\\servicing\\*",
        "C:\\Windows\\SoftwareDistribution\\*",
        "C:\\Windows\\System32\\*",
        "C:\\Windows\\SystemApps\\*",
        "C:\\Windows\\SysWOW64\\*",
        "C:\\Windows\\WinSxS\\*",
    )

    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
       Filesystem.user Filesystem.vendor_product

    | `drop_dm_object_name("Filesystem")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_cab_file_on_disk_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
    These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
    To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions.
    These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
    The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Some false positives are expected from user controlled folders.
references:
    - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The file [$file_path$] with a .cab extension was written to disk on endpoint $dest$.
threat_objects:
    - field: file_path
      type: file_path
analytic_story:
    - DarkGate Malware
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
cve:
    - CVE-2026-47301
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chromium Browser with Custom User Data Directory
id: 4f546cf4-15aa-4368-80f7-940e92bc551e
version: 8
creation_date: '2025-05-28'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects instances where the Chromium-based browser (e.g., Google Chrome, Microsoft Edge) is launched with the --user-data-dir command-line argument. While this flag is legitimate and used for multi-profile support or automation, it is frequently leveraged by malware and adversaries to run Chrome in an isolated environment for stealth operations, credential harvesting, phishing delivery, or evasion of user session artifacts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
    Processes.process = "*--user-data-dir*"
    Processes.process IN ("*--disable-gpu*", "*--disable-3d-apis*")
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_chromium_browser_with_custom_user_data_directory_filter`
how_to_implement: |
    To successfully implement this search you need to be ingesting information
    on process that include the name of the process responsible for the changes from
    your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
    confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
    endpoint product.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
references:
    - https://chromium.googlesource.com/chromium/src/+/main/docs/user_data_dir.md
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A chromium process with the --user-data-dir flag was launched on $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - StealC Stealer
    - Malicious Inno Setup Loader
    - Lokibot
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1497
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chromium Process with Disabled Extensions
id: ce245717-779b-483b-bc52-fc7a94729973
version: 5
creation_date: '2026-02-02'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects instances of Chromium-based browser processes on Windows launched with extensions explicitly disabled via command-line arguments. Disabling extensions can be used by automation frameworks, testing tools, or headless browser activity, but may also indicate defense evasion or abuse of browser functionality by malicious scripts or malware. This behavior reduces browser visibility and bypasses user-installed security extensions, making it relevant for detecting non-interactive execution, suspicious automation, or living-off-the-land techniques. Analysts should validate execution context, parent process, and command-line parameters to determine legitimacy.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes
    where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
    Processes.process = "*--disable-extensions*"
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_chromium_process_with_disabled_extensions_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Administrators may enable or disable this feature for framework testing that may cause some false positive.
references:
    - https://www.trendmicro.com/en_us/research/26/a/analysis-of-the-evelyn-stealer-campaign.html
    - https://peter.sh/experiments/chromium-command-line-switches/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: User $user$ launched a Chromium-based browser on $dest$ with the --disable-extensions flag. Parent process $parent_process_name$. Command line $process$.
        - field: user
          type: user
          score: 20
          message: User $user$ launched a Chromium-based browser on $dest$ with the --disable-extensions flag. Parent process $parent_process_name$. Command line $process$.
threat_objects:
    - field: parent_process
      type: parent_process
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Browser Hijacking
asset_type: Endpoint
mitre_attack_id:
    - T1497
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Cisco Secure Endpoint Unblock File Via Sfc
id: 9a7a490c-5581-4c95-bab5-a21e351293ef
version: 7
creation_date: '2021-07-29'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the sfc.exe utility with the "-unblock" parameter, a feature within Cisco Secure Endpoint. The "-unblock" flag is used to remove system blocks imposed by the endpoint protection. This detection focuses on command-line activity that includes the "-unblock" parameter, as it may indicate an attempt to restore access to files or processes previously blocked by the security software. While this action could be legitimate in troubleshooting scenarios, malicious actors might use it to override protective measures, enabling execution of blocked malicious payloads or bypassing other security mechanisms.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_unblock_file_via_sfc_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
references:
    - https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Suspicious use of `sfc.exe` unblocking a potentially harmful file on $dest$ by user $user$
        - field: dest
          type: system
          score: 20
          message: Suspicious use of `sfc.exe` unblocking a potentially harmful file on $dest$ by user $user$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Security Solution Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Credentials from Password Stores Deletion
id: 46d676aa-40c6-4fe6-b917-d23b621f0f89
version: 13
creation_date: '2022-12-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the Windows OS tool cmdkey.exe with the /delete parameter. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. The activity is significant because cmdkey.exe can be used by attackers to delete stored credentials, potentially leading to privilege escalation and persistence. If confirmed malicious, this behavior could allow attackers to remove stored user credentials, hindering incident response efforts and enabling further unauthorized access to the compromised system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (Processes.process_name="cmdkey.exe"
        OR
        Processes.original_file_name = "cmdkey.exe")
        AND
        Processes.process = "*/delete*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_credentials_from_password_stores_deletion_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network administrator can use this tool for auditing process.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
finding:
    title: a process $process_name$ was executed on $dest$ to delete stored credentials
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Compromised Windows Host
    - DarkGate Malware
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1555
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint