Splunk rules: 0y

id: '32363.57556'
title: .msc Executed from Unusual Location
description: 'Threat actors may abuse mmc.exe to proxy execution of malicious .msc
  files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft
  and is used in several ways in either its GUI or in a command prompt. MMC can be
  used to create, open, and save custom consoles that contain administrative tools
  created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows
  systems locally or remotely. MMC can also be used to open Microsoft created .msc
  files to manage system configuration. This use case detects mmc.exe executions referencing
  .msc files outside of C:\Windows\system32 or C:\Windows\SysWOW64. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "mmc.exe" ".msc" | regex process="(?i)\.msc"|
  regex process!="(?i)C:\x5cWindows\x5c(system32|syswow64)\x5c\w+\.msc" | table _time,
  host, user, process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:mmc
technique_id:
- T1218.014
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.itechtics.com/enable-gpedit-windows-10-home/

name: Attacker Tools On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-16a110145893
version: 19
creation_date: '2021-07-12'
modification_date: '2026-07-14'
author: Bhavin Patel, Splunk, sventec, Github Community
status: production
type: TTP
description: |-
    The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration.
    It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names.
    This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(Processes.process) as process
            values(Processes.parent_process) as parent_process
    FROM datamodel=Endpoint.Processes WHERE [
        | inputlookup attacker_tools
        | rename attacker_tool_names AS Processes.process_name
        | fields Processes.process_name
    ]
    AND
    Processes.dest!=unknown
    Processes.user!=unknown

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description
    | search description !=false
    | `attacker_tools_on_endpoint_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some administrator activity can be potentially triggered, please add those users to the filter macro.
references: []
finding:
    title: An attacker tool $process_name$, listed in attacker_tools.csv is executed on host $dest$ by User $user$. $process_name$ is known for [$description$].
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An attacker tool $process_name$, listed in attacker_tools.csv is executed on host $dest$ by User $user$. $process_name$ is known for [$description$].
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - XMRig
    - Unusual Processes
    - SamSam Ransomware
    - CISA AA22-264A
    - Compromised Windows Host
    - PHP-CGI RCE Attack on Japanese Organizations
    - Cisco Network Visibility Module Analytics
    - Scattered Spider
asset_type: Endpoint
mitre_attack_id:
    - T1003
    - T1036.005
    - T1595
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1031.1037'
title: Certutil De-Obfuscate_Decode Files
description: 'Detects the decoding of PE files inside a certificate (used by MenuPass)
  - (T1140). -- Threat Actor Association: FIN13, Kimsuky, Revil, TA551, Volt Typhoon
  -- Software Association: Astaroth, MINEBRIDGE, Mispadu, VawTrack -- Atomics T1140
  Test #1 Atomics T1140 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("certutil" (TERM(-decode) OR TERM(-decodehex)))
  OR (TERM(-decode) OR TERM(-decodehex)) | table _time, host, user event_id, parent_*,
  process, process_*, signature_id, src_*, dest_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process, "(?i)-decode") '
techniques:
- defense-evasion:deobfuscate/decode files or information
technique_id: 
- T1140
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.sentinelone.com/blog/malware-living-off-land-with-certutil/

name: Cisco Isovalent - Potential Escape to Host
id: 2b8a7a21-bec6-4e1f-84c4-7b319f45d2ab
version: 6
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    This analytic detects potential container escape or reconnaissance attempts by monitoring for the rapid execution of multiple suspicious Linux commands (nsenter, mount, ps aux, and ls) within a short time window. The search aggregates process execution logs into 5-minute buckets and identifies when two or more distinct commands occur in quick succession. This behavior is noteworthy because attackers often chain these commands together to pivot from a container into the host, enumerate processes, or browse filesystems. For a SOC, catching these clustered command executions is important because it highlights possible adversary activity attempting to break isolation and escalate privileges inside a Kubernetes environment.
data_source:
    - Cisco Isovalent Process Exec
search: |
    `cisco_isovalent_process_exec`

    (
        process_name IN ("nsenter","mount","ps","ls")
        OR
        process IN ("*nsenter*", "*mount*", "*ps aux*", "*ps -ef*")
    )
    | bin _time span=5m
    | stats
        count AS total_events
        dc(process_name) AS distinct_cmds
        min(_time) AS firstTime
        max(_time) AS lastTime
        values(process) AS process
        values(process_name) AS process_name
      BY cluster_name node_name pod_name _time
    | eval duration_s = round(lastTime - firstTime, 0)
    | where distinct_cmds >= 2 AND duration_s <= 120
    | table _time cluster_name node_name pod_name total_events distinct_cmds duration_s firstTime lastTime process process_name
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_isovalent___potential_escape_to_host_filter`
how_to_implement: |
    This detection relies on process execution telemetry from Cisco Isovalent Runtime Security.
    Ensure Isovalent Runtime Security is deployed and configured in your Kubernetes environment
    to generate process_exec events. Configure the Cisco Security Cloud TA to collect these logs
    via HEC and normalize them into Splunk CIM. Privileged pods and hostPID configurations
    should be closely monitored as they increase the risk of container escape attempts.
known_false_positives: |
    Some legitimate administrative containers or troubleshooting workflows may use nsenter
    or mount commands (e.g., debugging nodes with hostPID pods). Such activity should be
    investigated in context to ensure it is not malicious.
references:
    - https://attack.mitre.org/techniques/T1611/
    - https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
intermediate_findings:
    entities:
        - field: pod_name
          type: system
          score: 20
          message: Escape-to-host attempt detected in pod $pod_name$ on cluster $cluster_name$ using a command - [$process$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Isovalent Suspicious Activity
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1611
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco Secure Firewall - Privileged Command Execution via HTTP
id: 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
version: 5
creation_date: '2026-01-12'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Michael Haag, Splunk
status: production
type: Anomaly
description: |
    This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events.
    This detection leverages Snort signature 65370 to identify requests to these sensitive endpoints, which when combined with other indicators may signal active exploitation or post-compromise activity.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall`
    EventType=IntrusionEvent
    signature_id=65370
    | fillnull
    | stats dc(signature_id) as unique_signature_count
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(src) as src
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
            by dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___privileged_command_execution_via_http_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: |
    No false positives have been identified yet.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: HTTP request to privileged execution path detected from $src$ to Cisco router $dest$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1059
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: ConnectWise ScreenConnect Authentication Bypass
id: d3f7a803-e802-448b-8eb2-e796b223bfff
version: 11
creation_date: '2024-02-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via an alternate path or channel. It leverages web request logs to identify access to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected system, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url IN ("*/SetupWizard.aspx/*","*/SetupWizard/") Web.status=200 Web.http_method=POST
      BY Web.src, Web.dest, Web.http_user_agent,
         Web.url, Web.status, Web.http_method,
         sourcetype, source
    | rex field=Web.url "/SetupWizard.aspx/(?<randomPath>.+)"
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `connectwise_screenconnect_authentication_bypass_filter`
how_to_implement: To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The analytic was written against Suricata. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
known_false_positives: False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
references:
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
    - https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
finding:
    title: An authentication bypass attempt against ScreenConnect has been detected on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ConnectWise ScreenConnect Vulnerabilities
    - Seashell Blizzard
asset_type: Web Server
cve:
    - CVE-2024-1708
    - CVE-2024-1709
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Deleting Shadow Copies
id: b89919ed-ee5f-492c-b139-95dbb162039e
version: 19
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: TTP
description: The following analytic detects the deletion of shadow copies using the vssadmin.exe or wmic.exe utilities. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because deleting shadow copies is a common tactic used by attackers to prevent recovery and hide their tracks. If confirmed malicious, this action could hinder incident response efforts and allow attackers to maintain persistence and cover their activities, making it crucial for security teams to investigate promptly.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=vssadmin.exe
            OR
            Processes.process_name=wmic.exe
        )
        Processes.process=*delete* Processes.process=*shadow*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `deleting_shadow_copies_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare.
references:
    - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Rhysida Ransomware
    - Prestige Ransomware
    - CISA AA22-264A
    - LockBit Ransomware
    - SamSam Ransomware
    - Chaos Ransomware
    - Black Basta Ransomware
    - DarkGate Malware
    - Ransomware
    - Windows Log Manipulation
    - Compromised Windows Host
    - Clop Ransomware
    - Cactus Ransomware
    - Medusa Ransomware
    - VanHelsing Ransomware
    - Termite Ransomware
    - Storm-2460 CLFS Zero Day Exploitation
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Domain Group Discovery With Wmic
id: a87736a6-95cd-4728-8689-3c64d5026b3e
version: 9
creation_date: '2021-08-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of `wmic.exe` with command-line arguments used to query for domain groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gain situational awareness and map out Active Directory structures. If confirmed malicious, this behavior could allow attackers to identify and target specific domain groups, potentially leading to privilege escalation or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group* AND Processes.process="*GET ds_samaccountname*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '22624.40846'
title: Remote Share Directory Listing - Windows
description: 'Threat actors may seek to enumerate local administrative access on remote
  systems during reconnaissance activities. This use case detects commands to list
  files and directories on administrative shares (C$, Admin$, or IPC$). Note: dir
  and tree commands do not generate process creation logs and will only be detected
  if called with another executable, e.g. "cmd.exe /c dir".'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") (TERM(dir) OR TERM(ls) OR TERM(Get-ChildItem) OR TERM(gci) OR
  TERM(tree)) ("C$" OR "ADMIN$" OR "IPC$") | regex process="(?i)\x5c\x5c(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\x5c(C|ADMIN|IPC)\$"
  | table _time, host, user user, process, process_*, parent_process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- discovery:file and directory discovery
technique_id: 
- T1083
data_category:
- PowerShell logs
references:
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/

id: '8661.11208'
title: Suspicious Certificate Modification
description: 'Adversaries may modify an AD CA’s root certificate, and in order to
  gain ans use a certificate for any active user or computer. - Threat Actor Association:
  APT29'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4891) OR
  "<EventID>4891<" OR TERM(EventCode=4892) OR "<EventID>4892<" OR TERM(EventCode=4890)
  OR "<EventID>4890<" OR TERM(EventCode=4882) OR "<EventID>4882<") | table _time,
  host, user process, process_*, parent_process, parent_process_*, src_*, dest_*,
  subject | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:modify authentication process
technique_id: 
- T1556
data_category:
- Windows event logs
references:
- https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
- https://github.com/GhostPack/Certify#using-requested-certificates

name: Windows Change File Association Command To Notepad
id: 339155d6-34cb-4788-9d00-e67f190af93a
version: 6
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    The following analytic detects attempts to change the command value of a file association of an extension to open with Notepad.exe.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns and registry modifications.
    This activity is significant as it can indicate an attempt to manipulate file handling behavior, a technique observed in APT and ransomware attacks like Prestige.
    After changing the extension of all encrypted files to a new one, Prestige ransomware modifies the file association for that extension to open with Notepad.exe in order to display a ransom note.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
      max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
      (`process_reg` AND Processes.process="* add *")
      OR
      (`process_powershell` AND Processes.process IN ("*New-ItemProperty*", "*Set-ItemProperty*", "* sp *"))
    )

    Processes.process IN ("*HKCR\\*", "*HKEY_CLASSES_ROOT\\*")
    Processes.process = "*\\shell\\open\\command*"
    Processes.process = "*Notepad.exe*"

    ```
    The exclusion below aims to filter the default notepad association as well as links to the notepad package from the Microsoft Store.
    ```

    NOT Processes.process IN ("*\\Applications\\notepad.exe\\*", "*\\WindowsApps\\Microsoft.WindowsNotepad*")

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_change_file_association_command_to_notepad_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
finding:
    title: Process with commandline $process$ set the execution command of a file association to notepad.exe on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Prestige Ransomware
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1546.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows COM Hijacking InprocServer32 Modification
id: b7bd83c0-92b5-4fc7-b286-23eccfa2c561
version: 14
creation_date: '2022-09-26'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the modification of the InProcServer32 registry key by reg.exe, indicative of potential COM hijacking. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. COM hijacking is significant as it allows adversaries to insert malicious code that executes in place of legitimate software, providing a means for persistence. If confirmed malicious, this activity could enable attackers to execute arbitrary code, disrupt legitimate system components, and maintain long-term access to the compromised environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_reg` Processes.process=*inprocserver32*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_com_hijacking_inprocserver32_modification_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present and some filtering may be required.
references:
    - https://attack.mitre.org/techniques/T1546/015/
    - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to modify InProcServer32 within the registry.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to modify InProcServer32 within the registry.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Living Off The Land
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1546.015
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows LSA Secrets NoLMhash Registry
id: 48cc1605-538c-4223-8382-e36bee5b540d
version: 12
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry related to the Local Security Authority (LSA) NoLMHash setting. It identifies when the registry value is set to 0, indicating that the system will store passwords in the weaker Lan Manager (LM) hash format. This detection leverages registry activity logs from endpoint data sources like Sysmon or EDR tools. Monitoring this activity is crucial as it can indicate attempts to weaken password storage security. If confirmed malicious, this could allow attackers to exploit weaker LM hashes, potentially leading to unauthorized access and credential theft.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\NoLMHash" Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lsa_secrets_nolmhash_registry_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
known_false_positives: Administrator may change this registry setting.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
finding:
    title: Windows LSA Secrets NoLMhash Registry on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Windows LSA Secrets NoLMhash Registry on $dest$ by $user$.
analytic_story:
    - CISA AA23-347A
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1003.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry No Auto Reboot With Logon User
id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a
version: 11
creation_date: '2023-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a suspicious modification to the Windows registry that disables automatic reboot with a logged-on user. This detection leverages the Endpoint data model to identify changes to the registry path `SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers` with a value of `0x00000001`. This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to evade detection and maintain persistence. If confirmed malicious, this could allow attackers to bypass security measures and deploy additional payloads without interruption.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoRebootWithLoggedOnUsers" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_no_auto_reboot_with_logon_user_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
references:
    - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A registry modification in Windows auto update configuration on $dest$
analytic_story:
    - RedLine Stealer
asset_type: Endpoint
atomic_guid:
    - 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows SSH Proxy Command
id: ac520039-21f1-4567-b528-5b7133dba76f
version: 6
creation_date: '2025-03-24'
modification_date: '2026-05-13'
author: Michael Haag, AJ King, Nasreddine Bencherchali, Splunk, Jesse Hunter, Splunk Community Contributor
status: production
type: Anomaly
description: |
    This detection identifies potential abuse of SSH "ProxyCommand" or "LocalCommand" by monitoring for suspicious process execution patterns.
    Specifically, it looks for instances where ssh.exe (as a parent process) containing "ProxyCommand" or "LocalCommand" in its arguments spawns potentially malicious child processes like mshta, powershell, wscript, or cscript, or processes containing "http" in their command line.
    This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands.
data_source:
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.parent_process_name="ssh.exe"
    (
      Processes.parent_process = "*ProxyCommand=*"
      OR
      (
        Processes.parent_process = "* PermitLocalCommand=yes*"
        Processes.parent_process = "* LocalCommand=*"
      )
    )

    Processes.process IN (
      "*cscript*",
      "*http*",
      "*mshta*",
      "*powershell*",
      "*pwsh*",
      "*wmic*",
      "*wscript*"
    )

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
       Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_ssh_proxy_command_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Legitimate use of SSH ProxyCommand or LocalCommand with scripting engines may trigger this detection.
    Filter as needed based on your environment's normal SSH usage patterns and authorized scripting activities.
references:
    - https://www.virustotal.com/gui/file/c33f82868dbbfc3ab03918f430b1a348499f5baf047b136ff0a4fc3e8addaa9b/detection
    - https://attack.mitre.org/techniques/T1572/
    - https://lolbas-project.github.io/lolbas/Binaries/Ssh/
    - https://man.openbsd.org/ssh_config#ProxyCommand
    - https://man.openbsd.org/ssh_config#LocalCommand
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious process execution $process$ detected through SSH $parent_process$ on $dest$ by user $user$
        - field: user
          type: user
          score: 20
          message: Suspicious process execution $process$ detected through SSH $parent_process$ on $dest$ by user $user$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
    - Living Off The Land
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1572
    - T1059.001
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows WinRAR Launched Outside Default Installation Directory
id: 3b711292-9793-4a88-8e89-6e016cfbc09c
version: 3
creation_date: '2026-03-16'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    This Analytics detects the execution of WinRAR or RAR outside the default installation directory.
    This behavior can be significant as it could indicate attempts to archive collected sensitive data from the endpoint for exfiltration.
    We recommend reviewing the process path and the parent process path to determine if the execution is legitimate and if possible validate the data being archived.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
      from datamodel=Endpoint.Processes where
      Processes.process_name IN ("Winrar.exe", "rar.exe")
      NOT Processes.process_path IN (
        "*:\\Program Files (x86)\\WinRAR\\*",
        "*:\\Program Files\\WinRAR\\*"
      )
      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
      Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
      Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
      Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
      Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_winrar_launched_outside_default_installation_directory_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    False positives are expected from machines where the default installation path was changed. Apply additional filters accordingly.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$process_name$] execution in [$process_path$] was identified on endpoint [$dest$] by user [$user$].
        - field: user
          type: user
          score: 20
          message: A [$process_name$] execution in [$process_path$] was identified on endpoint [$dest$] by user [$user$].
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: WinEvent Scheduled Task Created Within Public Path
id: 5d9c6eee-988c-11eb-8253-acde48001122
version: 25
creation_date: '2021-04-08'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks within user-writable paths using Windows Security EventCode 4698. It identifies tasks registered via schtasks.exe or TaskService that execute commands from directories like Public, ProgramData, Temp, and AppData. This behavior is significant as it may indicate an attempt to establish persistence or execute unauthorized commands. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, or execute arbitrary code, posing a severe threat to system integrity and security.
data_source:
    - Windows Event Log Security 4698
search: |
    `wineventlog_security`
    EventCode=4698
    TaskContent IN (
      "*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*",
      "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*"
      )
    | stats count min(_time) as firstTime max(_time) as lastTime
      by Computer, TaskName, TaskContent, user
    |  rename Computer as dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `winevent_scheduled_task_created_within_public_path_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately.
references:
    - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698
    - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
    - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
    - https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/
finding:
    title: A windows scheduled task was created (task name=$TaskName$) on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Data Destruction
    - Winter Vivern
    - Industroyer2
    - Compromised Windows Host
    - Quasar RAT
    - China-Nexus Threat Activity
    - XWorm
    - Ransomware
    - IcedID
    - CISA AA23-347A
    - Salt Typhoon
    - Ryuk Ransomware
    - Active Directory Lateral Movement
    - Malicious Inno Setup Loader
    - CISA AA22-257A
    - Medusa Ransomware
    - SystemBC
    - Scheduled Tasks
    - Prestige Ransomware
    - AsyncRAT
    - Windows Persistence Techniques
    - 0bj3ctivity Stealer
    - APT37 Rustonotto and FadeStealer
    - Castle RAT
    - ValleyRAT
    - PlugX
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: WinRAR Spawning Shell Application
id: d2f36034-37fa-4bd4-8801-26807c15540f
version: 13
creation_date: '2023-08-29'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of Windows shell processes initiated by WinRAR, such as "cmd.exe", "powershell.exe", "certutil.exe", "mshta.exe", or "bitsadmin.exe". This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant because it may indicate exploitation of the WinRAR CVE-2023-38831 vulnerability, where malicious scripts are executed from spoofed ZIP archives. If confirmed malicious, this could lead to unauthorized access, financial loss, and further malicious activities like data theft or ransomware attacks.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=winrar.exe `windows_shells`
        OR
        Processes.process_name IN ("certutil.exe","mshta.exe","bitsadmin.exe")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `winrar_spawning_shell_application_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Be aware of potential false positives - legitimate uses of WinRAR and the listed processes in your environment may cause benign activities to be flagged. Upon triage, review the destination, user, parent process, and process name involved in the flagged activity. Capture and inspect any relevant on-disk artifacts, and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.
references:
    - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
    - https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc
    - https://github.com/b1tg/CVE-2023-38831-winrar-exploit
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
    - WinRAR Spoofing Attack CVE-2023-38831
asset_type: Endpoint
cve:
    - CVE-2023-38831
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint