Splunk rules: 0r

name: AWS IAM AccessDenied Discovery Events
id: 3e1f1568-9633-11eb-a69c-acde48001122
version: 11
creation_date: '2021-04-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies excessive AccessDenied events within an hour timeframe for IAM users in AWS. It leverages AWS CloudTrail logs to detect multiple failed access attempts from the same source IP and user identity. This activity is significant as it may indicate that an access key has been compromised and is being misused for unauthorized discovery actions. If confirmed malicious, this could allow attackers to gather information about the AWS environment, potentially leading to further exploitation or privilege escalation.
data_source:
    - AWS CloudTrail
search: |-
    `cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com)
      | bucket _time span=1h
      | rename user_name as user
      | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(signature) as methods, dc(dest) as sources values(signature) as signature values(dest) as dest
        BY src, user, vendor_account
           vendor_region, vendor_product
      | where failures >= 5 and methods >= 1 and sources >= 1
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_iam_accessdenied_discovery_events_filter`
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
references:
    - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious Cloud User Activities
asset_type: AWS Account
mitre_attack_id:
    - T1580
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: Cisco Secure Firewall - Potential Data Exfiltration
id: 3d8536b6-52b4-4c3e-b695-3f2e90bb22be
version: 7
creation_date: '2025-04-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. It leverages Cisco Secure Firewall Threat Defense ConnectionEvent logs and thresholds on InitiatorBytes (bytes transmitted by the initiator), which for typical inside-initiated client sessions approximates upload or outbound payload from the internal host and avoids flagging large downloads where most bytes appear in ResponderBytes. Connections where the initiator sent at least 100 MB are flagged, as these may indicate unauthorized data exfiltration, especially if associated with unusual users, hosts, or processes. This analytic is scoped to inside-to-outside flows using a macro (cisco_secure_firewall_inside_to_outside) to abstract environment-specific zone definitions. If confirmed malicious, this behavior may reflect data staging and exfiltration over an encrypted or stealthy transport.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    `cisco_secure_firewall` EventType=ConnectionEvent `cisco_secure_firewall_inside_to_outside`
    | eval initiator_mb = round(InitiatorBytes / 1024 / 1024, 2)
    | where initiator_mb >= 100
    | eval Potentially_Exfiltrated = initiator_mb + " MB"
    | stats min(_time) as firstTime max(_time) as lastTime
        Values(url) as url
        Values(rule) as rule
        Values(dest_port) as dest_port
        by src, dest, Potentially_Exfiltrated, transport, action
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___potential_data_exfiltration_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the ConnectionEvent EventType. This search uses two input macros named `cisco_secure_firewall` and `cisco_secure_firewall_inside_to_outside`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definitions
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The access policy must also enable logging.
known_false_positives: |
    Large initiator-side transfers may occur due to legitimate activities such as cloud backups, file syncing, or developer build deployments.
    Backup servers, CI/CD pipelines, and enterprise sync tools (e.g., OneDrive, Dropbox) may exhibit similar patterns.
    Uncommon connection initiation (e.g., certain server-initiated or asymmetric paths) can change which side is logged as the initiator; tune or filter those scenarios if needed.
    Additional validation using user context, scheduled task windows, or endpoint telemetry is recommended to reduce false positives.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Potential data exfiltration activity from $src$ to $dest$ — With $Potentially_Exfiltrated$ transferred (initiator bytes)
threat_objects:
    - field: url
      type: url
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1041
    - T1567.002
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Detect AWS Console Login by User from New Country
id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
version: 9
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Eric McGinnis Splunk
status: production
type: Hunting
description: The following analytic identifies AWS console login events by users from a new country. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen users and their login locations. This activity is significant because logins from new countries can indicate potential unauthorized access or compromised accounts. If confirmed malicious, this could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the AWS environment.
data_source:
    - AWS CloudTrail
search: |-
    | tstats earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Authentication
      WHERE Authentication.signature=ConsoleLogin
      BY Authentication.user Authentication.src
    | iplocation Authentication.src
    | `drop_dm_object_name(Authentication)`
    | rename Country as justSeenCountry
    | table firstTime lastTime user justSeenCountry
    | join user type=outer [
    | inputlookup previously_seen_users_console_logins
    | rename Country as previouslySeenCountry
    | stats min(firstTime) AS earliestseen
      BY user previouslySeenCountry
    | fields earliestseen user previouslySeenCountry]
    | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country")
    | where userCountry = "New Country"
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime user previouslySeenCountry justSeenCountry userCountry
    | `detect_aws_console_login_by_user_from_new_country_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro.
known_false_positives: When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
references: []
analytic_story:
    - Suspicious AWS Login Activities
    - Suspicious Cloud Authentication Activities
    - AWS Identity and Access Management Account Takeover
    - Compromised User Account
asset_type: AWS Instance
mitre_attack_id:
    - T1535
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Users in CloudTrail - Initial
    - Previously Seen Users In CloudTrail - Update

name: Detect Password Spray Attempts
id: 086ab581-8877-42b3-9aee-4a7ecb0923af
version: 12
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This analytic employs the 3-sigma approach to detect an unusual volume of failed authentication attempts from a single source. A password spray attack is a type of brute force attack where an attacker tries a few common passwords across many different accounts to avoid detection and account lockouts. By utilizing the Authentication Data Model, this detection is effective for all CIM-mapped authentication events, providing comprehensive coverage and enhancing security against these attacks.
data_source:
    - Windows Event Log Security 4625
search: "| tstats `security_content_summariesonly` values(Authentication.user) AS unique_user_names dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action=\"failure\" NOT Authentication.src IN (\"-\",\"unknown\") by Authentication.action Authentication.app Authentication.authentication_method Authentication.dest \n  Authentication.signature Authentication.signature_id Authentication.src sourcetype _time span=5m  \n| `drop_dm_object_name(\"Authentication\")`\n    ```fill out time buckets for 0-count events during entire search length```\n| appendpipe [| timechart limit=0 span=5m count | table _time] | fillnull value=0 unique_accounts\n  ``` Create aggregation field & apply to all null events```\n| eval counter=src+\"__\"+sourcetype+\"__\"+signature_id  | eventstats values(counter) as fnscounter  | eval counter=coalesce(counter,fnscounter) \n  ``` stats version of mvexpand ```\n| stats values(app) as app values(unique_user_names) as unique_user_names values(total_failures) as total_failures values(src) as src values(signature_id) as signature_id values(sourcetype) as sourcetype count by counter unique_accounts _time\n    ``` remove duplicate time buckets for each unique source```\n| sort - _time unique_accounts | dedup _time counter\n    ```Find the outliers```\n| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0) | replace \"::ffff:*\" with * in src  | where isOutlier=1  | foreach * \n    [ eval <<FIELD>> = if(<<FIELD>>=\"null\",null(),<<FIELD>>)] \n| table _time, src, action, app, unique_accounts, unique_user_names, total_failures, sourcetype, signature_id, counter | `detect_password_spray_attempts_filter`"
how_to_implement: 'Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device.  Also ensure fill_nullvalue is set within the macro security_content_summariesonly. This search opporates best on a 5 minute schedule, looking back over the past 70 minutes.  Configure 70 minute throttling on the two fields _time and counter. '
known_false_positives: No false positives have been identified at this time.
references:
    - https://attack.mitre.org/techniques/T1110/003/
finding:
    title: Potential Password Spraying attack from $src$ targeting $unique_accounts$ unique accounts.
    entity:
        field: unique_user_names
        type: user
        score: 50
threat_objects:
    - field: src
      type: system
analytic_story:
    - Compromised User Account
    - Active Directory Password Spraying
asset_type: Endpoint
atomic_guid:
    - 90bc2e54-6c84-47a5-9439-0a2a92b4b175
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '6582.7595'
title: Dotnet.exe Execution
description: dotnet.exe comes with .NET Framework, is trusted binary and Default AppLocker
  rule does not block it so it will execute any dll even if applocker is enabled.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") ("dotnet") | table _time, host, user user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- Windows event logs
references:
- https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/

name: Get ADUser with PowerShell Script Block
id: 21432e40-04f4-11ec-b7e6-acde48001122
version: 10
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `Get-AdUser` PowerShell cmdlet, which is used to enumerate all domain users. It leverages PowerShell Script Block Logging (EventCode=4104) to identify instances where this command is executed with a filter. This activity is significant as it may indicate an attempt by adversaries or Red Teams to gather information about domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance and potential exploitation of user accounts within the domain.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `get_aduser_with_powershell_script_block_filter`
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://www.blackhillsinfosec.com/red-blue-purple/
    - https://attack.mitre.org/techniques/T1087/002/
    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps
analytic_story:
    - Active Directory Discovery
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Gsuite Suspicious Shared File Name
id: 07eed200-03f5-11ec-98fb-acde48001122
version: 12
creation_date: '2021-08-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: experimental
type: Anomaly
description: The following analytic detects shared files in Google Drive with suspicious filenames commonly used in spear phishing campaigns. It leverages GSuite Drive logs to identify documents with titles that include keywords like "dhl," "ups," "invoice," and "shipment." This activity is significant because such filenames are often used to lure users into opening malicious documents or clicking harmful links. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further compromise of the user's system.
data_source:
    - G Suite Drive
search: |-
    `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
      | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"
      | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"
      | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com"
      | eval phase="plan"
      | eval severity="low"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY email parameters.owner parameters.target_user
           parameters.doc_title parameters.doc_type phase
           severity
      | rename parameters.target_user AS user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gsuite_suspicious_shared_file_name_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
known_false_positives: normal user or normal transaction may contain the subject and file type attachment that this detection try to search
references:
    - https://www.redhat.com/en/topics/devops/what-is-devsecops
    - https://www.mandiant.com/resources/top-words-used-in-spear-phishing-attacks
intermediate_findings:
    entities:
        - field: email
          type: user
          score: 20
          message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
        - field: parameters.owner
          type: user
          score: 20
          message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
analytic_story:
    - Dev Sec Ops
asset_type: GSuite
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint

name: HTTP Malware User Agent
id: 8c4866e4-f488-4253-8537-7dc4f954c292
version: 5
creation_date: '2026-01-06'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of malware. This activity can signify possible compromised hosts on the network.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.http_user_agent != null
      BY Web.http_user_agent Web.http_method, Web.url,
         Web.url_length Web.src, Web.dest
    | `drop_dm_object_name("Web")`
    | lookup malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware
    | where isnotnull(malware)
    | stats count min(firstTime) as first_seen max(lastTime) as last_seen
      BY malware url http_user_agent
         src dest
    | `security_content_ctime(first_seen)`
    | `security_content_ctime(last_seen)`
    | `http_malware_user_agent_filter`
how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
known_false_positives: Filtering may be required in some instances depending on legacy system usage, filter as needed.
references:
    - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_http_user_agents_list.csv
finding:
    title: A known malware user agent $http_user_agent$ was performing a request from $src$.
    entity:
        field: src
        type: system
        score: 50
threat_objects:
    - field: http_user_agent
      type: http_user_agent
analytic_story:
    - Lokibot
    - Lumma Stealer
    - Meduza Stealer
    - Crypto Stealer
    - RedLine Stealer
    - Suspicious User Agents
asset_type: Network
mitre_attack_id:
    - T1071.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Linux Clipboard Data Copy
id: 7173b2ad-6146-418f-85ae-c3479e4515fc
version: 11
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=xclip Processes.process IN ("*-o *", "*-sel *", "*-selection *", "*clip *","*clipboard*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_clipboard_data_copy_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1115/
    - https://linux.die.net/man/1/xclip
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ adding or removing content from the clipboard.
        - field: dest
          type: system
          score: 20
          message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ adding or removing content from the clipboard.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1115
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Impair Defenses Process Kill
id: 435c6b33-adf9-47fe-be87-8e29fd6654f5
version: 11
creation_date: '2023-02-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of the 'pkill' command, which is used to terminate processes on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because threat actors often use 'pkill' to disable security defenses or terminate critical processes, facilitating further malicious actions. If confirmed malicious, this behavior could lead to the disruption of security applications, enabling attackers to evade detection and potentially corrupt or destroy files on the targeted system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ( "pgrep", "pkill") Processes.process = "*pkill *"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `linux_impair_defenses_process_kill_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network admin can terminate a process using this linux command. Filter is needed.
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
    - https://cert.gov.ua/article/3718487
analytic_story:
    - AwfulShred
    - Data Destruction
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32492.57744'
title: Microsoft Build Engine Suspicious Parent Process
description: Adversaries may take advantage of trusted developer utilities to proxy
  execution of malicious payloads. There are many utilities used for software development
  related tasks that can be used to execute code in various forms to assist in development,
  debugging, and reverse engineering. These utilities may often be signed with legitimate
  certificates that allow them to execute on a system and proxy execution of malicious
  code through a trusted process that effectively bypasses application control solutions.
  This use case detects msbuild.exe spawned by a scripting interpreter (such as CMD,
  PowerShell, etc.).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("msbuild.exe" OR TERM(msbuild)) ("cmd.exe" OR
  "powershell.exe" OR "pwsh.exe" OR "powershell_ise.exe" OR "cscript.exe" OR "wscript.exe"
  OR "mshta.exe") | regex process_name="(?i)msbuild\.exe"| regex parent_process_name="(?i)(cmd|powershell(_ise)?|pwsh|cscript|wscript|mshta)\.exe"
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- defense-evasion:trusted developer utilities proxy execution:msbuild
- execution:command and scripting interpreter
- defense-evasion:trusted developer utilities proxy execution
- execution:command and scripting interpreter:visual basic
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1127.001
- T1059
- T1127
- T1059.005
- T1059.003
data_category:
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1127/001/
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1059/001/
- https://attack.mitre.org/techniques/T1059/003/
- https://attack.mitre.org/techniques/T1059/005/
- https://detection.fyi/elastic/detection-rules/windows/defense_evasion_execution_msbuild_started_by_script/?query=msbuild

id: '13473.19309'
title: Mimikatz Execution
description: 'Mimikatz is used to extract plaintexts passwords, hash, PIN code and
  Kerberos tickets from memory. This use case looks for keywords leveraged while using
  Mimikatz -- Threat Actor Association: Alloy Taurus/Gallium, APT10/Cicada, APT15,
  APT27/Emissary Panda, APT29/Nobelium, APT41/Wicked Panda, Carbanak, CL-STA-0043,
  DarkSide, BlackMatter, FamousSparrow, FIN7, FIN12, Flax Typhoon, Hello Kitty / Five
  Hands, Karakurt, Lapsus$, Lazarus, LockBit, Memento Team, Muddled Libra, Mustang
  Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), OilRig,
  TRACER KITTEN, TRAVELING SPIDER, Scattered Spider (aka. 0ktapus, UNC3944), SILENCE,
  UNC2596 -- Software Association: AvosLocker, Blackcat/ALPHV, BlackByte, Conti, Cuba,
  Midas, Lockbit, LV, Nefilim, Play, Qakbot, Ransom Cartel, Revil, SamSam, Stonefly,
  Trigona, Vice Society, WASTEDLOCKER -- Atomics T1003.001 Test #6 Atomics T1003.001
  Test #10 Atomics T1550.002 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("mimikatz.exe") OR TERM(sekurlsa::logonpasswords)
  OR TERM(sekurlsa::pth) OR TERM(sekurlsa::tickets) OR TERM(lsadump::lsa) | table
  _time, host, user process, process_*, signature_id, parent_* src_* dest_* | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials
- credential-access:os credential dumping
technique_id: 
- T1552
- T1003
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.sans.org/reading-room/whitepapers/detection/mimikatz-overview-defenses-detection-36780

id: '12915.18547'
title: Multiple nslookup commands
description: 'Threat actors have been observed gathering host based network information
  by running a batch script, which ran nslookup for each host in the environment.Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Software Association: Rhysida'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("nslookup" OR "nslookup.exe") | table _time,
  host, user process, process_*, signature_id, parent_* | bin span=60s | stats values(*)
  as * by _time, host | where match(process_name, "(?i)nslookup.exe") and event_count
  > 2 '
techniques:
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id: 
- T1016
- T1018
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2022/04/25/quantum-ransomware/

id: '19129.33154'
title: Potential Cryptomining Commands
description: Adversaries may leverage the resources of co-opted systems in order to
  solve resource intensive problems, which may impact system and/or hosted service
  availability. One common purpose for Resource Hijacking is to validate transactions
  of cryptocurrency networks and earn virtual currency. This use case detects common
  plaintext and base64 encoded commands for cryptomining activity.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("--cpu-priority=" OR "--donate-level=" OR " -o
  pool." OR " --nicehash" OR " --algo=" OR "stratum+tcp://" OR "stratum+udp://" OR
  "LS1kb25hdGUtbGV2ZWw9" OR "0tZG9uYXRlLWxldmVsP" OR "tLWRvbmF0ZS1sZXZlbD" OR "c3RyYXR1bSt0Y3A6Ly"
  OR "N0cmF0dW0rdGNwOi8v" OR "zdHJhdHVtK3RjcDovL" OR "c3RyYXR1bSt1ZHA6Ly" OR "N0cmF0dW0rdWRwOi8v"
  OR "zdHJhdHVtK3VkcDovL") | regex process!="(?i)(pool\.(c|o))\s|gcc\s-" | table _time,
  host, user, process, process_*, parent_process_name | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- impact:resource hijacking
technique_id: 
- T1496
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://xmrig.com/docs/miner/command-line-options
- https://www.trendmicro.com/en_us/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

id: '29435.55089'
title: PowerShell DownloadFile_DownloadString
description: Adversaries have the capability to move tools or files from an external
  system into a compromised environment. This involves copying tools or files from
  an external system controlled by the adversary to the victim network through the
  command and control channel. This use case detects PowerShell commands related to
  file downloads using DownloadFile and DownloadString methods. Executions involving
  Invoke-WebRequest and Invoke-Expression have been excluded as they are covered by
  other use cases.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("downloadfile" OR "downloadstring") "System.Net.WebClient" NOT ("Invoke-WebRequest"
  OR "Invoke-Expression") | regex process="(?i)System\.Net\.WebClient.+\.Download(file|string)"|
  regex process!="(?i)(^|\s|\;|\|)(iex|iwr)(\s|\;|\|)"| table _time, host, user, process,
  process_name, parent_process_name | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1059
- T1105
data_category:
- Windows Sysmon
references:
- https://blog.talosintelligence.com/lazarus-three-rats/
- https://blog.talosintelligence.com/prometei-botnet-improves/

id: '17778.29822'
title: Read-Only Attribute Removed - Windows
description: 'This use case detects commands removing read-only attributes from files
  on Windows systems. This technique is used by threat actors to modify or delete
  critical system files. Atomics T1222.001 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(attrib) OR TERM(attrib.exe)) "-r" | regex
  process="(?i)\s+-r\s+" | table _time, host, user parent_*, process, process_* |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md#atomic-test-3---attrib---remove-read-only-attribute

name: Steal or Forge Authentication Certificates Behavior Identified
id: 87ac670e-bbfd-44ca-b566-44e9f835518d
version: 9
creation_date: '2023-05-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Correlation
description: The following analytic identifies potential threats related to the theft or forgery of authentication certificates. It detects when five or more analytics from the Windows Certificate Services story trigger within a specified timeframe. This detection leverages aggregated risk scores and event counts from the Risk data model. This activity is significant as it may indicate an ongoing attack aimed at compromising authentication mechanisms. If confirmed malicious, attackers could gain unauthorized access to sensitive systems and data, potentially leading to severe security breaches.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
      WHERE All_Risk.analyticstories="Windows Certificate Services" All_Risk.risk_object_type="system"
      BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >= 5
    | `steal_or_forge_authentication_certificates_behavior_identified_filter`
how_to_implement: The Windows Certificate Services analytic story must have 5 or more analytics enabled. In addition, ensure data is being logged that is required. Modify the correlation as needed based on volume of noise related to the other analytics.
known_false_positives: False positives may be present based on automated tooling or system administrators. Filter as needed.
references:
    - https://research.splunk.com/stories/windows_certificate_services/
    - https://attack.mitre.org/techniques/T1649/
finding:
    title: Steal or Forge Authentication Certificates Behavior Identified - $risk_object$
    entity:
        field: risk_object
        type: system
        score: 0
analytic_story:
    - Windows Certificate Services
asset_type: Endpoint
atomic_guid:
    - 290df60e-4b5d-4a5e-b0c7-dc5348ea0c86
    - 78b274f8-acb0-428b-b1f7-7b0d0e73330a
    - 7617f689-bbd8-44bc-adcd-6f8968897848
mitre_attack_id:
    - T1649
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '16967.27502'
title: System Enumeration with WMIC
description: 'An adversary may attempt to get detailed information about the operating
  system and hardware, including version, patches, hotfixes, service packs, and architecture.
  Adversaries may use the information from System Information Discovery during automated
  discovery to shape follow-on behaviors, including whether or not the adversary fully
  infects the target and/or attempts specific actions. This use case detects several
  WMIC executions in a short period of time. -- Threat Actor Association: Volt Typhoon
  -- Atomics T1082 Test #25'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(wmic) OR "wmic.exe" | table _time, host,
  user, process, process_*, parent_process*| regex process_name="(?i)wmic"| bin span=120s
  | stats values(*) as * by _time, host | eventstats dc(process) as dc_process by
  host, _time| where dc_process > 5 '
techniques:
- discovery:system information discovery
- execution:windows management instrumentation
technique_id: 
- T1082
- T1047
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic

name: System Info Gathering Using Dxdiag Application
id: f92d74f2-4921-11ec-b685-acde48001122
version: 8
creation_date: '2021-11-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of the dxdiag.exe process with specific command-line arguments, which is used to gather system information. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line details. This activity is significant because dxdiag.exe is rarely used in corporate environments and its execution may indicate reconnaissance efforts by malicious actors. If confirmed malicious, this activity could allow attackers to collect detailed system information, aiding in further exploitation or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe)
    Processes.process = "* /t *"
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
    | `system_info_gathering_using_dxdiag_application_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: This commandline can be used by a network administrator to audit host machine specifications. Thus, a filter is needed.
references:
    - https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/
analytic_story:
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1592
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AD GPO New CSE Addition
id: 700c11d1-da09-47b2-81aa-358c143c7986
version: 10
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console.
data_source:
    - Windows Event Log Security 5136
search: |-
    `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames
      | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest
        BY ObjectClass ObjectDN OpCorrelationID
           src_user SubjectLogonId
      | rex field=old_value max_match=10000 "(?P<old_values>\{.*?\})"
      | rex field=new_value max_match=10000 "(?P<new_values>\{.*?\})"
      | rex field=ObjectDN max_match=10000 "CN=(?P<policy_guid>\{.*?\})"
      | mvexpand new_values
      | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z
      | \d]+\-[A-Z
      | \d]+\-[A-Z
      | \d]+\-[A-Z
      | \d]+\-[A-Z
      | \d]+\}")
      | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType
      | eval newPolicy=if(policyType like "%",policyType,new_values)
      | join ObjectDN  [
      | search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update
      | stats latest(displayName) as displayName
        BY distinguishedName
      | eval ObjectDN=upper(distinguishedName)]
      | stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName
        BY ObjectDN
      | `windows_ad_gpo_new_cse_addition_filter`
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security and admon macros are configured with the correct indexes.
known_false_positives: General usage of group policy will trigger this detection, also please not GPOs modified using tools such as SharpGPOAbuse will not generate the AD audit events which enable this detection.
references:
    - https://wald0.com/?p=179
    - https://learn.microsoft.com/en-gb/archive/blogs/mempson/group-policy-client-side-extension-list
    - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
    - https://github.com/FSecureLABS/SharpGPOAbuse
finding:
    title: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1222.001
    - T1484.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint