Splunk rules: 0z

name: Auto Admin Logon Registry Entry
id: 1379d2b8-0f18-11ec-8ca3-acde48001122
version: 15
creation_date: '2021-09-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a suspicious registry modification that enables auto admin logon on a host. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "AutoAdminLogon" value within the "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" registry path. This activity is significant because it was observed in BlackMatter ransomware attacks to maintain access after a safe mode reboot, facilitating further encryption. If confirmed malicious, this could allow attackers to automatically log in and continue their operations, potentially leading to widespread network encryption and data loss.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
finding:
    title: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - BlackMatter Ransomware
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1552.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: AWS High Number Of Failed Authentications For User
id: e3236f49-daf3-4b70-b808-9290912ac64d
version: 10
creation_date: '2023-01-27'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects an AWS account experiencing more than 20 failed authentication attempts within a 5-minute window. It leverages AWS CloudTrail logs to identify multiple failed ConsoleLogin events. This behavior is significant as it may indicate a brute force attack targeting the account. If confirmed malicious, the attacker could potentially gain unauthorized access, leading to data breaches or further exploitation of the AWS environment. Security teams should consider adjusting the threshold based on their specific environment to reduce false positives.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName=ConsoleLogin action=failure
      | bucket span=10m _time
      | rename user_name as user
      | stats dc(_raw) AS failed_attempts values(src) as src values(user_agent) as user_agent
        BY _time, user, signature,
           dest, vendor_account vendor_region,
           vendor_product
      | where failed_attempts > 20
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_high_number_of_failed_authentications_for_user_filter`
how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
references:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ failed to authenticate more than 20 times in the span of 5 minutes for AWS Account $vendor_account$
analytic_story:
    - Compromised User Account
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Account
mitre_attack_id:
    - T1201
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS Network Access Control List Created with All Open Ports
id: ada0f478-84a8-4641-a3f1-d82362d6bd75
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for `CreateNetworkAclEntry` or `ReplaceNetworkAclEntry` actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.
data_source:
    - AWS CloudTrail CreateNetworkAclEntry
    - AWS CloudTrail ReplaceNetworkAclEntry
search: |-
    `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
      | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1
      | eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from'
      | where port_range>1024]
      | fillnull
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product requestParameters.ruleAction
           requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to
           requestParameters.portRange.from requestParameters.cidrBlock
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_network_access_control_list_created_with_all_open_ports_filter`
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
known_false_positives: It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
references: []
finding:
    title: User $user$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Network ACL Activity
asset_type: AWS Instance
mitre_attack_id:
    - T1686.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Cisco Duo Bypass Code Generation
id: 446e81ff-ce06-4925-9c7d-4073f9b5abf5
version: 6
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: |
    The following analytic detects when a Duo user generates a bypass code, which allows them to circumvent multi-factor authentication (2FA) protections.
    It works by monitoring Duo activity logs for the 'bypass_create' action, renaming the affected object as the user, and aggregating events to identify
    instances where a bypass code is issued. This behavior is significant for a Security Operations Center (SOC) because generating a bypass code can enable
    attackers, malicious insiders, or unauthorized administrators to gain access to sensitive systems without the required second authentication factor.
    Such activity may indicate account compromise, privilege abuse, or attempts to weaken security controls. Early detection of bypass code generation is
    critical, as it allows the SOC to investigate and respond before an attacker can exploit the reduced authentication requirements, helping to prevent
    unauthorized access, data breaches, or further lateral movement within the environment. Monitoring for this action helps maintain strong authentication
    standards and reduces the risk of credential-based attacks.
data_source:
    - Cisco Duo Administrator
search: |-
    `cisco_duo_administrator` action=bypass_create
      | rename object as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action actionlabel description
           user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `cisco_duo_bypass_code_generation_filter`
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A user $user$ has generated a bypass code
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Cisco Secure Firewall - Repeated Blocked Connections
id: 1f57f10e-1dc5-47ea-852c-2e85b2503d79
version: 9
creation_date: '2025-04-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    `cisco_secure_firewall` EventType=ConnectionEvent action IN ("Block with reset", "Block", "blocked")
    | bin _time span=1m
    | stats count min(_time) as firstTime max(_time) as lastTime
        Values(dest_port) as dest_port
        Values(url) as url
        by src, dest, transport, rule, action
    | where count >= 10
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___repeated_blocked_connections_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The access policy must also enable logging.
known_false_positives: |
    Misconfigured applications or automated scripts may generate repeated blocked traffic, particularly if attempting to reach decommissioned or restricted resources.
    Vulnerability scanners or penetration testing tools running in authorized environments may trigger this alert.
    Tuning may be required to exclude known internal tools or scanner IPs from detection.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Repeated blocked connections detected from $src$ to $dest$ according to the configured firewall rule $rule$
threat_objects:
    - field: url
      type: url
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1018
    - T1046
    - T1110
    - T1203
    - T1595.002
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

id: '21846.38490'
title: CMD execution with _c
description: 'The cmd.exe /c command is used to execute a specific command and then
  terminate the command prompt (CMD) window and is commonly seen in both legitimate
  and malicious scripted processes. Attackers may use /c after commands to avoid detection.
  -- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon - Software Association: DarkGate, Snatch
  -- Atomics T1036 Test #2 Atomics T1059.003 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "cmd.exe" "/c" | regex process="(?i)cmd(\.exe(\"?))?\s+\/c\s+"
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md#atomic-test-2---malware-masquerading-and-execution-from-zip-file
- https://twitter.com/ffforward/status/1481672378639912960

id: '6088.6537'
title: Command Line lsass request
description: 'The memory of lsass.exe is often dumped for credential theft attacks.
  This use case looks for instances of when lsass.exe has been called by powershell.exe
  or cmd.exe -- Threat Actor Association: Alloy Taurus/Gallium, Cadet Blizzard, Flax
  Typhoon, Redfly, Witchetty - Software Association: Blackcat/ALPHV, Clop, Quantum,
  Vice Society -- Atomics T1003.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(lsass) (TERM(cmd) OR
  TERM(powershell)) | table _time, host, user parent_*, process, process_*, signature_id
  | bin span=5s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping
technique_id: 
- T1003
data_category:
- Windows event logs
references:
- https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1

name: GetDomainGroup with PowerShell Script Block
id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53
version: 13
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-DomainGroup` cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet, part of the PowerView tool, is used to enumerate domain groups within a Windows domain. The detection leverages script block text to identify this specific command. Monitoring this activity is crucial as it may indicate an adversary or Red Team performing reconnaissance to gain situational awareness and map out Active Directory structures. If confirmed malicious, this activity could lead to further exploitation, including privilege escalation and lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `getdomaingroup_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerView functions for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/
finding:
    title: Domain group discovery enumeration using PowerView on $dest$ by $user_id$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Rundll32 Control RunDLL World Writable Directory
id: 1adffe86-10c3-11ec-8ce6-acde48001122
version: 13
creation_date: '2021-09-08'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of rundll32.exe with the `Control_RunDLL` command, loading files from world-writable directories such as windows\temp, programdata, or appdata. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process command-line data and specific directory paths. This activity is significant as it may indicate an attempt to exploit CVE-2021-40444 or similar vulnerabilities, allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, or persistent access within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_control_rundll_world_writable_directory_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed.
references:
    - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
    - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
    - https://attack.mitre.org/techniques/T1218/011/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
    - https://redcanary.com/blog/intelligence-insights-december-2021/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Microsoft MSHTML Remote Code Execution CVE-2021-40444
    - Suspicious Rundll32 Activity
    - Living Off The Land
    - Compromised Windows Host
asset_type: Endpoint
cve:
    - CVE-2021-40444
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
id: c2590137-0b08-4985-9ec5-6ae23d92f63d
version: 23
creation_date: '2019-10-16'
modification_date: '2026-07-20'
author: Steven Dick, Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects changes to the PowerShell ExecutionPolicy in the registry to "Unrestricted" or "Bypass." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications under the path *Software\Microsoft\Powershell\1\ShellIds\Microsoft.PowerShell*. This activity is significant because setting the ExecutionPolicy to these values can allow the execution of potentially malicious scripts without restriction. If confirmed malicious, this could enable an attacker to execute arbitrary code, leading to further compromise of the system and potential escalation of privileges.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass)) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate.
references: []
finding:
    title: A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: registry_path
      type: registry_path
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - HAFNIUM Group
    - Hermetic Wiper
    - Credential Dumping
    - Malicious PowerShell
    - Data Destruction
    - DarkGate Malware
    - SystemBC
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious Copy on System32
id: ce633e56-25b2-11ec-9e76-acde48001122
version: 16
creation_date: '2021-10-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects potentially suspicious file copy operations targeting the
    System32 or SysWow64 directories as source, often indicative of malicious activity.
    It leverages data from Endpoint Detection and Response (EDR) agents,
    focusing on activity initiated by command-line tools like cmd.exe or PowerShell.
    This behavior is significant as it may indicate an attempt to evade defenses by copying
    an existing binary from the system directory and renaming it.
    If confirmed malicious, this activity could allow an attacker to execute
    code undetected and potentially leading to system compromise or further lateral movement
    within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    Processes.parent_process_name IN (
      "cmd.exe",
      "powershell.exe",
      "pwsh.exe",
      "sqlps.exe",
      "sqltoolsps.exe"
    )
    (
      Processes.process_name IN ("copy.exe", "xcopy.exe")
      OR
      Processes.original_file_name IN ("copy.exe", "xcopy.exe")
    )
    Processes.process IN (
      "* \"C:\\Windows\\System32\\*",
      "* \'C:\\Windows\\System32\\*",
      "* C:\\Windows\\System32\\*",
      "* \"C:\\Windows\\SysWow64\\*",
      "* \'C:\\Windows\\SysWow64\\*",
      "* C:\\Windows\\SysWow64\\*"
    )
    by Processes.action Processes.dest Processes.original_file_name
    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
    Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_copy_on_system32_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: Copying files from System directories can happen for multiple admin reasons, allbeit rare without approval. Apply additional filters where needed.
references:
    - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Execution of copy exe to copy file from $process$ on $dest$
        - field: user
          type: user
          score: 20
          message: Execution of copy exe to copy file from $process$ on $dest$
analytic_story:
    - Qakbot
    - Sandworm Tools
    - IcedID
    - Volt Typhoon
    - AsyncRAT
    - Unusual Processes
    - Compromised Windows Host
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1036.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '30388.54457'
title: Suspicious PowerShell Parameter Substring
description: Threat actors may use obfuscated and truncated PowerShell execution arguments
  to evade detection, leveraging PowerShell's parameter binding functionality that
  allows partial matching of command-line arguments. This use case detects process
  executions containing substrings for commonly abused PowerShell parameters.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<" OR Type=Process) ("cmd.exe" OR "pwsh.exe" OR "powershell.exe") ("
  -windowstyl " OR " -windowsty " OR " -windowst " OR " -windows " OR " -windo " OR
  " -wind " OR " -win " OR " -wi") OR (" -executionpolic " OR " -executionpoli " OR
  " -executionpol " OR " -executionpo " OR " -executionp " OR " -execution " OR "
  -executio " OR " -executi " OR " -execut " OR " -execu " OR " -exec " OR " -exe
  " OR " -ex") OR " -NoPr " OR " -NoPro " OR " -NoProf " OR " -NoProfi " OR " -NoProfil
  " OR " -nonin " OR " -nonint " OR " -noninte " OR " -noninter " OR " -nonintera
  " OR " -noninterac " OR " -noninteract " OR " -noninteracti " OR " -noninteractiv
  " OR " -ec " OR " -encodedComman " OR " -encodedComma " OR " -encodedComm " OR "
  -encodedCom " OR " -encodedCo " OR " -encodedC " OR " -encoded " OR " -encode "
  OR " -encod " OR " -enco " OR " -en " OR (" /windowstyle " OR " /windowstyl " OR
  " /windowsty " OR " /windowst " OR " /windows " OR " /windo " OR " /wind " OR "
  /win " OR " /wi") OR (" /executionpolic " OR " /executionpoli " OR " /executionpol
  " OR " /executionpo " OR " /executionp " OR " /execution " OR " /executio " OR "
  /executi " OR " /execut " OR " /execu " OR " /exec " OR " /exe " OR " /ex") OR "
  /NoPr " OR " /NoPro " OR " /NoProf " OR " /NoProfi " OR " /NoProfil " OR " /nonin
  " OR " /nonint " OR " /noninte " OR " /noninter " OR " /nonintera " OR " /noninterac
  " OR " /noninteract " OR " /noninteracti " OR " /noninteractiv " OR " /ec " OR "
  /encodedComman " OR " /encodedComma " OR " /encodedComm " OR " /encodedCom " OR
  " /encodedCo " OR " /encodedC " OR " /encoded " OR " /encode " OR " /encod " OR
  " /enco " OR " /en" | regex process="(?i)\s(-|\/)(win?d?o?w?s?t?y?l?\s+hi?d?d?e?|windowstyle\s+h\s|NoPro?f?i?l?\s|nonint?e?r?a?c?t?i?v?\s|enc?o?d?e?d?C?o?m?m?a?n?\s|((exe?c?u?t?i?o?n?p?o?l?i?c?)|ep)\s+(bypass)?|ec\s)"
  | table _time, host, user user, process, process_*, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml

name: Web Servers Executing Suspicious Processes
id: ec3b7601-689a-4463-94e0-c9f45638efb9
version: 9
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: TTP
description: The following analytic detects the execution of suspicious processes on systems identified as web servers. It leverages the Splunk data model "Endpoint.Processes" to search for specific process names such as "whoami", "ping", "iptables", "wget", "service", and "curl". This activity is significant because these processes are often used by attackers for reconnaissance, persistence, or data exfiltration. If confirmed malicious, this could lead to data theft, deployment of additional malware, or even ransomware attacks. Immediate investigation is required to determine the legitimacy of the activity and mitigate potential threats.
data_source:
    - Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.dest_category="web_server"
        AND
        (Processes.process="*whoami*"
        OR
        Processes.process="*ping*"
        OR
        Processes.process="*iptables*"
        OR
        Processes.process="*wget*"
        OR
        Processes.process="*service*"
        OR
        Processes.process="*curl*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `web_servers_executing_suspicious_processes_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks.
references: []
finding:
    title: Suspicious Processes observed on web server $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious Processes observed on web server $dest$
analytic_story:
    - Apache Struts Vulnerability
asset_type: Web Server
mitre_attack_id:
    - T1082
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Apache Benchmark Binary
id: 894f48ea-8d85-4dcd-9132-c66cdb407c9b
version: 12
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the Apache Benchmark binary (ab.exe), commonly used by MetaSploit payloads. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the original file name is ab.exe. This activity is significant as it may indicate the presence of a MetaSploit attack, which uses Apache Benchmark to generate malicious payloads. If confirmed malicious, this could lead to unauthorized network connections, further system compromise, and potential data exfiltration. Immediate investigation is required to determine the intent and scope of the activity.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.original_file_name=ab.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_apache_benchmark_binary_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as there is a small subset of binaries that contain the original file name of ab.exe. Filter as needed.
references:
    - https://seclists.org/metasploit/2013/q3/13
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A known MetaSploit default payload has been identified on $dest$ ran by $user$, $parent_process_name$ spawning $process_name$.
        - field: dest
          type: system
          score: 20
          message: A known MetaSploit default payload has been identified on $dest$ ran by $user$, $parent_process_name$ spawning $process_name$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - MetaSploit
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AppX Deployment Full Trust Package Installation
id: 8560de46-ea2d-4c69-8ca3-5b78b90f1338
version: 4
creation_date: '2025-08-18'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the installation of MSIX/AppX packages with full trust privileges. This detection leverages Windows event logs from the AppXDeployment-Server, specifically focusing on EventCode 400 which indicates a package deployment operation. Full trust packages are significant as they run with elevated privileges outside the normal AppX container restrictions, allowing them to access system resources that regular AppX packages cannot. Adversaries have been observed leveraging full trust MSIX packages to deliver malware, as documented in recent threat intelligence reports. If confirmed malicious, these packages could allow attackers to execute arbitrary code with elevated privileges, establish persistence, or deliver malware while evading traditional detection mechanisms.
data_source:
    - Windows Event Log AppXDeployment-Server 400
search: |-
    `wineventlog_appxdeploymentserver` EventCode=400 HasFullTrust="true"
      | stats count min(_time) as firstTime max(_time) as lastTime values(PackageFullName) as PackageFullName values(Path) as PackagePath values(PackageSourceUri) as PackageSourceUri values(PackageDisplayName) as PackageDisplayName values(CallingProcess) as CallingProcess values(IsCentennial) as IsCentennial
        BY dvc EventCode HasFullTrust
           user_id
      | rename dvc as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_appx_deployment_full_trust_package_installation_filter`
how_to_implement: To implement this search, you need to configure Windows event log collection for the Microsoft-Windows-AppXDeploymentServer/Operational channel. This can be done through Windows Event Forwarding, Splunk Universal Forwarders, or other log collection methods. Ensure that the log collection method preserves the full XML structure of the events. The sourcetype should be set to XmlWinEventLog or WinEventLog depending on your environment configuration. This detection specifically looks for EventCode 400, which indicates package deployment operations, and filters for packages with full trust privileges.
known_false_positives: Legitimate applications may be deployed as full trust MSIX packages, especially line-of-business applications that require access to system resources. Microsoft Store applications, development tools, and enterprise applications may legitimately use full trust packages. Verify if the package is from a trusted source and signed by a trusted publisher before taking action. Review the package source URI and calling process to determine if the installation is expected in your environment.
references:
    - https://redcanary.com/blog/threat-intelligence/msix-installers/
    - https://redcanary.com/threat-detection-report/techniques/installer-packages/
    - https://learn.microsoft.com/en-us/windows/msix/desktop/desktop-to-uwp-behind-the-scenes
    - https://learn.microsoft.com/en-us/windows/msix/package/package-identity
    - https://attack.mitre.org/techniques/T1553/005/
analytic_story:
    - MSIX Package Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1553.005
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Certutil Root Certificate Addition
id: e9926391-ec0c-4bad-8a95-e450dbf6aae4
version: 6
creation_date: '2022-10-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    The following analytic detects the use of certutil.exe to add a certificate to the Root certificate store using the "-addstore" flag.
    In this case, the certificate is loaded from a temporary file path (e.g., %TEMP%) or other uncommon locations (e.g. C:\\Users\\Public\\), which is highly suspicious and uncommon in legitimate administrative activity.
    This behavior may indicate an adversary is installing a malicious root certificate to intercept HTTPS traffic, impersonate trusted entities, or bypass security controls.
    The use of flags such as -f (force) and -Enterprise, combined with loading .tmp files from user-writable locations, is consistent with post-exploitation activity seen in credential theft and adversary-in-the-middle (AiTM) attacks.
    This should be investigated immediately, especially if correlated with unauthorized privilege use or prior certificate modifications.
    You should monitor when new certificates are added to the root store because this store is what your system uses to decide which websites, apps, and software can be trusted.
    If an attacker manages to add their own certificate there, they can silently intercept encrypted traffic, impersonate trusted websites, or make malicious programs look safe.
    This means they could steal sensitive data, bypass security tools, and keep access to your system even after other malware is removed.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
      max(_time) as lastTime
      values(Processes.process) as process
    from datamodel=Endpoint.Processes where
    `process_certutil`
    Processes.process=*-addstore*
    Processes.process=*root*
    Processes.process IN (
          "*:\\PerfLogs\\*",
          "*:\\Windows\\Temp\\*",
          "*\\AppData\\Local\\Temp\\*",
          "*\\ProgramData\\*",
          "*\\Users\\Public\\*",
          "*%AppData%*",
          "*%Public%*",
          "*%Temp%*",
          "*%tmp%*"
          )
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    |`security_content_ctime(lastTime)`
    | `windows_certutil_root_certificate_addition_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed.
    To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions.
    These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product.
    The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Administrators or third party utilities may use leverage certutil in order to add a root certificate to the store. Filter as needed or restrict to critical assets on the perimeter.
references:
    - https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/
    - https://www.deepinstinct.com/blog/iranian-threat-actor-continues-to-develop-mass-exploitation-tools
    - https://unit42.paloaltonetworks.com/retefe-banking-trojan-targets-sweden-switzerland-and-japan/
finding:
    title: A potentially suspicious certificate was added to the Root certificate store via Certutil on $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Secret Blizzard
asset_type: Endpoint
mitre_attack_id:
    - T1587.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Cmdline Tool Execution From Non-Shell Process
id: 2afa393f-b88d-41b7-9793-623c93a2dfde
version: 13
creation_date: '2021-09-14'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe", "systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe", "hostname.exe", "whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "explorer.exe", "-", "unknown") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed.
references:
    - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
    - https://attack.mitre.org/groups/G0046/
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$.
        - field: user
          type: user
          score: 20
          message: A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - CISA AA22-277A
    - Gozi Malware
    - CISA AA23-347A
    - Qakbot
    - Medusa Ransomware
    - DarkGate Malware
    - Rhysida Ransomware
    - Volt Typhoon
    - FIN7
    - Water Gamayun
    - Tuoni
    - SolarWinds WHD RCE Post Exploitation
    - BlankGrabber Stealer
    - Gh0st RAT
asset_type: Endpoint
mitre_attack_id:
    - T1059.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Domain Account Discovery Via Get-NetComputer
id: a7fbbc4e-4571-424a-b627-6968e1c939e4
version: 12
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the PowerView PowerShell cmdlet Get-NetComputer, which is used to query Active Directory for user account details such as "samaccountname," "accountexpires," "lastlogon," and more. It leverages Event ID 4104 from PowerShell Script Block Logging to identify this activity. This behavior is significant as it may indicate an attempt to gather user account information, which is often a precursor to further malicious actions. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104  ScriptBlockText = "*Get-NetComputer*" ScriptBlockText IN ("*samaccountname*", "*accountexpires*", "*lastlogon*", "*lastlogoff*", "*pwdlastset*", "*logoncount*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_domain_account_discovery_via_get_netcomputer_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Windows Domain Account Discovery Via Get-NetComputer on $dest$.
analytic_story:
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Input Capture Using Credential UI Dll
id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e
version: 9
creation_date: '2022-08-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects a process loading the credui.dll or wincredui.dll module. This detection leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes outside typical system directories. This activity is significant because adversaries often abuse these modules to create fake credential prompts or dump credentials, posing a risk of credential theft. If confirmed malicious, this activity could allow attackers to harvest user credentials, leading to unauthorized access and potential lateral movement within the network.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7  (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll") AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_input_capture_using_credential_ui_dll_filter`'
how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
known_false_positives: this module can be loaded by a third party application. Filter is needed.
references:
    - https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password
analytic_story:
    - Brute Ratel C4
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1056.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint