Splunk rules: 0s

id: '6158.6685'
title: Certutil Obfuscate_Encode Files
description: 'Certutil can be used to encode files to evade defensive measures. --
  Threat Actor Association: APT29/Nobelium/Cozy Bear, Arid Viper/APT C-23, BlackTech
  - Software Association: Conti'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("certutil" (TERM(-encode) OR TERM(-encodehex)))
  OR (TERM(-encode) OR TERM(-encodehex)) | table _time, host, user, signature_id,
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host
  | where match(process, "(?i)-encode") '
techniques:
- command-and-control:data encoding
- defense-evasion:obfuscated files or information
technique_id: 
- T1027
- T1132
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/

name: Excessive Usage of NSLOOKUP App
id: 0a69fdaa-a2b8-11eb-b16d-acde48001122
version: 13
creation_date: '2021-04-22'
modification_date: '2026-08-24'
author: Teoderick Contreras, Stanislav Miskovic, Splunk
status: production
type: Anomaly
description: The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious,this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count as numNsLookup min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product values(Processes.parent_process) as parent_process values(Processes.process_name) as process_name values(Processes.parent_process_id) as parent_process_id values(Processes.user) as user FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "nslookup.exe"
      BY Processes.dest _time span=1m
    | `drop_dm_object_name(Processes)`
    | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots
      BY dest
    | eval upperThreshold=(avgNsLookup + stdNsLookup *3)
    | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0)
    | search isOutlier=1
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `excessive_usage_of_nslookup_app_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
known_false_positives: Network or DNS monitoring tools that perform bulk nslookup checks against multiple domains in quick succession (e.g., CDN health checks, load balancer DNS validation scripts) may exceed the detection threshold as part of normal, scheduled operation. Hosts with limited historical baseline data may also cross the dynamic threshold more easily due to low computed average and standard deviation values. Tune the detection or add exceptions for known monitoring tool parent processes as needed.
references:
    - https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings
    - https://www.varonis.com/blog/dns-tunneling
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Excessive usage of nslookup.exe has been detected on $dest$. This detection is triggered as as it violates the dynamic threshold
analytic_story:
    - Suspicious DNS Traffic
    - Dynamic DNS
    - Data Exfiltration
    - Command And Control
asset_type: Endpoint
mitre_attack_id:
    - T1048
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux GNU Awk Privilege Escalation
id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the 'gawk' command with elevated privileges on a Linux system. It leverages Endpoint Detection and Response (EDR) telemetry to identify command-line executions where 'gawk' is used with 'sudo' and 'BEGIN{system' patterns. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute system commands as root. If confirmed malicious, this could lead to full root access, enabling the attacker to control the system, modify critical files, and maintain persistent access.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*gawk*"
        AND
        Processes.process="*BEGIN*{system*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `linux_gnu_awk_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/gawk/
    - https://www.geeksforgeeks.org/gawk-command-in-linux-with-examples/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Telnet Authentication Bypass
id: 6e0913d4-5461-487c-9dce-6d22ef2c0f03
version: 5
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: Detects an authentication bypass in telnet tracked as CVE-2026-24061. An attacker can supply a specifically crafted USER environment variable (-f root) that is passed to /usr/bin/login. Because this input isn't sanitized an attacker can force the system to skip authentication and login directly as root.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "login" Processes.parent_process_name = "telnetd" Processes.process = "* -p *" Processes.process = "* -f root*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_telnet_authentication_bypass_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is rare for the telnetd to spawn login process with these arguments.
references:
    - https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified on endpoint $dest$ by user $user$ related to an authentication bypass in telnetd.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified on endpoint $dest$ by user $user$ related to an authentication bypass in telnetd.
threat_objects:
    - field: parent_process
      type: parent_process
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Telnetd CVE-2026-24061
asset_type: Endpoint
cve:
    - CVE-2026-24061
mitre_attack_id:
    - T1548
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '40510.73996'
title: LocalAccountTokenFilterPolicy Registry Value Modified
description: The HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
  key is responsible for controlling how local accounts are filtered when they are
  used to access a Windows system remotely. By setting the key to value '1', it effectively
  disables Remote UAC filtering for local accounts, allowing local admin accounts
  to use elevated tokens (with full admin rights when connecting remotely). This may
  leave a system vulnerable to Pass the Hash attacks. This use case detects registry
  modification events or process executions with registry modification commands targeting
  LocalAccountTokenFilterPolicy.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (((TERM(EventCode=1) OR "<EventID>1<")
  "Set-ItemProperty" OR "sp " OR "ADD") OR (TERM(EventCode=12) OR "<EventID>12<")
  OR TERM(EventCode=13) OR "<EventID>13<") "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  "LocalAccountTokenFilterPolicy" | table _time, host, user user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- defense-evasion:use alternate authentication material:pass the hash
technique_id:
- T1112
- T1550.002
data_category:
- Windows Sysmon
references:
- https://www.security.com/threat-intelligence/china-southeast-asia-espionage
- https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167
- https://kb.cybertecsecurity.com/knowledge/localaccounttokenfilterpolicy

name: O365 High Privilege Role Granted
id: e78a1037-4548-4072-bb1b-ad99ae416426
version: 10
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects when high-privilege roles such as "Exchange Administrator," "SharePoint Administrator," or "Global Administrator" are granted within Office 365. It leverages O365 audit logs to identify events where these roles are assigned to any user or service account. This activity is significant for SOCs as these roles provide extensive permissions, allowing broad access and control over critical resources and data. If confirmed malicious, this could enable attackers to gain significant control over O365 resources, access, modify, or delete critical data, and compromise the overall security and functionality of the O365 environment.
data_source:
    - O365 Add member to role.
search: "`o365_management_activity` Operation=\"Add member to role.\" Workload=AzureActiveDirectory | eval role_id = mvindex('ModifiedProperties{}.NewValue',2) | eval role_name = mvindex('ModifiedProperties{}.NewValue',1) | where role_id IN (\"29232cdf-9323-42fd-ade2-1d097af3e4de\", \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\", \"62e90394-69f5-4237-9190-012177145e10\") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product ObjectId role_name role_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_high_privilege_role_granted_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Privilege roles may be assigned for legitimate purposes, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/003/
    - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
    - https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-exchange-online-admin-role?view=o365-worldwide
    - https://learn.microsoft.com/en-us/sharepoint/sharepoint-admin-role
finding:
    title: $user$ granted high privilege roles to $ObjectId$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: O365 Multiple OS Vendors Authenticating From User
id: 3451e58a-9457-4985-a600-b616b0cbfda1
version: 7
creation_date: '2025-01-06'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various logon capabilities of Azure/EntraID/Office 365 and attempting to discover weaknesses in the organizational MFA or conditional access configurations. Usage of the tools like "MFASweep" will trigger this detection.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn)
    | eval -time = _time
    | bin _time span=15m
    | fillnull
    | stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by ClientIP, UserId, _time, dest, vendor_account, vendor_product
    | where os_count >= 4
    | eval src = ClientIP, user = UserId
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_multiple_os_vendors_authenticating_from_user_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique OS) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
known_false_positives: IP or users where the usage of multiple Operating systems is expected, filter accordingly.
references:
    - https://attack.mitre.org/techniques/T1110
    - https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/
    - https://sra.io/blog/msspray-wait-how-many-endpoints-dont-have-mfa/
    - https://github.com/dafthack/MFASweep/tree/master
finding:
    title: The user account $user$ authenticated with $os_count$ unique operating system types over a short period from $src$.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '16076.24079'
title: Process Executed with Null Command Line
description: Adversaries may inject code into processes in order to evade process-based
  defenses as well as possibly elevate privileges. Process injection is a method of
  executing arbitrary code in the address space of a separate live process. Running
  code in the context of another process may allow access to the process's memory,
  system/network resources, and possibly elevated privileges. Execution via process
  injection may also evade detection from security products since the execution is
  masked under a legitimate process. For some Windows processes, execution with a
  null command line is not expected activity and may be an indication of process injection.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("backgroundtaskhost.exe" OR "svchost.exe" OR "dllhost.exe" OR "werfault.exe" OR
  "searchprotocolhost.exe" OR "wuauclt.exe" OR "spoolsv.exe" OR "rundll32.exe" OR
  "regasm.exe" OR "regsvr32.exe" OR "regsvcs.exe") | regex process="(?i)((backgroundtaskhost|svchost|dllhost|werfault|searchprotocolhost|wuauclt|spoolsv|rundll32|regasm|regsvr32|regsvcs)\.exe\"?)$"
  | table _time, host, user process, process_*, parent_process_*, signature_id | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:process injection
technique_id: 
- T1055
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://redcanary.com/threat-detection-report/techniques/process-injection/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes/

name: SAM Database File Access Attempt
id: 57551656-ebdb-11eb-afdf-acde48001122
version: 8
creation_date: '2021-07-23'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects attempts to access the SAM, SYSTEM, or SECURITY database files within the `windows\system32\config` directory using Windows Security EventCode 4663. This detection leverages Windows Security Event logs to identify unauthorized access attempts. Monitoring this activity is crucial as it indicates potential credential access attempts, possibly exploiting vulnerabilities like CVE-2021-36934. If confirmed malicious, an attacker could extract user passwords, leading to unauthorized access, privilege escalation, and further compromise of the system.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` (EventCode=4663)  ProcessName!=*\\dllhost.exe ObjectName IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") | stats values(AccessList) count by ProcessName ObjectName dest src_user | rename ProcessName as process_name | `sam_database_file_access_attempt_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
references:
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
    - https://github.com/GossiTheDog/HiveNightmare
    - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
    - https://en.wikipedia.org/wiki/Security_Account_Manager
analytic_story:
    - Credential Dumping
    - Graceful Wipe Out Attack
    - Rhysida Ransomware
asset_type: Endpoint
cve:
    - CVE-2021-36934
mitre_attack_id:
    - T1003.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious Rundll32 dllregisterserver
id: 8c00a385-9b86-4ac0-8932-c9ec3713b159
version: 14
creation_date: '2021-02-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of rundll32.exe with the DllRegisterServer command to load a DLL. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as it may indicate an attempt to register a malicious DLL, which can be a method for code execution or persistence. If confirmed malicious, an attacker could gain unauthorized code execution, escalate privileges, or maintain persistence within the environment, posing a severe security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_rundll32` Processes.process=*dllregisterserver*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_rundll32_dllregisterserver_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names.
references:
    - https://attack.mitre.org/techniques/T1218/011/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
    - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east
    - https://github.com/pan-unit42/tweets/blob/master/2020-12-10-IOCs-from-Ursnif-infection-with-Delf-variant.txt
    - https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/
    - https://docs.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver?redirectedfrom=MSDN
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a DLL. code
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a DLL. code
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Rundll32 Activity
    - Living Off The Land
    - IcedID
asset_type: Endpoint
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Diskshadow Proxy Execution
id: 58adae9e-8ea3-11ec-90f6-acde48001122
version: 10
creation_date: '2022-02-17'
modification_date: '2026-05-13'
author: Lou Stella, Splunk
status: production
type: TTP
description: The following analytic detects the use of DiskShadow.exe in scripting mode, which can execute arbitrary unsigned code. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions with scripting mode flags. This activity is significant because DiskShadow.exe is typically used for legitimate backup operations, but its misuse can indicate an attempt to execute unauthorized code. If confirmed malicious, this could lead to unauthorized code execution, potentially compromising the system and allowing further malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (Processes.process_name=diskshadow.exe OR Processes.original_file_name=diskshadow.exe)
    Processes.process IN (*-s*, */s*)
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_diskshadow_proxy_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators using the DiskShadow tool in their infrastructure as a main backup tool with scripts will cause false positives that can be filtered with `windows_diskshadow_proxy_execution_filter`
references:
    - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
finding:
    title: Possible Signed Binary Proxy Execution on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Change Win Defender Tracing Level
id: fe9391cd-952a-4c64-8f56-727cb0d4f2d4
version: 11
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry specifically targeting the "WppTracingLevel" setting within Windows Defender. This detection leverages data from the Endpoint.Registry data model to identify changes in the registry path associated with Windows Defender tracing levels. Such modifications are significant as they can impair the diagnostic capabilities of Windows Defender, potentially hiding malicious activities. If confirmed malicious, this activity could allow an attacker to evade detection and maintain persistence within the environment, leading to further compromise and data exfiltration.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\WppTracingLevel" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_tracing_level_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender WppTracingLevel registry was modified on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Indirect Command Execution Via pcalua
id: 3428ac18-a410-4823-816c-ce697d26f7a8
version: 11
creation_date: '2022-03-04'
modification_date: '2026-05-13'
author: Eric McGinnis, Splunk
status: production
type: TTP
description: The following analytic detects programs initiated by pcalua.exe, the Microsoft Windows Program Compatibility Assistant. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process information. While pcalua.exe can start legitimate programs, it is significant because attackers may use it to bypass command line execution protections. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, potentially leading to unauthorized actions, privilege escalation, or persistence within the environment.
data_source:
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process="*pcalua* -a*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_indirect_command_execution_via_pcalua_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter these results as needed.
references:
    - https://twitter.com/KyleHanslovan/status/912659279806640128
    - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
finding:
    title: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1202
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows InstallUtil Credential Theft
id: ccfeddec-43ec-11ec-b494-acde48001122
version: 13
creation_date: '2021-11-12'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazo, Splunk
status: production
type: TTP
description: The following analytic detects instances where the Windows InstallUtil.exe binary loads `vaultcli.dll` and `Samlib.dll`. This detection leverages Sysmon EventCode 7 to identify these specific DLL loads. This activity is significant because it can indicate an attempt to execute code that bypasses application control and captures credentials using tools like Mimikatz. If confirmed malicious, this behavior could allow an attacker to steal credentials, potentially leading to unauthorized access and further compromise of the system.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7 process_name=installutil.exe loaded_file_path IN ("*\\samlib.dll", "*\\vaultcli.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Typically, this will not trigger because, by its very nature, InstallUtil does not require credentials. Filter as needed.
references:
    - https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0
finding:
    title: An instance of process name [$process_name$] loading a file [$loaded_file$] was identified on endpoint- [$dest$] to potentially capture credentials in memory.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Signed Binary Proxy Execution InstallUtil
asset_type: Endpoint
mitre_attack_id:
    - T1218.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Multiple Users Remotely Failed To Authenticate From Host
id: 80f9d53e-9ca1-11eb-b0d6-acde48001122
version: 13
creation_date: '2021-04-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies a source host failing to authenticate against a remote host with 30 unique users. It leverages Windows Event 4625 with Logon Type 3, indicating remote authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges in an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information. This detection is crucial for real-time security monitoring and threat hunting.
data_source:
    - Windows Event Log Security 4625
search: |-
    `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-"
      | bucket span=5m _time
      | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest values(src) as src values(user) as user
        BY _time, IpAddress, Computer,
           action, app, authentication_method,
           signature, signature_id
      | rename Computer as dest
      | where unique_accounts > 30
      | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
finding:
    title: Potential password spraying attack on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Password Spraying
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Parent PID Spoofing with Explorer
id: 17f8f69c-5d00-4c88-9c6f-493bbdef20a1
version: 13
creation_date: '2022-05-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies a suspicious `explorer.exe` process with the `/root` command-line parameter. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process and command-line data. The presence of `/root` in `explorer.exe` is significant as it may indicate parent process spoofing, a technique used by malware to evade detection. If confirmed malicious, this activity could allow an attacker to operate undetected, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*explorer.exe*" Processes.process="*/root,*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_parent_pid_spoofing_with_explorer_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://x.com/CyberRaiju/status/1273597319322058752?s=20
finding:
    title: An explorer.exe process with process commandline $process$ on dest $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1134.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Query Registry UnInstall Program List
id: 535fd4fc-7151-4062-9d7e-e896bea77bf6
version: 11
creation_date: '2023-05-02'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects an access request on the uninstall registry key. It leverages Windows Security Event logs, specifically event code 4663. This activity is significant because adversaries or malware can exploit this key to gather information about installed applications, aiding in further attacks. If confirmed malicious, this behavior could allow attackers to map out installed software, potentially identifying vulnerabilities or software to exploit, leading to further system compromise.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` EventCode=4663 object_file_path="*\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_uninstall_program_list_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For Event code 4663, enable the "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: Uninstallers may access this registry to remove the entry of the target application. Filter as needed.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious process $process_name$ accessing uninstall registry on $dest$
analytic_story:
    - StealC Stealer
    - RedLine Stealer
    - Meduza Stealer
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Security And Backup Services Stop
id: 9c24aef6-cad9-4931-acce-74318aa5663b
version: 8
creation_date: '2021-06-04'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
data_source:
    - Windows Event Log System 7036
search: |-
    `wineventlog_system`
    `normalized_service_binary_field`
    | rename param1 as display_name
    | where param2="stopped" AND (match(display_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)") OR match(normalized_service_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)"))

    | stats count min(_time) as firstTime max(_time) as lastTime by EventCode display_name dest normalized_service_name
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_security_and_backup_services_stop_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
known_false_positives: Admin activities or installing related updates may do a sudden stop to list of services we monitor.
references:
    - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
    - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
    - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
finding:
    title: Known services $display_name$ terminated by a potential ransomware on $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: display_name
      type: service
analytic_story:
    - LockBit Ransomware
    - Ransomware
    - Compromised Windows Host
    - BlackMatter Ransomware
    - Termite Ransomware
    - Scattered Lapsus$ Hunters
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Unsigned DLL Side-Loading
id: 5a83ce44-8e0f-4786-a775-8249a525c879
version: 15
creation_date: '2023-07-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of potentially malicious unsigned DLLs in the c:\windows\system32 or c:\windows\syswow64 folders. It leverages Sysmon EventCode 7 logs to identify unsigned DLLs with unavailable signatures loaded in these critical directories. This activity is significant as it may indicate a DLL hijacking attempt, a technique used by attackers to gain unauthorized access and execute malicious code. If confirmed malicious, this could lead to privilege escalation, allowing the attacker to gain elevated privileges and further compromise the target system.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: It is possible some Administrative utilities will load dismcore.dll outside of normal system paths, filter as needed.
references:
    - https://asec.ahnlab.com/en/17692/
    - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An unsigned dll module was loaded on $dest$
analytic_story:
    - China-Nexus Threat Activity
    - Derusbi
    - Warzone RAT
    - Salt Typhoon
    - NjRAT
    - Earth Alux
    - SolarWinds WHD RCE Post Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: WMI Permanent Event Subscription - Sysmon
id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9
version: 12
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCodes 19, 20, and 21, to detect the creation of WMI EventFilters, EventConsumers, and FilterToConsumerBindings. This activity is significant as it may indicate an attacker setting up mechanisms to execute code with elevated SYSTEM privileges when specific events occur. If confirmed malicious, this could allow the attacker to maintain persistence, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.
data_source:
    - Sysmon EventID 21
search: |-
    `sysmon` EventCode=21
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest dvc object
           object_attrs object_category object_path
           signature signature_id src
           status user user_id
           vendor_product Consumer ConsumerNoQuotes
           Filter FilterNoQuotes
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `wmi_permanent_event_subscription___sysmon_filter`
how_to_implement: To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
    - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md
    - https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
finding:
    title: WMI Permanent Event Subscription detected on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: WMI Permanent Event Subscription detected on $dest$ by $user$
analytic_story:
    - Suspicious WMI Use
asset_type: Endpoint
mitre_attack_id:
    - T1546.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint