Splunk rules: 0x

id: '8622.11070'
title: Account set to active via Net.exe
description: 'Adversaries may obtain and abuse credentials of a default or disabled
  account as a means of gaining Initial Access, Persistence, Privilege Escalation,
  or Defense Evasion. Default accounts are those that are built-into an OS, such as
  the Guest or Administrator accounts on Windows systems. -- Threat Actor Association:
  Unfading Sea Haze - Software Association: RansomHub -- Atomics T1078.001 Test#1
  Atomics T1078.001 Test#2 Atomics T1564 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<")
  ("/active:yes" OR "/active:y") | table _time, host, user, signature_id, process,
  process_*, parent_process_*, src_ip, dest_ip, dest_port `group_events("host", 1)` '
techniques:
- privilege-escalation:valid accounts:default accounts
- persistence:account manipulation
- defense-evasion:valid accounts:default accounts
- persistence:valid accounts:default accounts
technique_id:
- T1078.001
- T1098
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.001/T1078.001.md

name: Disable Security Logs Using MiniNt Registry
id: 39ebdc68-25b9-11ec-aec7-acde48001122
version: 16
creation_date: '2021-10-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. It leverages data from the Endpoint.Registry data model, focusing on changes to the "Control\\MiniNt" registry path. This activity is significant because it can prevent Windows from logging any events to the Security Log, effectively blinding security monitoring efforts. If confirmed malicious, this technique could allow an attacker to operate undetected, making it difficult to trace their actions and compromising the integrity of security audits.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://twitter.com/0gtweet/status/1182516740955226112
finding:
    title: Modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Windows Defense Evasion Tactics
    - CISA AA23-347A
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disabling Firewall with Netsh
id: 6860a62c-9203-11eb-9e05-acde48001122
version: 14
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the disabling of the firewall using the netsh application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include keywords like "firewall," "off," or "disable." This activity is significant because disabling the firewall can expose the system to external threats, allowing malware to communicate with its command and control (C2) server. If confirmed malicious, this action could lead to unauthorized data exfiltration, further malware downloads, and broader network compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_netsh` Processes.process= "*firewall*" (Processes.process= "*off*"
        OR
        Processes.process= "*disable*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `disabling_firewall_with_netsh_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: admin may disable firewall during testing or fixing network problem.
references:
    - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The Windows Firewall was disabled on $dest$ by $user$.
        - field: dest
          type: system
          score: 20
          message: The Windows Firewall was disabled on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - BlackByte Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi Sensitive Files Accessed
id: 6fa0073d-6ca0-4f93-913d-fb420c9de15b
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. Interaction with these files may indicate adversary reconnaissance, credential harvesting, or preparation for privilege escalation, lateral movement, or persistence.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*shell[*" Message IN ("*/etc/shadow*","*/etc/vmware/hostd/hostd.xml*", "*/etc/vmware/vpxa/vpxa.cfg*","*/etc/sfcb/sfcb.cfg*","*/etc/security/*", "*/etc/likewise/krb5-affinity.conf*","*/etc/vmware-vpx/vcdb.properties*") | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_sensitive_files_accessed_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Administrators may access these files for initial setup or troubleshooting. Limited in most environments. Tune as needed.
finding:
    title: Sensitive files accessed on ESXi host $dest$ with $command$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
    - China-Nexus Threat Activity
asset_type: Infrastructure
mitre_attack_id:
    - T1003.008
    - T1005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: ESXi Shared or Stolen Root Account
id: 1bc8f235-5d7c-457c-95ca-5e92edcb52ea
version: 4
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*root*" Message="*logged in*" NOT Message="*root@127.0.0.1*" | rex field=_raw "root@(?<SrcIpAddr>\d{1,3}(?:\.\d{1,3}){3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | bin _time span=15m | stats min(_time) as firstTime max(_time) as lastTime dc(SrcIpAddr) AS distinct_ip_count values(SrcIpAddr) AS SrcIps by dest | where distinct_ip_count > 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_shared_or_stolen_root_account_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward logs to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed
references:
    - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Root login from multiple IPs on ESXi host $dest$.
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: GCP Authentication Failed During MFA Challenge
id: 345f7e1d-a3fe-4158-abd8-e630f9878323
version: 13
creation_date: '2022-10-14'
modification_date: '2026-05-13'
author: Bhavin Patel, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects failed authentication attempts during the Multi-Factor Authentication (MFA) challenge on a Google Cloud Platform (GCP) tenant. It uses Google Workspace login failure events to identify instances where MFA methods were challenged but not successfully completed. This activity is significant as it may indicate an adversary attempting to access an account with compromised credentials despite MFA protection. If confirmed malicious, this could lead to unauthorized access attempts, potentially compromising sensitive data and resources within the GCP environment.
data_source:
    - Google Workspace login_failure
search: |-
    `gws_reports_login` event.name=login_failure `gws_login_mfa_methods`
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY user, src_ip, login_challenge_method
      | `gcp_authentication_failed_during_mfa_challenge_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events.
known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://attack.mitre.org/techniques/T1078/004/
finding:
    title: User $user$ failed to pass MFA challenge
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - GCP Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Google Cloud Platform tenant
mitre_attack_id:
    - T1078.004
    - T1586.003
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Java Class File download by Java User Agent
id: 8281ce42-5c50-11ec-82d2-acde48001122
version: 10
creation_date: '2021-12-13'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies a Java user agent performing a GET request for a .class file from a remote site. It leverages web or proxy logs within the Web Datamodel to detect this activity. This behavior is significant as it may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell). If confirmed malicious, an attacker could exploit vulnerabilities in the Java application, potentially leading to remote code execution and further compromise of the affected system.
data_source:
    - Splunk Stream HTTP
search: |-
    | tstats  `security_content_summariesonly` count FROM datamodel=Web
      WHERE Web.http_user_agent="*Java*" Web.http_method="GET" Web.url="*.class*"
      BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
         Web.src, Web.dest
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `java_class_file_download_by_java_user_agent_filter`
how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
known_false_positives: Filtering may be required in some instances, filter as needed.
references:
    - https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/
finding:
    title: A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve a remote class file.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: http_user_agent
      type: http_user_agent
analytic_story:
    - Log4Shell CVE-2021-44228
asset_type: Web Server
cve:
    - CVE-2021-44228
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Auditd Dd File Overwrite
id: d1b74420-4cea-4752-a123-9b40dfcca49a
version: 9
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. It leverages data from Linux Auditd telemetry, focusing on process execution logs that include command-line details. This activity is significant because adversaries often use the 'dd' command to destroy or irreversibly overwrite files, disrupting system availability and services. If confirmed malicious, this behavior could lead to data destruction, making recovery difficult and potentially causing significant operational disruptions.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd` proctitle = "*dd *" AND proctitle = "*of=*" AND proctitle = "*if=/dev/zero*"
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_dd_file_overwrite_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://gtfobins.github.io/gtfobins/dd/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
finding:
    title: A [$proctitle$] event occurred on host - [$dest$].
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Industroyer2
    - Data Destruction
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux AWK Privilege Escalation
id: 4510cae0-96a2-4840-9919-91d262db210a
version: 13
creation_date: '2022-02-15'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the AWK command with elevated privileges to execute system commands. It leverages Endpoint Detection and Response (EDR) telemetry, specifically monitoring processes that include "sudo," "awk," and "BEGIN*system" in their command lines. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain root access by executing commands as the root user. If confirmed malicious, this could allow an attacker to fully compromise the system, execute arbitrary commands, and maintain persistent control over the affected endpoint.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*sudo*"
        AND
        Processes.process="*awk*"
        AND
        Processes.process="*BEGIN*system*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_awk_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://www.hacknos.com/awk-privilege-escalation/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: M365 Copilot Application Usage Pattern Anomalies
id: e3308b0c-d1a1-40d5-9486-4500f0d34731
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: production
type: Anomaly
description: Detects M365 Copilot users exhibiting suspicious application usage patterns including multi-location access, abnormally high activity volumes, or access to multiple Copilot applications that may indicate account compromise or automated abuse. The detection aggregates M365 Copilot Graph API events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses, number of different Copilot apps used, and average events per day over the observation period. Users are flagged when they access Copilot from multiple cities (cities_count > 1), generate excessive daily activity (events_per_day > 100), or use more than two different Copilot applications (app_count > 2), which are anomalous patterns suggesting credential compromise or bot-driven abuse.
data_source:
    - M365 Copilot Graph API
search: >
    `m365_copilot_graph_api` (appDisplayName="*Copilot*" OR appDisplayName="M365ChatClient" OR appDisplayName="OfficeAIAppChatCopilot")
    | eval user = userPrincipalName
    | stats count as events,
        dc(location.city) as cities_count,
        values(location.city) as city_list,
        dc(location.countryOrRegion) as countries_count,
        values(location.countryOrRegion) as country_list,
        dc(ipAddress) as ip_count,
        values(ipAddress) as ip_addresses,
        dc(appDisplayName) as app_count,
        values(appDisplayName) as apps_used,
        dc(resourceDisplayName) as resource_count,
        values(resourceDisplayName) as resources_accessed,
        min(_time) as first_seen,
        max(_time) as last_seen
        by user
    | eval days_active = round((last_seen - first_seen)/86400, 1)
    | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S")
    | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M:%S")
    | eval events_per_day = if(days_active > 0, round(events/days_active, 2), events)
    | where cities_count > 1 OR events_per_day > 100 OR app_count > 2
    | sort -events_per_day, -countries_count
    | `m365_copilot_application_usage_pattern_anomalies_filter`
how_to_implement: This detection requires ingesting M365 Copilot access logs via the Splunk Add-on for Microsoft Office 365. Configure the add-on to collect Azure AD Sign-in logs (AuditLogs.SignIns) through the Graph API data input. Ensure proper authentication and permissions are configured to access sign-in audit logs. The `m365_copilot_graph_api` macro should be defined to filter for sourcetype o365:graph:api data containing Copilot application activity.
known_false_positives: Power users, executives with heavy AI workloads, employees traveling for business, users accessing multiple Copilot applications legitimately, or teams using shared corporate accounts across different office locations may trigger false positives.
references:
    - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ exhibited anomalous M365 Copilot usage patterns including multi-location access, excessive activity levels, or multiple application usage indicating potential account compromise or automated abuse.
analytic_story:
    - Suspicious Microsoft 365 Copilot Activities
asset_type: Web Application
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '1033.1041'
title: Mimikatz
description: 'Mimikatz is used to extract plaintexts passwords, hash, PIN code and
  Kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket
  or build Golden tickets. -- Threat Actor Association: APT10/Cicada, APT27/Emissary
  Panda, APT29/Nobelium, APT41/Wicked Panda, Carbanak, DarkSide, BlackMatter, FamousSparrow,
  FIN7, FIN12, Hello Kitty / Five Hands, Karakurt, Lapsus$, LockBit, Memento Team,
  TRACER KITTEN, TRAVELING SPIDER, SILENCE, UNC2596, Witchetty -- Software Association:
  Blackcat/ALPHV, Conti, Cuba, Midas, Lockbit, LV, Nefilim, Play, Qakbot, Revil, SamSam,
  Stonefly, WASTEDLOCKER -- Atomics T1003.001 Test #6 Atomics T1003.001 Test #10 Atomics
  T1550.002 Test#1'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=1 AND ( "mimikatz"
  OR "gentilkiwi" OR "whoami" OR "IntegriyLevel=High" )) OR (EventCode=10 AND ("lsass.exe"
  OR mimikatz)) | table _time, host, user dest, direction, dvc, dvc_nt_host, event_id,
  eventtype, hashes, host, index, parent_process, parent_process_id, parent_process_name,
  parent_process_path, process, process_current_directory, process_id, process_name,
  process_path, signature_id, source, sourcetype, tag, user, user_id | bin span=60s
  | stats values(*) as * by _time, host | where (match(parent_process_name,"(?i)(powershell.exe)|(cmd.exe)")
  AND match(parameters,"(?i)gentilkiwi") OR match(process,"(?i)mimikatz")) OR (match(parameters,"(?i)granted_access=0x1010")
  AND match(parent_process_name,"(?i)(powershell.exe)|(cmd.exe)") AND match(process_path,"(?i).lsass.exe")
  AND match(process,"(?i)KERNELBASE.dll") AND match(process,"(?i)ntdll.dll") AND match(process,"(?i)whoami"))
  | bin span=300s _time | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:lsass memory
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping:dcsync
- credential-access:os credential dumping:lsa secrets
- credential-access:steal or forge kerberos tickets:golden ticket
- credential-access:steal or forge kerberos tickets:silver ticket
- credential-access:unsecured credentials:credentials in registry
technique_id:
- T1552.002
- T1003.006
- T1003.004
- T1003.002
- T1558.002
- T1558.001
- T1003.001
data_category:
- Windows Sysmon
references:
- https://www.sans.org/reading-room/whitepapers/detection/mimikatz-overview-defenses-detection-36780

id: '1117.1196'
title: MSIExec Install MSI File
description: 'The Windows Installer technology uses Msiexec.exe for installing MSI
  and MSP packages. This tool gives you full control over the installation process.
  -- Threat Actor Association: APT-K-47/Mysterious Elephant, APT36, TA505 -- Software
  Association: Clop, DirtyMoe, Hive, MirrorBlast, Qakbot/Qbot, Yellow Cockatoo/Jupiter
  Infostealer, Zloader -- LOLBAS -- Atomics T1218.007 Test #1 Atomics T1218.007 Test
  #2 Atomics T1218.007 Test #3 Atomics T1218.007 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=1040) OR
  "<EventID>1040<") TERM(MsiInstaller) OR TERM(ingress.event.procstart) | rex field=Message
  "(?i)Beginning\sa\sWindows\sInstaller\stransaction:(\s+)?(?<process>.+)" | table
  _time, host, user host, signature_id, user, process | bin span=1s | stats values(*)
  as * by _time, host | eventstats dc(process) as c_process by process | where c_process
  < 2 and isnotnull(process) '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows event logs
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/

id: '30578.54661'
title: Parent in Public Folder Suspicious Process
description: Adversaries may attempt to hide artifacts associated with their behaviors
  to evade detection. Adversaries may abuse command and script interpreters to execute
  commands, scripts, or binaries. This use case detects suspicious processes with
  a parent process in the Users\Public directory.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "\\Users\\Public" ("powershell" OR "pwsh" OR "wscript.exe"
  OR "cscript.exe" OR "bitsadmin" OR "certutil" OR "mshta.exe") OR ("cmd.exe" (" /c
  " OR " /r " OR " /k " )) | regex parent_process_path="^C:\x5cUsers\x5cPublic"| table
  _time, host, user, parent_process_name, parent_process_path, process_name, process_path,
  process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- defense-evasion:hide artifacts
technique_id: 
- T1059
- T1564
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent/
- https://attack.mitre.org/techniques/T1564/
- https://attack.mitre.org/techniques/T1059/

id: '6138.6633'
title: Query Registry
description: 'Adversaries may interact with the Windows Registry to gather information
  about the system, configuration, and installed software. -- Threat Actor Association:
  APT29/Nobelium/Cozy Bear, APT33, APT37, Carbanak, GoldenJackal, Lazarus, SaintBear
  (aka UAC-0056, UNC2589, TA471), TA505, Wizard Spider, WIRTE - - Software Associations:
  Bazar, Conti, Dridex, Emotet, NanoCore, PowerShortShell, Snatch, SquirrelWaffle,
  Ursnif, Zloader -- Atomics T1012 Test#1 Atomics T1218 Test#4 Atomics T1547.005 Test#1
  -- #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  TERM(EventCode=4104)) (((TERM(reg) OR "reg.exe") TERM(query)) OR ((("Get-Item" TERM(property))
  OR "Get-ItemProperty" OR "Set-Location" OR "New-Object") (TERM(Registry) OR TERM(HKLM)
  OR TERM(HKCU))) OR ( "RegEnumValue" OR "RegQueryInfoKey" OR "RegEnumKeyEx")) | table
  _time, host, user, signature_id, process_name, user, process | bin span=1s | stats
  values(*) as * by _time, host | eventstats c(process) as c_process by process| where
  c_process < 20 '
techniques:
- discovery:query registry
technique_id: 
- T1012
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://securelist.com/the-epic-turla-operation/65545/
- https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf

id: '5455.5610'
title: RDP Brute-force Detection
description: 'Detects possible Brute force attempt over Windows Remote Desktop Protocol
  (RDP) -- Software Association: BianLian, Conti, LockBit, SamSam, Snatch'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` AND ((TERM(EventCode=5156)
  OR "<EventID>5156<") AND Destination_Port="3389" AND Direction="Inbound" AND Protocol="6")
  OR ((TERM(EventCode=4625) OR "<EventID>4625<") AND (Failure_Reason="Unknown user
  name or bad password." OR FailureReason="%%2313" AND Logon_Type="3")) | rex field=Message
  (?<result>"(?i)An account failed to log on.")| rex field=Failure_Reason (?<result_reason>"(?i)Unknown
  user name or bad password.")| eval note=mvappend(result, result_reason)| table _time,
  host, user dest_port, note, process_name, process_path, signature_id, src_country,
  src_dns, src_ip | bin span=20s | stats values(*) as * by _time, host | where match(signature_id,"5156")
  AND match(signature_id,"4625")| where event_count > 3 | lookup dnslookup clientip
  as src_ip OUTPUT clienthost as src_dns | iplocation prefix="src_" src_ip | rename
  src_Country as src_country '
techniques:
- credential-access:brute force:password guessing
- initial-access:external remote services
technique_id:
- T1110.001
- T1133
data_category:
- Windows event logs
references: null

id: '33701.59574'
title: Suspicious Execution via Microsoft Common Console
description: 'Microsoft Management Console (MMC) can be used to create, open, and
  save custom consoles that contain administrative tools created by Microsoft, called
  snap-ins. These snap-ins may be used to manage Windows systems locally or remotely.
  MMC can also be used to open Microsoft created .msc files to manage system configuration.
  Threat actors may leverage malicious .msc files to gain full code execution via
  mmc.exe as observed in the GrimResource technique. This use case child processes
  created by mmc.exe that do not originate from common system directories or standard
  application paths. NOTE: Due to its extended logging capabilities for parent process
  behaviors and attributes, Sysmon is recommended for best rule fidelity.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(mmc) OR "mmc.exe") ".msc" | where match(parent_process_name, "(?i)mmc\.exe")
  and match(parent_process, "(?i)\.msc") and !match(parent_process, "(?i):\x5cWindows\x5c(System32|SysWOW64)\x5c\S+\.msc|Program\sFiles(\s\(x86\))?\x5c\S+\.msc")
  and !match(process_path, "(?i):\x5c(Windows\x5c(System32|SysWOW64)\x5c(mmc|wermgr|WerFault)\.exe)|Program\sFiles(\s\(x86\))?\x5c.*\.exe|Windows\x5cSystem32\x5cspool\x5cdrivers\x5cx64\x5c3\x5c\S+\.exe")
  | table _time, host, user, process, parent_process, parent_process_*, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218.014
data_category:
- Windows Sysmon
references:
- https://www.elastic.co/security-labs/grimresource

id: '20632.36814'
title: Suspicious ntds.dit Commands
description: 'Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information, as well as obtain other
  information about domain members such as devices, users, and access rights. This
  use case detects patterns of commands associated with ntds.dit dumping and/or exfiltration.
  -- Threat Actor Association: UNC5221, UTA0178 -- Software Association: Akira --
  Atomics T1003.003 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") (TERM(ntdsutil) OR TERM(ntds) OR "ntds.dit") (((TERM(ac) TERM(i))
  OR (TERM(activate) TERM(instance)) TERM(create) TERM(full)) OR TERM(copy)) | regex
  process="(?i)(ac\s+i\s+ntds.+create\s+full)|(copy\s+.+?ntds\.dit)|(activate\s+instance\s+ntds.*create\s+full)"
  | table _time, host, user, process*, parent_process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
- https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
- https://pentestlab.blog/tag/ntds-dit/
- https://github.com/zcgonvh/NTDSDumpEx
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1

name: Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc
id: ba6e7f4d-a85e-4a14-8e7d-41f4b82e3c9a
version: 7
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the sfc.exe utility with the "-u" parameter, which is part of the Cisco Secure Endpoint installation. The "-u" flag allows the uninstallation of Cisco Secure Endpoint components. This detection leverages endpoint telemetry to monitor command-line executions that include the "-u" parameter. The use of this flag is significant as it could indicate an attempt to disable or remove endpoint protection, potentially leaving the system vulnerable to further exploitation. If identified as malicious, this action may be part of a broader effort to disable security mechanisms and avoid detection.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -u*" NOT Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
references:
    - https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Suspicious use of `sfc.exe` to uninstall the Immunet Protect service on $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: Suspicious use of `sfc.exe` to uninstall the Immunet Protect service on $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Security Solution Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DotNet Binary in Non Standard Path
id: fddf3b56-7933-11ec-98a6-acde48001122
version: 14
creation_date: '2022-01-20'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects the execution of native .NET binaries from non-standard directories within the Windows operating system.
    It leverages Endpoint Detection and Response (EDR) telemetry, comparing process names and original file names against a predefined lookup "is_net_windows_file".
    This activity is significant because adversaries may move .NET binaries to unconventional paths to evade detection and execute malicious code.
    If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
    Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime
    FROM datamodel=Endpoint.Processes where
    NOT Processes.process_path IN (
          "*:\\Windows\\ADWS\\*",
          "*:\\Windows\\Microsoft.NET\\*",
          "*:\\Windows\\NetworkController\\*",
          "*:\\Windows\\System32\\*",
          "*:\\Windows\\SystemApps\\*",
          "*:\\Windows\\SysWOW64\\*",
          "*:\\Windows\\WinSxS\\*"
        )
    (
      [ | inputlookup is_net_windows_file
        | search netFile=true
        | fields originalFileName
        | rename originalFileName as Processes.original_file_name
        | format
      ]
    )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup update=true is_net_windows_file filename as process_name OUTPUT netFile
    | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile
    | search netFile=true
    | `windows_dotnet_binary_in_non_standard_path_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
    - https://attack.mitre.org/techniques/T1036/003/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Masquerading - Rename System Utilities
    - Ransomware
    - Unusual Processes
    - Signed Binary Proxy Execution InstallUtil
    - Data Destruction
    - WhisperGate
asset_type: Endpoint
mitre_attack_id:
    - T1036.003
    - T1218.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Hidden Schedule Task Settings
id: 0b730470-5fe8-4b13-93a7-fe0ad014d0cc
version: 14
creation_date: '2022-04-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of hidden scheduled tasks on Windows systems, which are not visible in the UI. It leverages Windows Security EventCode 4698 to identify tasks where the 'Hidden' setting is enabled. This behavior is significant as it may indicate malware activity, such as Industroyer2, or the use of living-off-the-land binaries (LOLBINs) to download additional payloads. If confirmed malicious, this activity could allow attackers to execute code stealthily, maintain persistence, or further compromise the system by downloading additional malicious payloads.
data_source:
    - Windows Event Log Security 4698
search: |
    `wineventlog_security`
    EventCode=4698
    TaskContent = "*<Hidden>true</Hidden>*"
    | stats count min(_time) as firstTime max(_time) as lastTime
      by TaskName TaskContent action signature status dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_hidden_schedule_task_settings_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://cert.gov.ua/article/39518
finding:
    title: A schedule task with hidden setting enable in host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - CISA AA22-257A
    - Active Directory Discovery
    - Malicious Inno Setup Loader
    - Compromised Windows Host
    - Data Destruction
    - Industroyer2
    - Cactus Ransomware
    - Scheduled Tasks
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1053
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify System Firewall with Notable Process Path
id: cd6d7410-9146-4471-a418-49edba6dadc4
version: 12
creation_date: '2021-11-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Will Metcalf, Splunk
status: production
type: TTP
description: The following analytic detects suspicious modifications to system firewall rules, specifically allowing execution of applications from notable and potentially malicious file paths. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving firewall rule changes. This activity is significant as it may indicate an adversary attempting to bypass firewall restrictions to execute malicious files. If confirmed malicious, this could allow attackers to execute unauthorized code, potentially leading to further system compromise, data exfiltration, or persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*" Processes.process IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*","*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\temp\\*", "*\\PerfLogs\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_system_firewall_with_notable_process_path_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: A network operator or systems administrator may utilize an automated or manual execution of this firewall rule that may generate false positives. Filter as needed.
references:
    - https://www.splunk.com/en_us/blog/security/more-than-just-a-rat-unveiling-njrat-s-mbr-wiping-capabilities.html
finding:
    title: firewall allowed program commandline $process$ of $process_name$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Medusa Ransomware
    - NjRAT
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint