Splunk rules: 10

name: 3CX Supply Chain Attack Network Indicators
id: 791b727c-deec-4fbe-a732-756131b3c5a1
version: 11
creation_date: '2023-04-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies DNS queries to domains associated with the 3CX supply chain attack. It leverages the Network_Resolution datamodel to detect these suspicious domain indicators. This activity is significant because it can indicate a potential compromise stemming from the 3CX supply chain attack, which is known for distributing malicious software through trusted updates. If confirmed malicious, this activity could allow attackers to establish a foothold in the network, exfiltrate sensitive data, or further propagate malware, leading to extensive damage and data breaches.
data_source:
    - Sysmon EventID 22
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Network_Resolution where
    DNS.query=*
    NOT DNS.query IN ("-", "unknown")
    by DNS.answer DNS.answer_count DNS.query
       DNS.query_count DNS.reply_code_id DNS.src
       DNS.vendor_product
    | `drop_dm_object_name(DNS)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC
    | search isIOC=true
    | `3cx_supply_chain_attack_network_indicators_filter`
how_to_implement: To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed.
known_false_positives: False positives will be present for accessing the 3cx[.]com website. Remove from the lookup as needed.
references:
    - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
    - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
    - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
    - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
    - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
finding:
    title: Indicators related to 3CX supply chain attack have been identified on $src$.
    entity:
        field: src
        type: system
        score: 50
threat_objects:
    - field: query
      type: domain
analytic_story:
    - 3CX Supply Chain Attack
asset_type: Network
cve:
    - CVE-2023-29059
mitre_attack_id:
    - T1195.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Allow Inbound Traffic By Firewall Rule Registry
id: 0a46537c-be02-11eb-92ca-acde48001122
version: 15
creation_date: '2021-05-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects suspicious modifications to firewall rule registry settings that allow inbound traffic on specific ports with a public profile. It leverages data from the Endpoint.Registry data model, focusing on registry paths and values indicative of such changes. This activity is significant as it may indicate an adversary attempting to grant remote access to a machine by modifying firewall rules. If confirmed malicious, this could enable unauthorized remote access, potentially leading to further exploitation, data exfiltration, or lateral movement within the network.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*"  Registry.registry_value_data = "*|LPort=*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
references:
    - https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
finding:
    title: Suspicious firewall allow rule modifications were detected via the registry on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious firewall allow rule modifications were detected via the registry on endpoint $dest$ by user $user$.
analytic_story:
    - Windows Registry Abuse
    - NjRAT
    - PlugX
    - Prohibited Traffic Allowed or Protocol Mismatch
    - Medusa Ransomware
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1021.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ASL AWS EC2 Snapshot Shared Externally
id: 00af8f7f-e004-446b-9bba-2732f717ae27
version: 7
creation_date: '2022-10-04'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects when an EC2 snapshot is shared publicly by analyzing AWS CloudTrail events. This detection method leverages CloudTrail logs to identify modifications in snapshot permissions, specifically when the snapshot is shared outside the originating AWS account. This activity is significant as it may indicate an attempt to exfiltrate sensitive data stored in the snapshot. If confirmed malicious, an attacker could gain unauthorized access to the snapshot's data, potentially leading to data breaches or further exploitation of the compromised information.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=ModifySnapshotAttribute
      | spath input=api.request.data path=createVolumePermission.add.items{}.group output=group
      | search group=all
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region api.request.data
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_ec2_snapshot_shared_externally_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
references:
    - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
    - https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
finding:
    title: AWS EC2 snapshot from user $user$ is shared publicly
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious Cloud Instance Activities
    - Data Exfiltration
asset_type: EC2 Snapshot
mitre_attack_id:
    - T1537
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco NVM - Suspicious Download From File Sharing Website
id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7
version: 7
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects suspicious downloads from common file sharing and content delivery platforms using known living-off-the-land binaries (LOLBins)
    such as 'curl.exe', 'certutil.exe', 'msiexec.exe', 'powershell.exe', 'wmic.exe', and others.
    It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path,
    and parent process information. These tools are often abused by adversaries and malware to retrieve payloads from public hosting platforms
    such as GitHub, Discord CDN, Transfer.sh, or Pastebin.
    This detection helps identify potential initial access, payload staging, or command and control activity using legitimate services.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    (
      (process_name = "svchost.exe" process_arguments = "*-s BITS*")
      OR
      process_name IN (
          "curl.exe", "wmic.exe", "wscript.exe", "cscript.exe", "certutil.exe",
          "msiexec.exe", "hh.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe",
          "installutil.exe", "certoc.exe", "bitsadmin.exe"
      )
    )
    dest_hostname IN (
        "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*",
        "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*",
        "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*",
        "*paste.ee*", "*pastebin.*", "*pastetext.net*", "*privatlab.*",
        "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*",
        "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*",
        "*ufile.io*", "*w3spaces.com*", "*workers.dev*"
      )
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___suspicious_download_from_file_sharing_website_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Some system administrators or development teams may use tools like curl or PowerShell to download files from public services
    for legitimate automation or scripting purposes. However, use of these binaries to contact domains commonly associated with file sharing or temporary hosting
    should be carefully reviewed, as such services are frequently abused by threat actors for malware delivery and staging.
    Tuning by domain allowlisting or internal usage policies is recommended.
references:
    - https://twitter.com/jhencinski/status/1102695118455349248
    - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
    - https://www.virustotal.com/gui/domain/paste.ee/relations
    - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
    - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The host $src$ used $process_path$ to download content from the file-sharing domain $dest_hostname$ over port $dest_port$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - Cisco Network Visibility Module Analytics
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1197
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco Secure Firewall - High Priority Intrusion Classification
id: ec99bb81-c31b-4837-8c7d-1b32aa70b337
version: 7
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs.
    It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as:

    - A Network Trojan was Detected
    - Successful Administrator Privilege Gain
    - Successful User Privilege Gain
    - Attempt to Login By a Default Username and Password
    - Known malware command and control traffic
    - Known malicious file or file based exploit
    - Known client side exploit attempt
    - Large Scale Information Leak"

    These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent
            class_desc IN ("A Network Trojan was Detected", "Successful Administrator Privilege Gain", "Successful User Privilege Gain", "Attempt to Login By a Default Username and Password", "Known malware command and control traffic", "Known malicious file or file based exploit", "Known client side exploit attempt", "Large Scale Information Leak")
    | fillnull
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(signature_id) as signature_id
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            by src, dest, signature, class_desc
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___high_priority_intrusion_classification_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: Some intrusion events that are linked to these classifications might be noisy in certain environments. Apply a combination of filters for specific snort IDs and other indicators.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
finding:
    title: A high priority intrusion event with classification ($class_desc$) was detected from $src$ to $dest$, indicating potential suspicious activity.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1203
    - T1003
    - T1071
    - T1190
    - T1078
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity
id: 7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
version: 7
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk, Talos NTDR
status: production
type: TTP
description: |
    This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events.
    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 61514 (Veeam Backup and Replication credential dump attempt)
    is followed within a 5-minute window by 64795 (Veeam Backup and Replication xp_cmdshell invocation attempt), which detects the use of `xp_cmdshell`, a common post-exploitation technique.
    If confirmed malicious, this behavior is highly indicative of a successful exploitation of CVE-2023-27532, followed by remote command execution or credential dumping.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (61514, 64795)
    | bin _time span=5m
    | fillnull
    | stats dc(signature_id) as unique_signature_count
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(src) as src
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
            by dest
    | where unique_signature_count = 2
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: False positives should be very unlikely.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27532
    - https://www.veeam.com/kb4424
finding:
    title: Exploitation attempt of Veeam CVE-2023-27532 on host $dest$ by $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1190
    - T1210
    - T1059.001
    - T1003.001
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Crowdstrike User Weak Password Policy
id: b49b6ef4-57cd-4d42-bd7e-64e00f11cc87
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects CrowdStrike alerts for weak password policy violations, identifying instances where passwords do not meet the required security standards. These alerts highlight potential vulnerabilities that could be exploited by attackers, emphasizing the need for stronger password practices. Addressing these alerts promptly helps to enhance overall security and protect sensitive information from unauthorized access.
data_source: []
search: |-
    `crowdstrike_identities`  primaryDisplayName != "*admin*"
      | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY domain dn primaryDisplayName
           risk_type severity riskScore
           riskScoreSeverity user role_type
      | where risk_type = "WEAK_PASSWORD_POLICY"
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_user_weak_password_policy_filter`
how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User Weak Password found on $domain$
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect GCP Storage access from a new IP
id: ccc3246a-daa1-11ea-87d0-0242ac130022
version: 8
creation_date: '2020-08-19'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies access to GCP Storage buckets from new or previously unseen remote IP addresses. It leverages GCP Storage bucket-access logs ingested via Cloud Pub/Sub and compares current access events against a lookup table of previously seen IP addresses. This activity is significant as it may indicate unauthorized access or potential reconnaissance by an attacker. If confirmed malicious, this could lead to data exfiltration, unauthorized data manipulation, or further compromise of the GCP environment.
data_source: []
search: |-
    `google_gcp_pubsub_message`
      | multikv
      | rename sc_status_ as status
      | rename cs_object_ as bucket_name
      | rename c_ip_ as remote_ip
      | rename cs_uri_ as request_uri
      | rename cs_method_ as operation
      | search status="\"200\""
      | stats earliest(_time) as firstTime latest(_time) as lastTime
        BY bucket_name remote_ip operation
           request_uri
      | table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri
      | inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip
      | stats min(firstTime) as firstTime, max(lastTime) as lastTime
        BY bucket_name remote_ip operation
           request_uri
      | outputlookup previously_seen_gcp_storage_access_from_remote_ip
      | eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0)
      | where newIP=1
      | eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S")
      | eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S")
      | table  first_time last_time bucket_name remote_ip operation request_uri
      | `detect_gcp_storage_access_from_a_new_ip_filter`
how_to_implement: This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview). In order to capture public GCP Storage Bucket access logs, you must also enable storage bucket logging to your PubSub Topic as per https://cloud.google.com/storage/docs/access-logs.  These logs are deposited into the nominated Storage Bucket on an hourly basis and typically show up by 15 minutes past the hour.  It is recommended to configure any saved searches or correlation searches in Enterprise Security to run on an hourly basis at 30 minutes past the hour (cron definition of 30 * * * *).  A lookup table (previously_seen_gcp_storage_access_from_remote_ip.csv) stores the previously seen access requests, and is used by this search to determine any newly seen IP addresses accessing the Storage Buckets.
known_false_positives: GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past two hours.
references: []
intermediate_findings:
    entities:
        - field: bucket_name
          type: system
          score: 20
          message: GCP Bucket $bucket_name$ accessed from a new IP ($remote_ip$)
threat_objects:
    - field: remote_ip
      type: ip_address
analytic_story:
    - Suspicious GCP Storage Activities
asset_type: GCP Storage Bucket
mitre_attack_id:
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Detect Remote Access Software Usage DNS
id: a16b797d-e309-41bd-8ba0-5067dae2e4be
version: 14
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated promptly.
data_source:
    - Sysmon EventID 22
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Network_Resolution where
    DNS.query=*
    NOT DNS.query IN ("-", "unknown")
    by DNS.answer DNS.answer_count DNS.query
       DNS.query_count DNS.reply_code_id DNS.src
       DNS.vendor_product
    | `drop_dm_object_name("DNS")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup remote_access_software remote_domain AS query OUTPUT isutility, description as signature,
    comment_reference as desc, category
    | eval dest = query
    | search isutility = True
    | `remote_access_software_usage_exceptions`
    | `detect_remote_access_software_usage_dns_filter`
how_to_implement: To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A domain for a known remote access software $query$ was contacted by $src$.
threat_objects:
    - field: query
      type: domain
    - field: signature
      type: signature
analytic_story:
    - Insider Threat
    - Command And Control
    - Ransomware
    - CISA AA24-241A
    - Remote Monitoring and Management Software
    - Scattered Spider
    - Interlock Ransomware
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Detect Spike in blocked Outbound Traffic from your AWS
id: d3fffa37-492f-487b-a35d-c60fcb2acf01
version: 8
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies spikes in blocked outbound network connections originating from within your AWS environment. It leverages VPC Flow Logs data from CloudWatch, focusing on blocked actions from internal IP ranges to external destinations. This detection is significant as it can indicate potential exfiltration attempts or misconfigurations leading to data leakage. If confirmed malicious, such activity could allow attackers to bypass network defenses, leading to unauthorized data transfer or communication with malicious external entities.
data_source: []
search: |-
    `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)  [search  `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)
      | stats count as numberOfBlockedConnections
        BY src_ip
      | inputlookup baseline_blocked_outbound_connections append=t
      | fields - latestCount
      | stats values(*) as *
        BY src_ip
      | rename numberOfBlockedConnections as latestCount
      | eval newAvgBlockedConnections=avgBlockedConnections + (latestCount-avgBlockedConnections)/720
      | eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections, 2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720))
      | eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections), stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
      | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections
      | outputlookup baseline_blocked_outbound_connections
      | eval dataPointThreshold = 5, deviationThreshold = 3
      | eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections) AND numDataPoints > dataPointThreshold, 1, 0)
      | where isSpike=1
      | table src_ip]
      | stats values(dest_ip) as dest_ip, values(interface_id) as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections
        BY src_ip
      | `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter`
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the number of data points required to meet the definition of "spike." The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Blocked Outbound Connection" support search once to create a history of previously seen blocked outbound connections.
known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Additionally, false positives may result when AWS administrators roll out policies enforcing network blocks, causing sudden increases in the number of blocked outbound connections.
references: []
intermediate_findings:
    entities:
        - field: src_ip
          type: system
          score: 20
          message: Blocked $numberOfBlockedConnections$ outbound connections from your AWS VPC $src_ip$
analytic_story:
    - AWS Network ACL Activity
    - Suspicious AWS Traffic
    - Command And Control
asset_type: AWS Instance
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network
baselines:
    - Baseline of blocked outbound traffic from AWS

id: '6003.18227'
title: Dump File Identified
description: 'Adversaries may attempt to dump credentials to obtain account login
  and credential material, normally in the form of a hash or a clear text password,
  from the operating system and software. This use case looks command line arguments
  that include a ".dmp" file, which may indicate a dump has teken place or that a
  dmp file is being analyzed locally. -- Threat Actor Association: Cadet Blizzard,
  Redfly - Software Association: Akira, Black Basta, LockBit, Quantum, Rhysida, Vice
  Society'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  TERM(dmp)| regex process="(?i)\.dmp" | table _time, host, user parent_*, process,
  process_*, signature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping
technique_id: 
- T1003
data_category:
- Windows Sysmon
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass

id: '1125.1203'
title: File Execution (Unix)
description: 'Detect when a file has been executed -- Threat Actor Association: TeamTNT,
  Winnti Group - Software Association: Mélofée, Ransom Cartel -- Atomics T1548.003
  Test#1 Atomics T1548.003 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=execve OR type=proctitle
  OR sourcetype=bash_history) AND ("./" OR "/") AND NOT ("/usr/bin/" OR "/bin/" OR
  "/sbin/" OR "/usr/libexec/") | rex field=_raw "(?i)proctitle\=(?<command_type>\.\/.+)"|
  eval process=mvappend(process, command_type)| regex process="^(\.)?\/.+" | table
  _time, host, user process | bin span=300s | stats values(*) as * by _time, host,process
  | eventstats dc(host) as dc_host, c(process) as c_process by process| where dc_host=1
  and c_process<3 '
techniques:
- execution:command and scripting interpreter:unix shell
technique_id:
- T1059.004
data_category:
- Process command-line parameters
- Linux audit logs
references: null

name: Get WMIObject Group Discovery with Script Block Logging
id: 69df7f7c-155d-11ec-a055-acde48001122
version: 11
creation_date: '2021-09-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `Get-WMIObject Win32_Group` command using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, allowing for detailed analysis. Identifying group information on an endpoint is not inherently malicious but can be suspicious based on context such as time, endpoint, and user. This activity is significant as it may indicate reconnaissance efforts by an attacker. If confirmed malicious, it could lead to further enumeration and potential lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText = "*Win32_Group*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `get_wmiobject_group_discovery_with_script_block_logging_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives may be present. Tune as needed.
references:
    - https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kubernetes Pod With Host Network Attachment
id: cce357cf-43a4-494a-814b-67cea90fe990
version: 10
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation or update of a Kubernetes pod with host network attachment. It leverages Kubernetes Audit logs to identify pods configured with host network settings. This activity is significant for a SOC as it could allow an attacker to monitor all network traffic on the node, potentially capturing sensitive information and escalating privileges. If confirmed malicious, this could lead to unauthorized access, data breaches, and service disruptions, severely impacting the security and integrity of the Kubernetes environment.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` objectRef.resource=pods verb=create OR verb=update requestObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration=*\"hostNetwork\":true*
      | fillnull
      | stats count values(user.groups{}) as user_groups
        BY kind objectRef.name objectRef.namespace
           objectRef.resource requestObject.kind responseStatus.code
           sourceIPs{} stage user.username
           userAgent verb requestObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_pod_with_host_network_attachment_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Kubernetes pod with host network attachment from user $user$.
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '28360.51606'
title: 'Potential CVE-2024-21413: Outbound SMB from Outlook'
description: A critical vulnerability CVE-2024-21413 in Microsoft Outlook, discovered
  by Check Point, enables remote code execution from merely opening an email containing
  malicious links, bypassing Outlook's Protected View. This flaw, exploitable without
  user interaction, allows attackers to perform high-privilege actions and steal NTLM
  credentials via crafted Office documents. This use case detects outbound SMB connections
  from Outlook which may indicate successful CVE-2024-21413 execution.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=3 OR "<EventID>3<")
  (TERM(445) OR TERM(SMB)) "outlook.exe" | where match(dest_port, "^445$") and match(process_name,
  "(?i)outlook\.exe") and not match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|fc00:|fd00:|fe80:)")
  | table _time, host, user, dest_ip, dest_port, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:user execution:malicious link
technique_id:
- T1204.001
data_category:
- Windows Sysmon
- Process use of network
references:
- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/

id: '20217.35908'
title: Potential fodhelper UAC Bypass Attempt
description: 'Adversaries may bypass UAC mechanisms to elevate process privileges
  on system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. This use case detects
  the creation of registry keys associated with known methods of using fodhelper to
  bypass UAC. Atomic Test #3: T1548.002'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  OR TERM(EventCode=12) OR "<EventID>12<" OR (EventCode=13) OR "<EventID>13<") "ms-settings"
  "shell" | regex process="(?i)ms-settings\x5cshell\x5copen\x5ccommand.+" | table
  _time, host, user, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
- defense-evasion:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://blog.sygnia.co/breaking-down-casbaneiro-infection-chain-part2?_ga=2.66949422.1638613298.1690290265-1923873697.1682517767
- https://gist.github.com/netbiosX/a114f8822eb20b115e33db55deee6692

id: '9118.12340'
title: Potential Lateral Movement via SMB
description: 'Adversaries, typically, start moving laterally once they get initial
  foothold in the victim organization. Once they get initial access, they escalate
  their privileges and move laterally with the escalated privileges either to propagate
  their malware or to further reconnaissance & collect the targeted information. There
  are many techniques by which threat actors move laterally, this use case focuses
  solely on detecting potential anomalous SMB Traffic. - Threat Actor Association:
  Earth Estries, FIN8 (Syssphinx), Lancefly, Lazarus - Software Association: ALPHV/BlackCat,
  Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=5156 OR "Event>ID>5156<")
  (TERM(445) OR TERM(SMB)) | search dest_port="445" src_ip IN(10.0.0.0/8, 127.0.0.0/8,
  169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1",
  "FE80::/10", "FF00::/8") dest_ip IN(10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12,
  192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1", "FE80::/10", "FF00::/8") |
  table _time, host, user dest, direction, event_id, eventtype, parent_*, process,
  process_*, user, user_id, src_*, dest_* | bin span=1s | stats values(*) as * by
  _time, host | eventstats dc(dest_ip) as dc_dest by src_ip | eventstats dc(src_ip)
  as dc_src by dest_ip | eventstats dc(host) as dc_host by process_path| where (dc_dest
  < 5 AND dc_src < 5) OR dc_host < 3 OR match(process_path, "(?i)(powershell|cmd)") '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
- Process use of network
references:
- https://imphash.medium.com/detecting-lateral-movement-101-tracking-movement-smb-windows-admin-shares-through-windows-log-6005e3ba6980
- https://www.ired.team/offensive-security/lateral-movement/lateral-movement-via-smb-relaying-by-abusing-lack-of-smb-signing

id: '24645.45567'
title: Potential Proxy Malware via AutoRun Key
description: The Windows Registry Run keys can be abused to establish persistence
  for malware known as SystemBC (aka Coroxy or DroxiDat), which functions as a proxy,
  bot, backdoor, and RAT. Threat actors utilize this method to maintain continuous
  access to a compromised system, enabling them to gather information, execute commands,
  and deploy additional malware. SystemBC has been observed modifying AutoRun keys
  with a value of socks5. This use case detects modifications to registry keys containing
  the path \SOFTWARE\Microsoft\Windows\CurrentVersion\Run including the value "socks5".
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "socks5"
  | table _time, host, user signature_id, process, process_*, user, parent_process_path
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
- T1547.001
data_category:
- PowerShell logs
references:
- https://rexorvc0.com/2023/11/12/Swiss-Knife-SystemBC-Coroxy/

id: '1082.1121'
title: Powershell DLL_EXE Injection
description: 'DLL injection simply refers to the (forced) injection of a DLL into
  the space of another process and then execution of its code.What makes Reflective
  DLL Injection different? The DLL injection code and the source of the DLL are obtained
  via its full path on disk. Because of this, it is not considered a very stealthy
  approach and also has an external dependency which may be problematic should it
  ever be separated. These issues can be addressed by using Reflective DLL Injection
  which allows the sourcing of the DLL in the form of its raw data. Threat Actor Association:
  Carbanak, TA2541, TA551 Software Association: IcedID'
logic_format: Splunk
logic: '`get_endpoint_data``get_endpoint_data_powershell` TERM(EventCode=4104) ("VirtualAlloc"
  OR "VirtualAllocEx" OR "WriteProcessMemory" OR "CreateRemoteThread" OR "VirtualFree"
  OR "CreateThread" OR "System.Diagnostics.Process") | rex field=_raw (?<Keywords_1>"(?i)VirtualAlloc(Ex)?")|
  rex field=_raw (?<Keywords_2>"(?i)WriteProcessMemory")| rex field=_raw (?<Keywords_3>"(?i)CreateRemoteThread")|
  rex field=_raw (?<Keywords_4>"(?i)VirtualFree")| rex field=_raw (?<Keywords_5>"(?i)CreateThread")|
  rex field=Message max_match=5 "(?i)System\.Diagnostics\.Process\s+\W?(?<injected_process>((\w+\-){1,})?\w+)"|
  rex field=_raw max_match=0 (?<script>"(?i)((\w+\-){1,})?\w+\.ps1")| eval keywords=mvappend(Keywords_1,
  Keywords_2, Keywords_3, Keywords_4, Keywords_5)| table _time, host, user event_id,
  keywords, process, process_*, signature_id, user, user_id, script, injected_process
  | bin span=15s | stats values(*) as * by _time, host |where (match(process, "(?i)VirtualAlloc(Ex)?")
  AND match(process, "(?i)WriteProcessMemory|virtualfree") AND match(process, "(?i)CreateRemoteThread|Createthread")) '
techniques:
- privilege-escalation:process injection:dynamic-link library injection
technique_id:
- T1055.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://attack.mitre.org/techniques/T1055/001/