Splunk rules: 0w

id: '6146.6664'
title: Adfind Commands
description: 'AdFind is a free command-line query tool that can be used for gathering
  information from Active Directory. In some instances Adversaries have renamed adfind
  in order to avoid detection. This use case looks for common commands of Adfind.
  -- Threat Actor Association: APT29/Nobelium/Cozy Bear, BlackMatter, Conti, DarkSide,
  FIN6, FIN7, FIN12, Karakurt, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Traveling Spider, Wizard Spider, Yanluowang -- Software
  Association: BazarLoader, Blackcat/ALPHV, Conti, DatopLoader, Dridex, Entropy, Lockbit,
  Nefilim, Quantum, Sodinokibi/REvil, Trickbot, XingLocker'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") ("objectcategory"
  OR "trustdmp" OR ("member" "list")) | regex process="(?i)(objectcategory|trustdmp|member.*?\s+\-list)"
  | table _time, host, user user, process, process_name | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:account discovery:domain account
- discovery:permission groups discovery:domain groups
- discovery:domain trust discovery
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id:
- T1087.002
- T1069.002
- T1482
- T1016
- T1018
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/

id: '23090.41815'
title: AutoIt Execution
description: 'AutoIt is a freeware scripting utility that can automate Windows GUI
  tasks such as mouse clicks, keystrokes, and window manipulations. While it is a
  legitimate tool, threat actors have abused it to automate malicious activity. This
  use case detects AutoIt, AutoIt2, or AutoIt3 executions, or commands loading .au3
  files. -- Software Association: DarkGate'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ("AutoIT3.exe" OR "AutoIT2.exe" OR "AutoIT.exe" OR ".au3") | regex
  process="(?i)\S+\.exe.+\.au3" | table _time, host, user, process, process_* | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- PowerShell logs
references:
- https://isc.sans.edu/forums/diary/KPOT+Deployed+via+AutoIt+Script/25934/
- https://blog.talosintelligence.com/magnat-campaigns-use-malvertising-to/
- https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/

name: AWS SetDefaultPolicyVersion
id: 2a9b80d3-6340-4345-11ad-212bf3d0dac4
version: 11
creation_date: '2021-03-02'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects when a user sets a default policy version in AWS. It leverages AWS CloudTrail logs to identify the `SetDefaultPolicyVersion` event from the IAM service. This activity is significant because attackers may exploit this technique for privilege escalation, especially if previous policy versions grant more extensive permissions than the current one. If confirmed malicious, this could allow an attacker to gain elevated access to AWS resources, potentially leading to unauthorized actions and data breaches.
data_source:
    - AWS CloudTrail SetDefaultPolicyVersion
search: |-
    `cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_setdefaultpolicyversion_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
references:
    - https://bishopfox.com/blog/privilege-escalation-in-aws
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
finding:
    title: From IP address $src$, user $user$ has trigged an action $signature$ for updating the the default policy version
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1078.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal
id: e20a6709-5f2c-4508-83fb-b3af6f705717
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-20'
author: Nasreddine Bencherchali
status: production
type: Anomaly
description: |
    This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period.
    It also detects the pattern where a loopback interface is removed before clearing logs and exiting.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility IN ("AAA", "HA_EM", "PARSER")
    mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG", "CFGLOG_LOGGEDCMD")
    message_text IN ("*show logging*", "*clear logging*", "*exit*", "*no interface Loopback*")

    | eval cmd=lower(coalesce(command, message_text))
    | eval event_type=case(
                like(cmd, "%show logging%"), "show_logging",
                like(cmd, "%clear logging%"), "clear_logging",
                like(cmd, "%exit%"), "exit",
                like(cmd, "%no interface loopback%"), "remove_loopback"
            )
    | where isnotnull(event_type)
    | eval dest=coalesce(host, dvc, dest, "unknown")
    | bin _time span=2m
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(event_type) as event_types
                  values(message_text) as message_text
                  values(cmd) as cmd
      by _time dest
    | where mvfind(event_types, "clear_logging") >= 0
            AND
            mvfind(event_types, "exit") >= 0
            AND
            (
                mvfind(event_types, "show_logging") >= 0
                OR
                mvfind(event_types, "remove_loopback") >= 0
            )
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
    Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Cisco IOS-XE log clearing sequence was observed on $dest$.
threat_objects: []
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1070.001
    - T1562
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '27059.49380'
title: DLL Called with Uncommon Function
description: DLLs can invoke a variety of functions when executed. While these functions
  are part of legitimate Windows operations, their execution from a DLL file, especially
  in an unusual context, can be indicative of malicious behavior. Threat actors including
  Qbot have been observed abusing this technique when calling DLLs with rundll32.exe.
  This use case detects calls of uncommon functions from DLL files, accounting for
  instances where rundll32.exe has been renamed. While these function calls may be
  legitimate, unexpected executions should be investigated. Living Off the Land Binary
  and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ".dll" ("RS32" OR "VirtualAllocEx" OR "NtUnmapViewOfSection" OR "CreateRemoteThread"
  OR "RtlCreateUserThread" OR "DeviceIoControl" OR "WriteProcessMemory" OR "CryptEncrypt"
  OR "CryptDecrypt" OR "RegSetValueEx" OR "SetWindowsHookEx" OR "DLLRegisterServer")
  | rex field=process "\.dll,(?<called_function>[^\s]+)"| where match(process, "(?i)\.dll\,(RS32|VirtualAllocEx|NtUnmapViewOfSection|CreateRemoteThread|RtlCreateUserThread|DeviceIoControl|WriteProcessMemory|CryptEncrypt|CryptDecrypt|RegSetValueEx|SetWindowsHookEx|DLLRegisterServer)")
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  called_function | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Windows Sysmon
references:
- https://redcanary.com/blog/lolbins-abuse/

name: Get ADUserResultantPasswordPolicy with Powershell Script Block
id: 737e1eb0-065a-11ec-921a-acde48001122
version: 12
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-ADUserResultantPasswordPolicy` PowerShell cmdlet, which is used to obtain the password policy in a Windows domain. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity. Monitoring this behavior is significant as it may indicate an attempt to enumerate domain policies, a common tactic used by adversaries for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to understand password policies, aiding in further attacks such as password guessing or policy exploitation.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
    - https://attack.mitre.org/techniques/T1201/
    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps
finding:
    title: powershell process having commandline to query domain user password policy detected on host - $dest$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: powershell process having commandline to query domain user password policy detected on host - $dest$.
analytic_story:
    - Active Directory Discovery
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1201
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: HTTP PUA User Agent
id: 21af5447-734f-4549-956b-7a255cb2b032
version: 5
creation_date: '2026-01-06'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of unwanted applications. This activity can signify possible compromised hosts on the network.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.http_user_agent != null
      BY Web.http_user_agent Web.http_method, Web.url,
         Web.url_length Web.src, Web.dest
    | `drop_dm_object_name("Web")`
    | lookup pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool
    | where isnotnull(tool)
    | stats count min(firstTime) as first_seen max(lastTime) as last_seen
      BY tool url http_user_agent
         src dest
    | `security_content_ctime(first_seen)`
    | `security_content_ctime(last_seen)`
    | `http_pua_user_agent_filter`
how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
known_false_positives: Noise and false positive can be seen if these programs are allowed to be used within corporate network. In this case, a filter is needed.
references:
    - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_http_user_agents_list.csv
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A known user agent ($http_user_agent$) associated with unusual programs was performing a request from $src$.
threat_objects:
    - field: http_user_agent
      type: http_user_agent
analytic_story:
    - Local Privilege Escalation With KrbRelayUp
    - BlackSuit Ransomware
    - Cactus Ransomware
    - Suspicious User Agents
asset_type: Network
mitre_attack_id:
    - T1071.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Linux Auditd Add User Account Type
id: f8c325ea-506e-4105-8ccf-da1492e90115
version: 12
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the suspicious add user account type. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
data_source:
    - Linux Auditd Add User
search: |-
    `linux_auditd` type=ADD_USER
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY exe pid dest
           res type
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_add_user_account_type_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: New [$type$] event on host - [$dest$] to add a user account type.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1136.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Make Privilege Escalation
id: 80b22836-5091-4944-80ee-f733ac443f4f
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the 'make' command with elevated privileges to execute system commands as root, potentially leading to a root shell. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include 'make', '--eval', and 'sudo'. This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access. If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*make*-s*"
        AND
        Processes.process="*--eval*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_make_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/make/
    - https://www.javatpoint.com/linux-make-command
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Possible Privilege Escalation via PYTHONPATH
id: 5edda575-409a-4820-a048-5780796a181e
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects the creation of a malicious shared object at a Python importlib path outside the standard system library directories, a technique used to abuse PYTHONPATH for local privilege escalation.
    Attackers exploiting vulnerabilities such as the 2024 NeedRestart flaw (CVE-2024-48990) plant a crafted importlib/__init__.so in an attacker-controlled directory, then manipulate the PYTHONPATH environment variable so that a privileged process, such as NeedRestart running as root, loads the rogue module instead of the legitimate one, achieving code execution with elevated privileges.
    The detection monitors for file writes matching the importlib/__init__.so pattern that do not originate from expected system library paths.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.file_path="*/importlib/__init__.so*"
    NOT Filesystem.file_path IN (
        "/lib/*",
        "/lib64/*",
        "/usr/lib/*",
        "/usr/lib64/*",
        "/usr/local/lib/*",
        "/usr/local/lib64/*"
    )

    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
       Filesystem.process_guid Filesystem.process_id

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_privilege_escalation_via_pythonpath_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate Python developers or system administrators may modify PYTHONPATH for testing or application configuration purposes. Filter based on known development environments and trusted user activity.
references:
    - https://www.bleepingcomputer.com/news/security/ubuntu-linux-impacted-by-decade-old-needrestart-flaw-that-gives-root/
    - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
finding:
    title: Possible Privilege Escalation via PYTHONPATH via [$file_name$] on [$dest$]
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Post-Exploitation
    - Linux Persistence Techniques
asset_type: Endpoint
cve:
    - CVE-2024-48990
mitre_attack_id:
    - T1068
    - T1574.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Shred Overwrite Command
id: c1952cf1-643c-4965-82de-11c067cbae76
version: 10
creation_date: '2022-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name =shred
        AND
        Processes.process IN ("*-n*", "*-u*", "*-z*", "*-s*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_shred_overwrite_command_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://cert.gov.ua/article/39518
finding:
    title: A possible shred overwrite command $process$ executed on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Industroyer2
    - AwfulShred
    - Linux Privilege Escalation
    - Data Destruction
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5982.6332'
title: MSHTA.exe execution
description: 'Detect use of MSHTA. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT37, APT43, FIN7, Kimsuky, MuddyWater, TA551, TA576, UAC-0057 (GhostWriter),
  Wizard Spider -- Software Association: Bazar, Conti, PYSA/Mespinoza, Trickbot, XingLocker,
  Zloader Atomics T1218.005 Test#1 Atomics T1218.005 Test#2 Atomics T1218.005 Test#3
  Atomics T1218.005 Test#4 Atomics T1218.005 Test#5 Atomics T1218.005 Test#6 Atomics
  T1218.005 Test#7 Atomics T1218.005 Test#8 Atomics T1218.005 Test#9 Atomics T1218.005
  Test#10 Atomics T1059.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(mshta.exe) OR TERM(mshta)) | table _time,
  host, user process, process_*, parent_*, signature_id, src_*, dest_* | bin span=1s
  | stats values(*) as * by _time, host | where match(process_name, "(?i)mshta") OR
  match(process, "(?i)mshta") OR (match(parent_process_name, "(?i)mshta") and match(process_name,
  "(?i)cmd|powershell")) '
techniques:
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1218.005
data_category:
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- ired.team/offensive-security/code-execution/t1170-mshta-code-execution
- https://attackiq.com/2020/04/20/fingerprinting-fin7/

id: '21579.38119'
title: Potential Executable Masquerading as Document - Windows
description: 'Adversaries may abuse double extensions to attempt to conceal dangerous
  file types of payloads. This use case detects executions of files that appear to
  be document or image files but execute as script or executable files, or executable/script
  files with 3 or more spaces or underscores preceding the extension in an effort
  to obscure the file''s actual extension. CVE-2023-38831 -- Threat Actor Association:
  APT28, APT40, Sandworm Team, UAC-0057 (GhostWriter)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (".pdf" OR ".jpg" OR ".jpeg" OR "gif" OR ".ico"
  OR ".doc" OR ".xls" OR ".docx" OR ".xlsx" OR ".png" OR ".xml" OR ".csv" OR ".ppt"
  OR ".pptx" OR ".rtf" OR ".txt") (".cmd" OR ".bat" OR ".ps1" OR ".vbs" OR ".js" OR
  ".py" OR ".exe" OR ".msi" OR ".vbe" OR ".lnk" OR ".scr") | regex process="(?i)((\s{3,}|_{3,})|(\.(pdf|jpg|jpeg|gif|ico|doc|xls|docx|xlsx|png|xml|csv|ppt|pptx|rtf|txt)(\s+)?))\.(cmd|bat|ps1|vbs|js|py|exe|msi|vbe|lnk|scr)"
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading:double file extension
technique_id:
- T1036.007
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/

name: PowerShell Invoke WmiExec Usage
id: 0734bd21-2769-4972-a5f1-78bb1e011224
version: 12
creation_date: '2023-03-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the Invoke-WMIExec utility within PowerShell Script Block Logging (EventCode 4104). This detection leverages PowerShell script block logs to identify instances where the Invoke-WMIExec command is used. Monitoring this activity is crucial as it indicates potential lateral movement using WMI commands with NTLMv2 pass-the-hash authentication. If confirmed malicious, this activity could allow an attacker to execute commands remotely on target systems, potentially leading to further compromise and lateral spread within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText IN ("*invoke-wmiexec*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_invoke_wmiexec_usage_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives should be limited as this analytic is designed to detect a specific utility. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
references:
    - https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-WMIExec.ps1
finding:
    title: PowerShell was identified running a Invoke-WmiExec on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Scattered Lapsus$ Hunters
    - Suspicious WMI Use
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5977.18235'
title: regsvr32 Execution
description: 'Using regsvr32.exe, an adversary may load malicious .dll files. -- Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Threat Actor Association: Kimsuky,
  TA551, Traveling Spider, Wizard Spider -- Software Association: Astaroth, Bazar,
  Black Basta, Conti, HermeticWizard, IcedID, Nefilim, Qakbot/Qbot, Rhysida, XingLocker,
  Zloader Atomics T1218.010 Test#1 Atomics T1218.010 Test#2 Atomics T1218.010 Test#3
  Atomics T1218.010 Test#4 Atomics T1218.010 Test#5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ("EventCode=4104" OR "<EventID>4104<"
  OR "EventCode=4103" OR "<EventID>4103<") TERM(regsvr32) | regex process="(?i)(regsvr32)"|
  table _time, host, user parent_*, process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | eventstats dc(process) as dc_process by
  host | where dc_process < 30 '
techniques:
- defense-evasion:system binary proxy execution:regsvr32
technique_id:
- T1218.010
data_category:
- PowerShell logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
- https://www.carbonblack.com/blog/threat-advisory-squiblydoo-continues-trend-of-attackers-using-native-os-tools-to-live-off-the-land/

id: '1045.1073'
title: Unusual HTTP Download
description: Detects possible malicious download which was made using a browser or
  wget over the http or https protocol.
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=3 (protocol="https"
  OR protocol="http"))) OR (EventCode=15 AND ("chrome.exe"OR "firefox.exe" OR "iexplorer.exe"
  OR "opera.exe" OR "MicrosoftEdge.exe"))| table _time, host, user, host, dest_ip,
  src_ip, dvc, tag, process_*, event_id, dest_port, src_port, dvc_nt_host, signature,
  user, direction, protocol| bin span=60s | stats values(*) as * by _time, host |
  table _time, host, user, dest_ip, dest_port, src_ip, src_port, event_id, process_id,
  process_name, process_path, signature, direction, protocol `hec_collect`'
techniques:
- command-and-control:ingress tool transfer
- command-and-control:application layer protocol:web protocols
technique_id:
- T1105
- T1071.001
data_category:
- Windows Sysmon
references: null

id: '31066.55631'
title: User Discovery via Environment Variables - PowerShell
description: Threat actors may perform user discovery to gather information about
  logged-in users, aiding in further lateral movement or privilege escalation within
  the network. This use case detects instances where PowerShell is executed with commands
  involving discovery of the current user's name, potentially indicating an attempt
  by a threat actor to discover user accounts and environment variables on a compromised
  system. PowerShell script block logging is recommended for best detection results.
  Detection using other log sources requires the PowerShell command to be run in a
  manner that creates a new process, such as powershell -command.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "$env:UserName" OR
  "[System.Environment]::UserName" | table _time, host, user, process, process_* |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:system owner/user discovery
technique_id: 
- T1033
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1033/
- https://research.splunk.com/endpoint/0cdf318b-a0dd-47d7-b257-c621c0247de8/

id: '40420.73845'
title: Visual Studio Code Tunnel Execution
description: Adversaries may communicate using application layer protocols associated
  with web traffic to avoid detection/network filtering by blending in with existing
  traffic. Commands to the remote system, and often the results of those commands,
  will be embedded within the protocol traffic between the client and server. This
  use case detects the execution of Visual Studio Code tunnel in attempt to establish
  a C2 channel, accounting for instances where the binary has been renamed.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ((TERM(EventCode=4103)
  OR "<EventID>4103<") OR (TERM(EventCode=4104) OR "<EventID>4104<")) "tunnel" OR
  ("tunnel" ("--name " "--accept-server-license-terms") OR "--cli-data-dir") | where
  match(process, "(?i)\.exe(\x22)?\s+tunnel\s?") or ((match(process, "\.exe(\x22)?\s+tunnel\s?$")
  and like(process, "%--name %") and like(process, "%--accept-server-license-terms%"))
  or like(process, "%--cli-data-dir%") | table _time, host, user, process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:application layer protocol:web protocols
technique_id:
- T1071.001
data_category:
- PowerShell logs
references:
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_vscode_tunnel_execution/
- https://attack.mitre.org/techniques/T1071/001/
- https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/

name: Windows Command and Scripting Interpreter Path Traversal Exec
id: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2
version: 12
creation_date: '2022-05-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects path traversal command-line execution, often used in malicious documents to execute code via msdt.exe for defense evasion. It leverages Endpoint Detection and Response (EDR) data, focusing on specific patterns in process paths. This activity is significant as it can indicate an attempt to bypass security controls and execute unauthorized code. If confirmed malicious, this behavior could lead to code execution, privilege escalation, or persistence within the environment, potentially allowing attackers to deploy malware or leverage other living-off-the-land binaries (LOLBins).
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.os="Linux" Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Not known at this moment.
references:
    - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
finding:
    title: A process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5685.5945'
title: Windows Copy Files
description: 'Adversaries may search local system sources, such as file systems or
  local databases, or network shares to find files of interest and sensitive data
  prior to Exfiltration. Interactive command shells may be in use, and common functionality
  within cmd may be used to gather information. These events are only detected when
  a new process is created, or if powershell logging is enabled and used. Threat Actor
  Association: APT29, Evilnum, REvil, TA428, Vice Society Software Association: Black
  Basta, SamSam Atomics T1505.003 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  TERM(EventCode=4104)) (TERM(Copy-Item) OR TERM(copy) OR TERM(xcopy) OR TERM(cp)
  OR TERM(cpi) OR TERM(robocopy)) | regex process="(?i)(Copy\-Item|(^|\s)copy|xcopy(\.exe\"?)?|[^\-]cp|[^\-]cpi|robocopy(\.exe\"?)?)\s+.{1,}?"
  | rex field=process (?<copy>"(Copy-Item|copy|xcopy|cp|cpi|robocopy)\s+.{25}")| rex
  field=Message "(?i)script\s+?name\s+?\=\s+?(?<script>.{1,}?\.ps1)" | eval script=mvappend(Path,
  script) | table _time, host, user signature_id, process, process_*, script, copy
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- collection:data from local system
- execution:command and scripting interpreter
- collection:data from network shared drive
technique_id: 
- T1005
- T1059
- T1039
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://book.hacktricks.xyz/exfiltration
- https://www.computerhope.com/xcopyhlp.htm

name: Windows EFI Volume Mount Attempt Via Mountvol
id: 6ee1d152-56c7-40e8-8db0-edb0074a6bb2
version: 2
creation_date: '2021-12-08'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects attempts to mount the EFI volume.
    The EFI system partition (ESP) is a special partition on a data storage device (usually a hard disk drive or solid-state drive) that computers adhering to the UEFI (Unified Extensible Firmware Interface) specification use to store data necessary for the system to boot, such as bootloaders, device drivers, and system utilities.
    This is used with attacks such as PKFail to modify the system on boot.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        Processes.process_name="mountvol.exe"
        OR
        Processes.original_file_name="MOUNTVOL.EXE"
    )
    Processes.process IN ("*-S*", "* /S*")

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_efi_volume_mount_attempt_via_mountvol_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Mounting the EFI volume can be part of normal system updates or legitimate maintenance tasks. Monitor for unusual timing or context to reduce false alerts.
references:
    - https://www.binarly.io/blog/pkfail-untrusted-platform-keys-undermine-secure-boot-on-uefi-ecosystem
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential EFI Volume Mount Attempt by $user$ via $process$ observed on $dest$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1204.002
    - T1542
    - T1688
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '13077.18831'
title: Windows Process Outside of System Folder
description: 'Adversaries may match or approximate the name or location of legitimate
  files or resources when naming/placing them. This is done for the sake of evading
  defenses and observation. This may be done by giving it the name of a legitimate,
  trusted program (ex: svchost.exe). This use case detects Windows processes commonly
  targeted for abuse operating outside of expected file paths \Windows\system32 and
  \Windows\SysWOW64. -- Threat Actor Association: Flax Typhoon, Vice Society, UNC4990
  - Software Association: XWorm -- Atomics T1036.005 Test #2 Atomics T1218 Test #12'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("svchost.exe" OR "rundll32.exe" OR "services.exe"
  OR "powershell.exe" OR "pwsh.exe" OR "regsvr32.exe" OR "spoolsv.exe" OR "lsass.exe"
  OR "smss.exe" OR "csrss.exe" OR "conhost.exe" OR "wininit.exe" OR "lsm.exe" OR "winlogon.exe"
  OR "taskhost.exe" OR "taskmgr.exe" OR "sihost.exe" OR "RuntimeBroker.exe" OR "smartscreen.exe"
  OR "dllhost.exe" OR "audiodg.exe" OR "wlanext.exe" OR "cmd.exe" OR "wmiprvse.exe"
  OR "powershell_ise.exe" OR "ie4uinit.exe" OR "mshta.exe" OR "printui.exe") | regex process_path!="(?i)(\x5cWindows\x5c(system32|SysWOW64))|Program\sFiles\x5cPowerShell"|
  where match(process_name, "(?i)^(svchost\.exe|rundll32\.exe|services\.exe|powershell\.exe|pwsh\.exe|regsvr32\.exe|spoolsv\.exe|lsass\.exe|smss\.exe|csrss\.exe|conhost\.exe|wininit\.exe|lsm\.exe|winlogon\.exe|taskhost\.exe|taskmgr\.exe|sihost\.exe|RuntimeBroker\.exe|smartscreen\.exe|dllhost\.exe|audiodg\.exe|wlanext\.exe|cmd\.exe|wmiprvse\.exe|powershell_ise\.exe|ie4uinit\.exe|mshta\.exe|printui\.exe)$")
  | table _time, host, user, process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- defense-evasion:masquerading:masquerade task or service
- defense-evasion:masquerading:match legitimate name or location
technique_id:
- T1036.004
- T1036.005
data_category:
- Windows event logs
references:
- https://redcanary.com/threat-detection-report/techniques/match-legitimate-name-or-location/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.005/T1036.005.md#atomic-test-2---masquerade-as-a-built-in-system-executable

name: Windows Service Create Kernel Mode Driver
id: 0b4e3b06-1b2b-4885-b752-cf06d12a90cb
version: 13
creation_date: '2022-05-16'
modification_date: '2026-05-13'
author: Michael Haag, Teoderick Contreras Splunk
status: production
type: TTP
description: The following analytic identifies the creation of a new kernel mode driver using the sc.exe command. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. The activity is significant because adding a kernel driver is uncommon in regular operations and can indicate an attempt to gain low-level access to the system. If confirmed malicious, this could allow an attacker to execute code with high privileges, potentially compromising the entire system and evading traditional security measures.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
      where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) Processes.process="*create*" Processes.process IN ("*kernel*", "*filesys*") Processes.process="*type*"
    by Processes.action Processes.dest Processes.original_file_name
    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
    Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_service_create_kernel_mode_driver_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present based on common applications adding new drivers, however, filter as needed.
references:
    - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
    - https://whiteknightlabs.com/2025/11/25/discreet-driver-loading-in-windows/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-config
finding:
    title: Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$.
analytic_story:
    - Windows Drivers
    - CISA AA22-320A
asset_type: Endpoint
mitre_attack_id:
    - T1068
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint