Splunk rules: 0u

id: '1093.1147'
title: Add DLL_EXE Registry Value
description: 'Adding an entry to the "run keys" in the Registry or startup folder
  will cause the program referenced to be executed when a user logs in. -- Threat
  Actor Association: CL-STA-0043, FamousSparrow, FIN6, Flax Typhoon, WIRTE -- Software
  Association: Blackbyte'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ( signature_id=13 AND (TERM(HKU)
  OR TERM(HKCU) OR TERM(HKLM)) AND (registry_value_name="*\\Temp\\*.exe" OR registry_value_name="*\\Temp\\*.dll"
  OR registry_value_name="*\\Common Files\\*.dll" OR registry_value_name="*\\Common
  Files\\*.exe") ) | table _time, host, user, process process_name, parent_process_name,
  signature_id, dest_ip, registry_value_name | bin span=1s | stats values(*) as *
  by _time, host | table _time, host, user, process process_name, parent_process_name,
  signature_id dest_ip registry_value_name `hec_collect`'
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
technique_id:
- T1547.001
data_category:
- Windows Registry
- Windows Sysmon
references:
- https://www.hackingarticles.in/multiple-ways-to-persistence-on-windows-10-with-metasploit/
- https://blog.talosintelligence.com/2021/09/tinyturla.html

name: ASL AWS Disable Bucket Versioning
id: f32598bb-fa5f-4afd-8ab3-0263cc28efbc
version: 7
creation_date: '2022-10-04'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify `PutBucketVersioning` events with the `VersioningConfiguration.Status` set to `Suspended`. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=PutBucketVersioning
      | spath input=api.request.data path=VersioningConfiguration.Status output=Status
      | spath input=api.request.data path=bucketName output=bucketName
      | search Status=Suspended
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region api.request.data
           bucketName
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_disable_bucket_versioning_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs.
references:
    - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
    - https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Bucket Versioning is suspended for S3 buckets- $bucketName$ by user $user$ from IP address $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious AWS S3 Activities
    - Data Exfiltration
asset_type: AWS Account
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco SD-WAN - Peering Activity
id: 1d192a47-4bd3-4c06-902d-5dbe2375ec6d
version: 3
creation_date: '2026-03-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Hunting
description: |
    This analytic detects Cisco SD-WAN `control-connection-state-change` events where a control connection transitions.
    It extracts and highlights key triage fields including `peer-type`, `peer-system-ip`, `public-ip`, and `public-port`.
    Analysts should manually validate whether the `peer-system-ip` matches the expected SD-WAN addressing schema and
    device inventory, whether the event timing aligns with known operational activity (maintenance, failover, or
    planned changes), and whether the `public-ip` is an expected source for control peering in the environment.
    Treat `peer-type:vmanage` events with higher scrutiny, especially when peer or source IP values are previously
    unseen.
data_source:
    - Cisco SD-WAN NTCE 1000001
search: |-
    `cisco_sd_wan_syslog`
    TERM("*control-connection-state-change*")
    TERM("*peer-system-ip:*")
    TERM("*public-ip:*")
    TERM("*new-state:up*")
    | rex field=_raw "^(?<event_timestamp>(?:[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d{3})?|[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.\d{1,6})?(?:Z|[+-][0-9]{2}:[0-9]{2})))\s*:?"
    | rex field=_raw "^(?:[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d{3})?\s*:?\s+)(?<prefix_host>[^\s:]+)\s+\S+(?:\[\d+\])?:\s+%"
    | eval dest=coalesce(prefix_host, legacy_host, device_name, host)
    | rex field=_raw "new-state:(?<new_state>\S+)"
    | rex field=_raw "peer-type:(?<peer_type>\S+)"
    | rex field=_raw "peer-system-ip:(?<peer_system_ip>\S+)"
    | rex field=_raw "public-ip:(?<public_ip>\S+)"
    | rex field=_raw "public-port:(?<public_port>\d+)"

    | where isnotnull(peer_type) AND isnotnull(peer_system_ip)

    | stats count max(event_timestamp) as event_time
                  values(public_ip) as public_ips
                  values(public_port) as public_ports
      by peer_type peer_system_ip dest new_state

    | table event_time dest peer_type peer_system_ip
            public_ips public_ports count
    | `cisco_sd_wan___peering_activity_filter`
how_to_implement: |
    This analytic requires Cisco SD-WAN/vSmart logs in Splunk and assumes control peering status
    messages are searchable via the `cisco_sd_wan_syslog` macro. Update that macro with your environment-specific index and sourcetype settings.
    Follow the documentation https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging to start ingesting these logs.
known_false_positives: |
    New controller onboarding, topology expansion, controller failover, maintenance windows, and temporary transport.
    Path changes can create rare peer/public-IP combinations.
    Validate outliers against change records and known SD-WAN inventory before escalating.
references:
    - https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
    - https://blog.talosintelligence.com/uat-8616-sd-wan/
    - https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Monitor-And-Maintain/monitor-maintain-book/m-alarms-events-logs.html
    - https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging
    - https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
analytic_story:
    - Cisco Catalyst SD-WAN Analytics
asset_type: Network
cve:
    - CVE-2026-20127
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '5541.17145'
title: Conhost.exe Kernel call
description: 'conhost. exe ForceV1 asks for information directly from the kernel space,
  conhost connects to the console application. Usecase Identifies potentially suspicious
  Conhost execution paired with additional processes. - Software Association: Trojan.Killdisk/HermeticWiper,
  Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  NOT (TERM(usoclient.exe) OR TERM(devicecensus.exe) OR TERM(ProgramData) OR "Program
  Files" OR "wmiprvse.exe") | regex process="^\S+\s" | table _time, host, user, process,
  process_*, parent_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host | regex process="conhost.exe 0xffffffff -ForceV1"| where mvcount(process)>1 '
techniques:
- defense-evasion:indirect command execution
- execution:command and scripting interpreter
- defense-evasion:exploitation for defense evasion
technique_id: 
- T1202
- T1059
- T1211
data_category:
- Windows Sysmon
references:
- https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29

name: Disable ETW Through Registry
id: f0eacfa4-d33f-11eb-8f9d-acde48001122
version: 15
creation_date: '2021-06-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects modifications to the registry that disable the Event Tracing for Windows (ETW) feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" with a value set to "0x00000000". This activity is significant because disabling ETW can allow attackers to evade detection mechanisms, making it harder for security tools to monitor malicious activities. If confirmed malicious, this could enable attackers to execute payloads with minimal alerts, impairing defenses and potentially leading to further compromise of the system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: network operator may disable this feature of windows but not so common.
references:
    - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
finding:
    title: Disable ETW Through Registry on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ransomware
    - CISA AA23-347A
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disabling CMD Application
id: ff86077c-9212-11eb-a1e6-acde48001122
version: 17
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects modifications to the registry that disable the CMD prompt application. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "DisableCMD" registry value. This activity is significant because disabling CMD can hinder an analyst's ability to investigate and remediate threats, a tactic often used by malware such as RATs, Trojans, or Worms. If confirmed malicious, this could prevent security teams from using CMD for directory and file traversal, complicating incident response and allowing the attacker to maintain persistence.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
    - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
finding:
    title: The Windows command prompt was disabled on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The Windows command prompt was disabled on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - NjRAT
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: DNS Query Length With High Standard Deviation
id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
version: 16
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding two times the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network.
data_source:
    - Sysmon EventID 22
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Resolution
      WHERE NOT DNS.record_type IN ("Pointer","PTR","SOA", "SRV") DNS.query != *.
      BY DNS.answer DNS.answer_count DNS.query
         DNS.query_count DNS.reply_code_id DNS.src
         DNS.vendor_product DNS.dest DNS.record_type
    | `drop_dm_object_name("DNS")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | eval tlds=split(query,".")
    | eval tld=mvindex(tlds,-1)
    | eval tld_len=len(tld)
    | search tld_len<=20
    | eval query_length = len(query)
    | table firstTime lastTime src dest query query_length record_type count record_type
    | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50
    | where query_length>(avg+stdev*2)
    | eval z_score=(query_length-avg)/stdev
    | stats count values(query) as query values(dest) as dest avg(query_length) as avg_query_length values(record_type) as record_type min(firstTime) as firstTime latest(lastTime) as lastTime
      BY src
    | `dns_query_length_with_high_standard_deviation_filter`
how_to_implement: To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
known_false_positives: It's possible there can be long domain names that are legitimate.
references: []
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Potentially suspicious DNS query [$query$] with high standard deviation from src - [$src$]
threat_objects:
    - field: query
      type: url
analytic_story:
    - Hidden Cobra Malware
    - Suspicious DNS Traffic
    - Command And Control
asset_type: Endpoint
mitre_attack_id:
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '33360.59026'
title: Domain Controller Enumeration via nltest
description: Adversaries may attempt to get a listing of other systems by IP address,
  hostname, or other logical identifier on a network that may be used for Lateral
  Movement from the current system. Functionality could exist within remote access
  tools to enable this, but utilities available on the operating system could also
  be used such as Nltest. Adversaries may look for details about the network configuration
  and settings, such as IP and/or MAC addresses, of systems they access or through
  information discovery of remote systems. Several operating system administration
  utilities exist that can be used to gather this information. Examples include Arp,
  ipconfig/ifconfig, nbtstat, and route. This use case detects nltest executions with
  options dclist or dsgetdc.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(nltest) (TERM(dclist) OR TERM(dsgetdc)) | table _time, host, user, process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id: 
- T1016
- T1018
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1016/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md#atomic-test-3---remote-system-discovery---nltest

id: '29487.53152'
title: Excessive DRSGetNCChanges Requests
description: 'Adversaries may attempt to access credentials and other sensitive information
  by abusing a Windows Domain Controller''s application programming interface (API)
  to simulate the replication process from a remote domain controller using a technique
  called DCSync. During a FIN8 attack, a desktop device performed more than 100 DRSGetNCChanges
  requests to a domain controller. Such activity, when not performed by new domain
  controllers to sync Active Directory contents, can indicate malicious domain or
  user enumeration, credential compromise or Active Directory enumeration. This use
  case detects excessive DRSGetNChanges requests (represented by GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2).
  Note: Windows Event ID 4662 must be logged and configured correctly for detection.
  Blocklisting event 4662 event collection and forwarding from expected hosts (likely
  other Domain Controllers) is recommended for best performance, as activity from
  DCs is expected behavior. See references for details. -- Threat Actor Association:
  FIN8 (Syssphinx), Muddled Libra, Scattered Spider'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4662) OR
  "<EventID>4662<") "0x100" "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" | table _time,
  host, user process, process_*, signature_id, parent_*, parameters | bin span=600s
  | stats values(*) as * by _time, user | where event_count > 5 '
techniques:
- credential-access:os credential dumping:dcsync
technique_id:
- T1003.006
data_category:
- Windows event logs
references:
- https://blog.blacklanternsecurity.com/p/detecting-dcsync
- https://darktrace.com/blog/shining-a-light-on-syssphinx-darktraces-detection-of-a-novel-ransomware-attack
- https://community.netwitness.com/t5/netwitness-community-blog/dcsync-detection-with-netwitness/ba-p/695474
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47
- https://www.extrahop.com/company/blog/2021/dcsync-definition-and-protection/

name: GetLocalUser with PowerShell Script Block
id: 2e891cbe-0426-11ec-9c9c-acde48001122
version: 11
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `Get-LocalUser` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). This commandlet lists all local users on a system. The detection leverages script block text from PowerShell logs to identify this activity. Monitoring this behavior is significant as adversaries and Red Teams may use it to enumerate local users for situational awareness and Active Directory discovery. If confirmed malicious, this activity could lead to further reconnaissance, enabling attackers to identify potential targets for privilege escalation or lateral movement.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-LocalUser*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `getlocaluser_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1087/001/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
analytic_story:
    - Active Directory Discovery
    - Malicious PowerShell
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1087.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GetWmiObject User Account with PowerShell Script Block
id: 640b0eda-0429-11ec-accd-acde48001122
version: 11
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `Get-WmiObject` commandlet with the `Win32_UserAccount` parameter via PowerShell Script Block Logging (EventCode=4104). This method leverages script block text to identify when a list of all local users is being enumerated. This activity is significant as it may indicate an adversary or Red Team operation attempting to gather user information for situational awareness and Active Directory discovery. If confirmed malicious, this could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `getwmiobject_user_account_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1087/001/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
analytic_story:
    - Winter Vivern
    - Active Directory Discovery
    - Malicious PowerShell
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1087.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '17974.30258'
title: hh.exe Execution
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. -- Threat Actor Association: APT-K-47/Mysterious Elephant,
  Gamaredon (aka. Armageddon, UAC-0010), Kimsuky -- LOLBAS Atomics T1218.001 Test
  #1 Atomics T1218.001 Test #2 Atomics T1218.001 Test #3 Atomics T1218.001 Test #4
  Atomics T1218.001 Test #5 Atomics T1218.001 Test #6 Atomics T1218.001 Test #7 Atomics
  T1218.001 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(hh) OR TERM(hh.exe))
  | where match(process_name, "(?i)hh\.exe") OR match(process, "(?i)hh\.exe") | table
  _time, host, user process, process_*, parent_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-8---decompile-local-chm-file
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
- https://asec.ahnlab.com/en/51746/

name: Linux Binary Launched Process with Null Argv
id: 0085652a-e682-45a2-a40c-5bb68b8f260e
version: 2
creation_date: '2026-05-12'
modification_date: '2026-07-17'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects kernel-level events where a setuid binary launches a shell or interpreter with a NULL argument vector, which occurs when a privilege escalation exploit gains root and executes a process via execve() without constructing a legitimate argument array.
data_source:
    - Linux Messages Syslog
search: |
    `linux_syslog` "NULL argv" "empty string added"
    | rex field=_raw "process '(?<launching_process>[^']+)' launched '(?<launched_process>[^']+)' with NULL argv"
    | where isnotnull(launching_process) AND isnotnull(launched_process)
    | stats
        count                        AS occurrences,
        min(_time)                   AS firstTime,
        max(_time)                   AS lastTime,
        values(_raw)                 AS message,
        values(host)                 AS dest
        by host, launching_process, launched_process
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table dest, launching_process, launched_process,
            firstTime, lastTime, occurrences, message
    | `linux_binary_launched_process_with_null_argv_filter`
how_to_implement: To successfully implement this search, you need to have relevant kernel logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).
known_false_positives: Legitimate false positives are rare but can occur when custom or poorly written setuid binaries, PAM modules, or login frameworks invoke shells programmatically without constructing a proper argv array. However, mainstream setuid binaries like su, sudo, and pkexec on modern Linux distributions always pass arguments, so any hit involving those specific processes should be treated as high confidence.
references:
    - https://www.elastic.co/security-labs/copy-fail-dirtyfrag-linux-page-bugs-in-the-wild
finding:
    title: Binary spawned process with NULL argv on $dest$ indicating possible privilege escalation.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2026-43284
    - CVE-2026-43500
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Suspicious Docker Build Command Execution
id: dc4a58d2-fde3-4bdd-a36b-7368b2523589
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects docker build being executed on Dockerfiles within the /tmp directory.
    This is not a typical location for this activity and can indicate an actor adding a container for malicious future actions.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process="*docker*"
    Processes.process="*build*"
    (
        (
            Processes.process="*-f *"
            Processes.process="* /tmp*"
        )
        OR
        Processes.process_current_directory="/tmp*"
    )

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest
       Processes.process_current_directory Processes.process_path Processes.process_integrity_level
       Processes.original_file_name Processes.parent_process Processes.parent_process_path
       Processes.parent_process_guid Processes.parent_process_id Processes.process_guid
       Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_suspicious_docker_build_command_execution_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Developers or administrators may occasionally use the /tmp directory for testing Docker builds in non-production environments. Filter based on known users or systems where this activity has been approved.
references:
    - https://github.com/Aegrah/PANIX
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious Docker Build Command [$process$] observed on [$dest$] executed by [$user$].
threat_objects:
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1610
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '8335.10406'
title: Modify Registry Key
description: 'Adversaries may interact with the Windows Registry to hide configuration
  information within Registry keys, remove information as part of cleaning up, or
  as part of other techniques to aid in persistence and execution. Threat Actor Association:
  APT27/Emissary Panda, APT29/Nobelium, APT30, APT41, APT43, Flax Typhoon, InvisiMole,
  Kimsuky, Lazarus, MuddyWater, RedEyes, REvil, Velvet Cholllima -- Software Association:
  Avos, BabyShark, BadRabbit, BianLian, BlackByte, DarkWatchman, Dharma, Dridex, Karius,
  Koxic, LockBit, Play, QBot/Qakbot, Ransom Cartel, SunBurst, Trojan.Killdisk/HermeticWiper,
  Trigona, Ursnif, VawTrack'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4657) OR
  "<EventID>4657<") Operation_Type="Existing registry value modified" | table _time,
  host, user parent_*, process, process_*, signature_id, Object_*, Operation_*, New_*,
  Old_*| eval note=Object_Name | bin span=1s | stats values(*) as * by _time, host
  | fields - Operation_*, New_*, Old_* `hec_collect`'
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- File monitoring
- Windows event logs
references:
- https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/
- https://www.netwrix.com/how_to_detect_modification_to_startup_items.html
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5d497aefe58b7e00011f6947/1565096688890/Windows+Registry+Auditing+Cheat+Sheet+ver+Aug+2019.pdf

name: Network Connection Discovery With Arp
id: ae008c0f-83bd-4ed4-9350-98d4328e15d2
version: 11
creation_date: '2021-08-24'
modification_date: '2026-08-30'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: |-
    The following analytic detects the execution of `arp.exe` with the `-a` flag, which is used to list network connections on a compromised system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and related telemetry. Monitoring this activity is significant because both Red Teams and adversaries use `arp.exe` for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to map the network, identify active devices, and plan further lateral movement or attacks.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    (
        Processes.process_name="arp.exe"
        OR
        Processes.original_file_name="arp.exe"
    )
    Processes.process IN (
        "* -a*",
        "* -g *",
        "* /a *",
        "* /g *"
    )
    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `network_connection_discovery_with_arp_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1049/
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
analytic_story:
    - Active Directory Discovery
    - Qakbot
    - Windows Post-Exploitation
    - Prestige Ransomware
    - Volt Typhoon
    - IcedID
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1049
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 File Permissioned Application Consent Granted by User
id: 6c382336-22b8-4023-9b80-1689e799f21f
version: 9
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where a user in the Office 365 environment grants consent to an application requesting file permissions for OneDrive or SharePoint. It leverages O365 audit logs, focusing on OAuth application consent events. This activity is significant because granting such permissions can allow applications to access, modify, or delete files, posing a risk if the application is malicious or overly permissive. If confirmed malicious, this could lead to data breaches, data loss, or unauthorized data manipulation, necessitating immediate investigation to validate the application's legitimacy and assess potential risks.
data_source:
    - O365 Consent to application.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Success | eval admin_consent =mvindex('ModifiedProperties{}.NewValue',0) | search admin_consent=False | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) | rex field=permissions \"Scope:(?<Scope>[^,]+)\" | makemv delim=\" \" Scope | search Scope IN (\"Files.Read\", \"Files.Read.All\", \"Files.ReadWrite\", \"Files.ReadWrite.All\", \"Files.ReadWrite.AppFolder\") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(lastTime)` | `o365_file_permissioned_application_consent_granted_by_user_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: OAuth applications that require file permissions may be legitimate, investigate and filter as needed.
references:
    - https://attack.mitre.org/techniques/T1528/
    - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
    - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
    - https://www.alteredsecurity.com/post/introduction-to-365-stealer
    - https://github.com/AlteredSecurity/365-Stealer
finding:
    title: User $user$ consented an OAuth application that requests file-related permissions.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1528
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '5987.6350'
title: Package installation
description: 'Some programming languages, like Python, come with an easy, more or
  less official method of installing dependencies for your projects. These installers
  are usually tied to public code repositories where anyone can freely upload code
  packages for others to use. The intent of this use case is to identify installation
  of packages, with common repositories using pip, gem and npm. Use case will be used
  to with additional threat identifiers to potentially identify Dependency confusion
  style attacks. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(npm)
  OR TERM(pip) OR TERM(gem)) TERM(install) | regex process="(?i)install\s" | rex field=process
  "(?<reqs>(?i)requirements\.txt") | rex field=process "(?<extra>(?i)(\-{2}extra)?\-index\-url(\s+\S+)")
  | rex field=process "(?<source1>(?i)\-{2}source(\s+\S+)") | eval keywords=mvappend(reqs,
  extra, source1) | table _time, host, user, signature_id, process, process_*, keywords
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- PowerShell logs
references:
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

name: PingID Mismatch Auth Source and Verification Response
id: 15b0694e-caa2-4009-8d83-a1f98b86d086
version: 9
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies discrepancies between the IP address of an authentication event and the IP address of the verification response event, focusing on differences in the originating countries. It leverages JSON logs from PingID, comparing the 'auth_Country' and 'verify_Country' fields. This activity is significant as it may indicate suspicious sign-in behavior, such as account compromise or unauthorized access attempts. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive systems and data.
data_source:
    - PingID
search: "`pingid` (\"result.status\" IN (\"SUCCESS*\",\"FAIL*\",\"UNSUCCESSFUL*\" ) NOT \"result.message\" IN (\"*pair*\",\"*create*\",\"*delete*\")) | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', dest = 'resources{}.ipaddress', reason = 'result.message', object = 'resources{}.devicemodel', status = 'result.status' | join user session_id [ search `pingid` (\"result.status\" IN (\"POLICY\") AND \"resources{}.ipaddress\"=*) AND \"result.message\" IN(\"*Action: Authenticate*\",\"*Action: Approve*\",\"*Action: Allowed*\") | rex field=result.message \"IP Address: (?:N\\/A)?(?<policy_ipaddress>.+)?\\n\" | rex field=result.message \"Action: (?:N\\/A)?(?<signature>.+)?\\n\" | rex field=result.message \"Requested Application Name: (?:N\\/A)?(?<Requested_Application_Name>.+)?\\n\" | rex field=result.message \" Requested Application ID: (?:N\\/A)?(?<Requested_Application_ID>.+)?\\n\" | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', src = coalesce('resources{}.ipaddress',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name) | fields app, user, session_id, src, signature ] | iplocation prefix=auth_ dest | iplocation prefix=verify_ src | stats count min(_time) as firstTime max(_time) as lastTime values(app) as app values(session_id) as session_id by user, dest, auth_Country, src, verify_Country, object, signature, status, reason | where auth_Country != verify_Country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_mismatch_auth_source_and_verification_response_filter`"
how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
known_false_positives: False positives may be generated by users working out the geographic region where the organizations services or technology is hosted.
references:
    - https://twitter.com/jhencinski/status/1618660062352007174
    - https://attack.mitre.org/techniques/T1098/005/
    - https://attack.mitre.org/techniques/T1556/006/
    - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
finding:
    title: An authentication by [$user$] was detected from [$dest$ - $auth_Country$] and the verification was received from [$src$ - $verify_Country$].
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 50
          message: An authentication by [$user$] was detected from [$dest$ - $auth_Country$] and the verification was received from [$src$ - $verify_Country$].
analytic_story:
    - Compromised User Account
asset_type: Identity
mitre_attack_id:
    - T1621
    - T1556.006
    - T1098.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

name: Powershell Fileless Process Injection via GetProcAddress
id: a26d9db4-c883-11eb-9d75-acde48001122
version: 14
creation_date: '2021-06-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of `GetProcAddress` in PowerShell script blocks, leveraging PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, which is then logged in Windows event logs. The presence of `GetProcAddress` is unusual for typical PowerShell scripts and often indicates malicious activity, as many attack toolkits use it to achieve code execution. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, potentially leading to system compromise. Analysts should review parallel processes and the entire logged script block for further investigation.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText=*getprocaddress*
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_fileless_process_injection_via_getprocaddress_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Limited false positives. Filter as needed.
references:
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
finding:
    title: A suspicious powershell script contains GetProcAddress API on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Hellcat Ransomware
    - Malicious PowerShell
    - Hermetic Wiper
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1055
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '25326.47104'
title: Scheduled Task with Potential SSH Tunnel - Windows
description: Threat actors have been observed using scheduled tasks to create reverse
  SSH tunnels to facilitate persistence on a compromised machine as reported by DFIR.
  This use case detects scheduled tasks created with commands indicating potential
  SSH tunnels. The regex filtering matches on the patterns <user>@<IP address> and
  <port number>:<IP Address> :<port number>. Living Off the Land Binary and Scripts
  (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "@" "/create" ("-L" OR "-R" OR "-N" OR "-D" OR "-C" OR "IdentitiesOnly=yes" OR "StrictHostKeyChecking=no"
  OR "ssh") | where match(process, "\w+@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") and match(process,
  "\d{1,5}:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,5}") and match(process, "(?i)\-(L|R|N|D|C)|IdentitiesOnly=yes|StrictHostKeyChecking=no|ssh")
  | table _time, host, user, process, process_*, parent_process_name, parent_process_*,
  signature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:scheduled task/job
- command-and-control:protocol tunneling
technique_id: 
- T1053
- T1572
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/