Splunk rules: 0v

id: '25095.46537'
title: Attempted Veeam Database Credential Dump
description: 'Operators from the Diavol ransomware gang were observed using sqlcmd
  to extract encrypted credentials from Veeam databases that were decrypted using
  a publicly documented technique on Veeam''s R+D forums. This use case detects commands
  targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented
  cases, the logic is not reliant on detecting sqlcmd.exe to account for instances
  where the binary has been renamed or another utility was used to interact with the
  database. -- Threat Actor Association: UTA0178 -- Software Association: Akira'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]"
  | table _time, host, user, user, process, process_*, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
data_category:
- PowerShell logs
references:
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html

name: AWS Credential Access GetPasswordData
id: 4d347c4a-306e-41db-8d10-b46baf71b3e2
version: 11
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies more than 10 GetPasswordData API calls within a 5-minute window in your AWS account. It leverages AWS CloudTrail logs to detect this activity by counting the distinct instance IDs accessed. This behavior is significant as it may indicate an attempt to retrieve encrypted administrator passwords for running Windows instances, which is a critical security concern. If confirmed malicious, attackers could gain unauthorized access to administrative credentials, potentially leading to full control over the affected instances and further compromise of the AWS environment.
data_source:
    - AWS CloudTrail GetPasswordData
search: |-
    `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com
      | bin _time span=5m
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime dc(requestParameters.instanceId) as distinct_instance_ids
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | where distinct_instance_ids > 10
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_credential_access_getpassworddata_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment.
known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.
references:
    - https://attack.mitre.org/techniques/T1552/
    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ is seen to make mulitple `GetPasswordData` API calls to multiple instances from IP $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Account
mitre_attack_id:
    - T1110.001
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco Secure Firewall - High EVE Threat Confidence
id: 8c15183e-2e70-4db4-86c3-88f8d9129b66
version: 7
creation_date: '2025-04-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. It leverages Cisco Secure Firewall Threat Defense logs and evaluates the EVE_ThreatConfidencePct field, which reflects the system's confidence in classifying encrypted sessions as threats based on machine learning models and behavioral analysis. A score equal to or greater than 80 suggests the connection is highly likely to be associated with malware command and control (C2), remote access tools, or suspicious tunneling behavior. If confirmed malicious, this may indicate covert communication over TLS from compromised hosts.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    `cisco_secure_firewall` EventType=ConnectionEvent EVE_ThreatConfidencePct >= 80
    | stats count min(_time) as firstTime max(_time) as lastTime
        Values(rule) as rule
        Values(url) as url
        by EVE_Process, EVE_ThreatConfidencePct, src, dest, dest_port, transport, action
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___high_eve_threat_confidence_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The access policy must also enable logging.
known_false_positives: |
    Some benign applications may exhibit behaviors that resemble encrypted threat patterns, especially if they use uncommon encryption libraries or custom protocols.
    Custom-developed or internal tools may trigger high EVE confidence scores depending on how they encrypt data.
    It is recommended to validate the associated process (`EVE_Process`) and destination context, and correlate with other logs (e.g., endpoint or threat intel) before taking response action.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: High threat confidence ($EVE_ThreatConfidencePct$%) from $EVE_Process$ on $src$"
threat_objects:
    - field: EVE_Process
      type: process_name
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1041
    - T1071.001
    - T1105
    - T1573.002
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Detect Password Spray Attack Behavior From Source
id: b6391b15-e913-4c2c-8949-9eecc06efacc
version: 12
creation_date: '2023-11-11'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies one source failing to authenticate with 10 or more unique users. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises and works well against any number of data sources ingested into the CIM datamodel. Environments can be very different depending on the organization. Test and customize this detections thresholds if needed.
data_source:
    - Windows Event Log Security 4624
    - Windows Event Log Security 4625
search: |-
    | tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count FROM datamodel=Authentication.Authentication
      BY Authentication.action Authentication.app Authentication.authentication_method
         Authentication.dest Authentication.signature Authentication.signature_id
         Authentication.src Authentication.user
    | `drop_dm_object_name("Authentication")`
    | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), src=upper(src), success=if(action="success",count,0),success_user=if(action="success",user,null),failure=if(action="failure",count,0), failed_user=if(action="failure",user,null)
    | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(app) as app values(src_category) as src_category values(success_user) as user values(failed_user) as failed_user dc(success_user) as success_dc dc(failed_user) as failed_dc dc(user) as user_dc ,sum(failure) as failure,sum(success) as success
      BY src
    | fields - _time
    | where user_dc >= 10 AND .25 > (success/failure) AND failed_dc > success_dc
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_password_spray_attack_behavior_from_source_filter`
how_to_implement: This detection requires ingesting authentication data to the appropriate accelerated datamodel. Recommend adjusting the search time window for this correlation to match the number of unique users (user_dc) in hours. i.e. 10 users over 10hrs
known_false_positives: Domain controllers, authentication chokepoints, and vulnerability scanners.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://www.microsoft.com/en-us/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
    - https://github.com/MarkoH17/Spray365
finding:
    title: The source [$src$] attempted to access $user_dc$ distinct users a total of $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 50
          message: The source [$src$] attempted to access $user_dc$ distinct users a total of $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
analytic_story:
    - Compromised User Account
asset_type: Account
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: access

name: Disable Schedule Task
id: db596056-3019-11ec-a9ff-acde48001122
version: 13
creation_date: '2021-10-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of a command to disable an existing scheduled task using 'schtasks.exe' with the '/change' and '/disable' parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Disabling scheduled tasks is significant as it is a common tactic used by adversaries, including malware like IcedID, to disable security applications and evade detection. If confirmed malicious, this activity could allow attackers to persist undetected, disable critical security defenses, and further compromise the targeted host.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=schtasks.exe Processes.process=*/change*  Processes.process=*/disable*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `disable_schedule_task_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: admin may disable problematic schedule task
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: schtask process with commandline $process$ to disable schedule task in $dest$
analytic_story:
    - IcedID
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disable Windows SmartScreen Protection
id: 664f0fd0-91ff-11eb-a56f-acde48001122
version: 17
creation_date: '2021-03-31'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that disable SmartScreen protection. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with SmartScreen settings. This activity is significant because SmartScreen provides an early warning system against phishing and malware. Disabling it can indicate malicious intent, often seen in Remote Access Trojans (RATs) to evade detection while downloading additional payloads. If confirmed malicious, this action could allow attackers to bypass security measures, increasing the risk of successful phishing attacks and malware infections.
data_source:
    - Sysmon EventID 13
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
       WHERE (
              Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled", "*\\Microsoft\\Windows\\System\\EnableSmartScreen")
              Registry.registry_value_data  IN ("Off", "0", 0x00000000))
              by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
         | `drop_dm_object_name(Registry)`
         | `security_content_ctime(firstTime)`
         | `security_content_ctime(lastTime)`
         | `disable_windows_smartscreen_protection_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable this windows features.
references:
    - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
finding:
    title: The Windows Smartscreen was disabled on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The Windows Smartscreen was disabled on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - CISA AA23-347A
    - Windows Registry Abuse
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: High Process Termination Frequency
id: 17cd75b2-8666-11eb-9ab4-acde48001122
version: 14
creation_date: '2021-03-19'
modification_date: '2026-05-13'
author: Teoderick Contreras
status: production
type: Anomaly
description: The following analytic identifies a high frequency of process termination events on a computer within a short period. It leverages Sysmon EventCode 5 logs to detect instances where 15 or more processes are terminated within a 3-second window. This behavior is significant as it is commonly associated with ransomware attempting to avoid exceptions during file encryption. If confirmed malicious, this activity could indicate an active ransomware attack, potentially leading to widespread file encryption and significant data loss.
data_source:
    - Sysmon EventID 5
search: |-
    `sysmon` EventCode=5
      | bin _time span=3s
      | stats values(process) as process values(process_exec) as process_exec values(process_guid) as process_guid values(process_id) as process_id values(process_name) as process_name values(process_path) as process_path values(user_id) as user_id min(_time) as firstTime max(_time) as lastTime count
        BY _time dest EventCode
           ProcessID signature signature_id
           vendor_product
      | where count >= 15
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `high_process_termination_frequency_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: admin or user tool that can terminate multiple process.
references:
    - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
    - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: High frequency process termination (more than 15 processes within 3s) detected on host $dest$
analytic_story:
    - BlackByte Ransomware
    - Rhysida Ransomware
    - LockBit Ransomware
    - Medusa Ransomware
    - Crypto Stealer
    - Snake Keylogger
    - Clop Ransomware
    - Termite Ransomware
    - Interlock Ransomware
    - NailaoLocker Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: JetBrains TeamCity RCE Attempt
id: 89a58e5f-1365-4793-b45c-770abbb32b6c
version: 11
creation_date: '2023-10-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |-
    The following analytic detects attempts to exploit the CVE-2023-42793 vulnerability in JetBrains TeamCity On-Premises.
    It identifies suspicious POST requests to /app/rest/users/id:1/tokens/RPC2, leveraging the Web datamodel to monitor specific URL patterns and HTTP methods.
    This activity is significant as it may indicate an unauthenticated attacker attempting to gain administrative access via Remote Code Execution (RCE).
    If confirmed malicious, this could allow the attacker to execute arbitrary code, potentially compromising the entire TeamCity environment and leading to further unauthorized access and data breaches.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url="*/app/rest/users/id:1/tokens/RPC2*"
    Web.status=200
    Web.http_method="POST"

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `jetbrains_teamcity_rce_attempt_filter`
how_to_implement: |-
    The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source.
known_false_positives: |-
    Requests to this specific endpoint via this method should not be common. Investigate further to determine if the request is legitimate, and apply appropriate filters to reduce false positives.
references:
    - https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/
    - https://www.sonarsource.com/blog/teamcity-vulnerability/
    - https://github.com/rapid7/metasploit-framework/pull/18408
    - https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis
finding:
    title: Potential JetBrains TeamCity RCE Attempt detected against URL $url$ on $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - JetBrains TeamCity Unauthenticated RCE
    - CISA AA23-347A
    - JetBrains TeamCity Vulnerabilities
asset_type: Web Server
cve:
    - CVE-2023-42793
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Kubernetes Process with Anomalous Resource Utilisation
id: 25ca9594-7a0d-4a95-a5e5-3228d7398ec8
version: 9
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies high resource utilization anomalies in Kubernetes processes. It leverages process metrics from an OTEL collector and hostmetrics receiver, fetched via the Splunk Infrastructure Monitoring Add-on. The detection uses a lookup table with average and standard deviation values to spot anomalies. This activity is significant as high resource utilization can indicate security threats like cryptojacking, unauthorized data exfiltration, or compromised containers. If confirmed malicious, such anomalies can disrupt services, exhaust resources, increase costs, and allow attackers to evade detection or maintain access.
data_source: []
search: "| mstats avg(process.*) as process.* where `kubernetes_metrics` by host.name k8s.cluster.name k8s.node.name process.executable.name span=10s | eval key = 'k8s.cluster.name' + \":\" + 'host.name' + \":\" + 'process.executable.name' | lookup k8s_process_resource_baseline key | fillnull | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | eval anomalies = replace(anomalies, \",\\s$\", \"\") | where anomalies!=\"\" | stats count values(anomalies) as anomalies by host.name k8s.cluster.name k8s.node.name process.executable.name | sort - count | where count > 5 | rename host.name as host | `kubernetes_process_with_anomalous_resource_utilisation_filter`"
how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes Process with Anomalous Resource Utilisation on host $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network
baselines:
    - Baseline Of Kubernetes Process Resource

name: Linux Curl Upload File
id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf
version: 13
creation_date: '2022-07-29'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of the curl command with specific switches (-F, --form, --upload-file, -T, -d, --data, --data-raw, -I, --head) to upload AWS credentials or configuration files to a remote destination. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as it may indicate an attempt to exfiltrate sensitive AWS credentials, a technique known to be used by the TeamTNT group. If confirmed malicious, this could lead to unauthorized access and potential compromise of AWS resources.
data_source:
    - Sysmon for Linux EventID 1
    - Cisco Isovalent Process Exec
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=curl Processes.process IN ("*-F *", "*--form *","*--upload-file *","*-T *","*-d *","*--data *","*--data-raw *", "*-I *", "*--head *")
        AND
        Processes.process IN ("*.aws/credentials*". "*.aws/config*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_curl_upload_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Filtering may be required. In addition to AWS credentials, add other important files and monitor. The inverse would be to look for _all_ -F behavior and tune from there.
references:
    - https://curl.se/docs/manpage.html
    - https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/
    - https://gtfobins.github.io/gtfobins/curl/
finding:
    title: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to upload important files to a remote destination.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to upload important files to a remote destination.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Linux Living Off The Land
    - Data Exfiltration
    - Ingress Tool Transfer
    - NPM Supply Chain Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Suspicious Namespace Creation
id: 039dbee4-39d8-4ad0-a43a-df4db3a41990
version: 1
creation_date: '2026-05-12'
modification_date: '2026-05-12'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects an unprivileged user invoking the unshare syscall with user namespace flags followed within 120 seconds by a root-owned shell or interpreter spawning under the same parent process, correlating auditd syscall telemetry with Sysmon process creation events to identify the two-step sequence characteristic of user-namespace-based Linux kernel privilege escalation exploits such as DirtyFrag.
data_source:
    - Linux Auditd Syscall
    - Sysmon for Linux EventID 1
search: |
    type=SYSCALL SYSCALL=unshare
    | where uid != "0" AND uid != "4294967295"
    | where a0 IN ("10000000","50000000","70000000","10020000","50020000","70020000")
    | eval unshare_time=_time,
          unshare_pid=pid,
          unshare_ppid=ppid,
          trigger_uid=uid,
          trigger_auid=auid,
          trigger_exe=exe,
          ns_flags=a0
    | table host, unshare_time, comm, syscall, unshare_pid, unshare_ppid,
            trigger_uid, trigger_auid, trigger_exe, ns_flags
    | join type=inner host unshare_ppid [
        search `sysmon` EventID=1 User=root
        | where match(Image, "/(su|sudo|pkexec|passwd|chsh|newgrp|doas|run0|sg|dash|sh|bash|zsh|fish|ksh|csh|tcsh|ash|mksh|busybox|tmux|screen|node|python[^/]*|perl[^/]*|ruby[^/]*|php[^/]*|lua[^/]*)$")
        | eval root_spawn_time=_time, root_pid=ProcessId,
              root_exe=Image, root_cmdline=CommandLine, root_parent=ParentProcessId
        | rename ParentProcessId AS unshare_ppid
        | table host, unshare_ppid, root_spawn_time, root_pid,
                root_exe, root_cmdline, root_parent, unshare_time,
                action, original_file_name, parent_process, parent_process_exec,
                parent_process_guid, parent_process_id, parent_process_name,
                parent_process_path, process, process_exec, process_guid,
                process_hash, process_id, process_integrity_level,
                process_name, process_path, user, user_id, vendor_product
    ]
    | where (root_spawn_time - unshare_time) >= 0
    | where (root_spawn_time - unshare_time) <= 120
    | eval elapsed_sec=round(root_spawn_time - unshare_time, 2)
    | eval ioc_match=case(
        ns_flags="50000000", "dirtyfrag (CLONE_NEWUSER|CLONE_NEWNET)",
        ns_flags="10000000", "CLONE_NEWUSER only",
        ns_flags="70000000", "CLONE_NEWUSER|CLONE_NEWNET|CLONE_NEWPID",
        1=1, "namespace flags="+ns_flags
      )
    | rename host as dest
    | stats
        count                              AS count,
        min(unshare_time)                  AS firstTime,
        max(unshare_time)                  AS lastTime,
        values(trigger_uid)                AS trigger_uid,
        values(trigger_auid)               AS trigger_auid,
        values(trigger_exe)                AS trigger_exe,
        values(ns_flags)                   AS ns_flags,
        values(ioc_match)                  AS ioc_match,
        values(unshare_pid)                AS unshare_pid,
        values(unshare_ppid)               AS unshare_ppid,
        values(root_exe)                   AS root_exe,
        values(root_cmdline)               AS root_cmdline,
        values(root_pid)                   AS root_pid,
        values(elapsed_sec)                AS elapsed_sec,
        values(process_hash)               AS process_hash,
        values(vendor_product)             AS vendor_product
        by dest, comm, syscall
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_suspicious_namespace_creation_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data.  The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.elastic.co/security-labs/copy-fail-dirtyfrag-linux-page-bugs-in-the-wild
finding:
    title: Suspicious namespace created on $dest$ indicating possible privilege escalation via DirtyFrag.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2026-43284
    - CVE-2026-43500
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Logon Script Event Trigger Execution
id: 4c38c264-1f74-11ec-b5fa-acde48001122
version: 12
creation_date: '2021-09-28'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the modification of the UserInitMprLogonScript registry entry, which is often used by attackers to establish persistence and gain privilege escalation upon system boot. It leverages data from the Endpoint.Registry data model, focusing on changes to the specified registry path. This activity is significant because it is a common technique used by APT groups and malware to ensure their payloads execute automatically when the system starts. If confirmed malicious, this could allow attackers to maintain persistent access and potentially escalate their privileges on the compromised host.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
known_false_positives: No false positives have been identified at this time.
references:
    - https://attack.mitre.org/techniques/T1037/001/
finding:
    title: Registry path $registry_path$ was modified, added, or deleted on $dest$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Registry path $registry_path$ was modified, added, or deleted on $dest$.
analytic_story:
    - Data Destruction
    - Windows Privilege Escalation
    - Hermetic Wiper
    - Windows Persistence Techniques
    - VIP Keylogger
asset_type: Endpoint
mitre_attack_id:
    - T1037.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS LOLbin
id: 58d270fb-5b39-418e-a855-4b8ac046805e
version: 13
creation_date: '2022-03-04'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: 'The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period.

    It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection.

    If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.'
data_source:
    - Osquery Results
search: "`osquery_macro`\nname=es_process_events\ncolumns.cmdline IN (\n    \"chmod*\",\n    \"crontab*\",\n    \"curl*\",\n    \"find*\",\n    \"funzip*\",\n    \"killall*\",\n    \"openssl*\",\n    \"screencapture*\",\n    \"wget*\",\n)\n| rename columns.* as *\n| stats count min(_time) as firstTime\n              max(_time) as lastTime\n              values(cmdline) as cmdline\n              values(pid) as pid\n              values(parent) as parent\n              values(path) as path\n              values(signing_id) as signing_id\n              dc(path) as dc_path\n    BY username host\n\n| rename username as user\n        cmdline as process\n        path as process_path\n        host as dest\n\n| where dc_path > 3\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `macos_lolbin_filter`"
how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
known_false_positives: No false positives have been identified at this time.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
finding:
    title: Multiplle LOLbin are executed on host $dest$ by user $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Multiplle LOLbin are executed on host $dest$ by user $user$
analytic_story:
    - Living Off The Land
    - Hellcat Ransomware
    - Axios Supply Chain Post Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '28729.52234'
title: Process Executed from Downloads Folder - Windows
description: This use case detects the execution of executable files (.exe) that originate
  from the Downloads folder of any user profile on a system. This technique is commonly
  used by threat actors who leverage social engineering or phishing campaigns to trick
  users into downloading and executing malicious software, which can then be used
  for a variety of malicious purposes such as gaining unauthorized access, data exfiltration,
  or delivering additional payloads.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<" OR Type=Process) "C:\\Users\\*\\Downloads\\*" | regex process_path="(?i)C:\x5cUsers\x5c.+\x5cDownloads\x5c.+\.exe"
  | table _time, host, user, process, process_*, parent_process* | bin span=1s | stats
  values(*) as * by _time, host, process_path '
techniques:
- execution:user execution
technique_id: 
- T1204
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/

name: Runas Execution in CommandLine
id: 4807e716-43a4-11ec-a0e7-acde48001122
version: 10
creation_date: '2021-11-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the runas.exe process with administrator user options. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as it may indicate an attempt to gain elevated privileges, a common tactic in privilege escalation and lateral movement. If confirmed malicious, this could allow an attacker to execute commands with higher privileges, potentially leading to unauthorized access, data exfiltration, or further compromise of the target host.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (Processes.process_name="runas.exe" OR Processes.original_file_name="runas.exe")
    Processes.process ="*/user:*"
    Processes.process = "*admin*"
    by Processes.action Processes.dest
       Processes.original_file_name Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
       Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `runas_execution_in_commandline_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: A network operator or systems administrator may utilize an automated or manual execute this command that may generate false positives. filter is needed.
references:
    - https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
analytic_story:
    - Quasar RAT
    - Data Destruction
    - Windows Privilege Escalation
    - Hermetic Wiper
asset_type: Endpoint
mitre_attack_id:
    - T1134.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27238.49666'
title: rundll32.exe Executing DLL from Non-standard Directory
description: rundll32.exe is a legitimate Windows utility used to run functions stored
  in Dynamic Link Libraries. Because rundll32 is a trusted system utility with the
  ability to execute code, it is a high value target for abuse by threat actors. Threat
  actors leveraging Qbot malware have been observed dropping DLLs into writeable paths
  and calling them with rundll32.exe. This use case detects when a DLL in a nonstandard
  directory is called by rundll32. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "rundll32" ".dll" | regex process_name="(?i)rundll32\.exe"|
  regex process!="(?i)(rundll32(\.exe)?\"?\s+(\/\w+\s+)?[\w.]+\.dll)|(C:\x5c(Windows\x5c(System32|WinSxS|SysWoW64)|Program\sFiles(\s\(x86\))?\x5c.+\.dll))"|
  table _time, host, user process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://redcanary.com/blog/lolbins-abuse/

id: '30808.55039'
title: Suspicious AteraAgent Installation - Windows
description: An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. These remote monitoring and management (RMM) tools, such as AteraAgent,
  are commonly used as legitimate technical support software and may be allowed by
  application control within a target environment. Remote access software may be installed
  and used post-compromise as an alternate communications channel for redundant access
  or as a way to establish an interactive remote desktop session with the target system.
  They may also be used as a component of malware to establish a reverse connection
  or back-connect to a service or adversary controlled system. This use case detects
  installation of AteraAgent RMM with an IntegratorLogin from non-business email providers.
  In lieu of filtering for specific publicly available mail providers, a negative
  match for expected user email domains can be used.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "AteraAgent.exe" "/i " "IntegratorLogin=" ("@gmail.com"
  OR "@hotmail.com" OR "@outlook.com" OR "@yandex.ru" OR "@mail.ru" OR "@protonmail.com"
  OR "@dropmail.me") | rex field=process "IntegratorLogin=\"(?<integrator_email>[^\"]+)\""|
  where match(process_name, "(?i)AteraAgent\.exe") and match(process, "(?i)\/i\s.*IntegratorLogin=\S+@(gmail|hotmail|outlook|protonmail)\.com|(yandex|mail)\.ru|dropmail\.me")|
  table _time, host, user, process_*, integrator_email | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign?utm_source=twitter&utm_medium=social_organic&utm_campaign=2024&utm_post_id=3c4043a3-313b-4b88-aca6-d74b47e16082
- https://www.atera.com/
- https://detection.fyi/the-dfir-report/sigma-rules/windows/process_creation/proc_creation_win_ateraagent_malicious_installations/?query=ateraage

id: '17798.29942'
title: Suspicious Child Process for hh.exe
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. This use case detects hh.exe spawning suspicious child
  processes, including shell utilities and other native Windows utilities. -- Threat
  Actor Association: APT-K-47/Mysterious Elephant -- LOLBAS Atomics T1218.001 Test
  #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(hh) OR "hh.exe") (TERM(cmd) OR TERM(powershell)
  OR TERM(pwsh) OR TERM(wscript) OR TERM(cscript) OR TERM(regsvr32) OR TERM(wmic)
  OR TERM(rundll32) OR TERM(MSHTA) OR TERM(CertUtil) OR TERM(CertReq) OR TERM(MSbuild)
  OR TERM(installutil) OR TERM(schtasks) OR TERM(msiexec)) | where match(parent_process_name,
  "(?i)hh\.exe") and match(process_name, "(?i)cmd|powershell|pwsh|wscript|cscript|regsvr32|wmic|rundll32|MSHTA|CertUtil|CertReq|MSbuild|installutil|schtasks|msiexec")
  | table _time, host, user process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-2---compiled-html-help-remote-payload
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/