Splunk rules: 11

name: ASL AWS Detect Users creating keys with encrypt policy without MFA
id: 16ae9076-d1d5-411c-8fdd-457504b33dac
version: 8
creation_date: '2020-10-27'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. It leverages AWS CloudTrail logs from Amazon Security Lake to identify `CreateKey` or `PutKeyPolicy` events where the `kms:Encrypt` action is granted to all principals. This activity is significant as it may indicate a compromised account, allowing an attacker to misuse the encryption key to target other organizations. If confirmed malicious, this could lead to unauthorized data encryption, potentially disrupting operations and compromising sensitive information across multiple entities.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=PutKeyPolicy OR api.operation=CreateKey
      | spath input=api.request.data path=policy output=policy
      | spath input=policy
      | rename Statement{}.Action as Action, Statement{}.Principal as Principal
      | eval Statement=mvzip(Action,Principal,"
      | ")
      | mvexpand Statement
      | eval action=mvindex(split(Statement, "
      | "), 0)
      | eval principal=mvindex(split(Statement, "
      | "), 1)
      | search action=kms*
      | regex principal="\*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region api.request.data
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`
how_to_implement: The detection is based on Cloudtrail events from Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: No false positives have been identified at this time.
references:
    - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
    - https://github.com/d1vious/git-wild-hunt
    - https://www.youtube.com/watch?v=PgzNib37g0M
finding:
    title: AWS account is potentially compromised and user $user$ is trying to compromise other accounts
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Ransomware Cloud
asset_type: AWS Account
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS Lambda UpdateFunctionCode
id: 211b80d3-6340-4345-11ad-212bf3d0d111
version: 9
creation_date: '2022-02-28'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Hunting
description: The following analytic identifies IAM users attempting to update or modify AWS Lambda code via the AWS CLI. It leverages CloudTrail logs to detect successful `UpdateFunctionCode` events initiated by IAM users. This activity is significant as it may indicate an attempt to gain persistence, further access, or plant backdoors within your AWS environment. If confirmed malicious, an attacker could upload and execute malicious code automatically when the Lambda function is triggered, potentially compromising the integrity and security of your AWS infrastructure.
data_source:
    - AWS CloudTrail
search: |-
    `cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode*  errorCode = success  user_type=IAMUser
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_lambda_updatefunctioncode_filter`
how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
references:
    - http://detectioninthe.cloud/execution/modify_lambda_function_code/
    - https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/
analytic_story:
    - Suspicious Cloud User Activities
asset_type: AWS Account
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity
id: 201022d7-a35c-470a-93ff-ae335c42e69d
version: 2
creation_date: '2026-03-12'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Hunting
description: |
    This hunting search is designed to surface source IP activity using uncommon HTTP user-agents across multiple URI paths in Cisco SD-WAN Manager serviceproxy access logs.
    It looks for source and user-agent combinations that access more than one distinct URI, then keeps only low-volume behavior (`requests<=50`) to reduce noise from normal high-volume traffic.
    Use this hunt to pivot on `http_user_agent` and `src` and identify possible automation, scripted reconnaissance, or exploitation attempts.
data_source:
    - Cisco SD-WAN Service Proxy Access Logs
search: |-
    `cisco_sd_wan_service_proxy_access`
    | rex field=_raw "^\[.*?\]\s+\"(?<http_method>\S+)\s+(?<uri>\S+)\s+(?<http_protocol>[^\"]+)\"\s+(?<http_response_code>\S+)\s+(?<response_flags>\S+)\s+(?<bytes_in>\S+)\s+(?<bytes_out>\S+)\s+(?<duration>\S+)\s+(?<upstream_service_time>\S+)\s+\"(?<src>[^\"]+)\"\s+\"(?<http_user_agent>[^\"]+)\"\s+\"(?<x_request_id>[^\"]+)\"\s+\"(?<dest>[^\"]+)\"\s+\"(?<upstream_host>[^\"]+)\""
    | rex field=uri "(?<uri_path>[^\?]+)(?<uri_query>\?.*)?"
    | bin _time span=5m
    | stats count as requests
            min(_time) as firstTime
            max(_time) as lastTime
            values(uri) as uri
            dc(uri) as uri_count
    by src http_user_agent
    | where requests<=50 AND uri_count>1
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | sort 0 +requests
    | `cisco_sd_wan___uncommon_user_agent_multi_uri_activity_filter`
how_to_implement: |
    This detection requires Cisco SD-WAN Manager Envoy access logs to be ingested into Splunk.
    These logs are located in "/var/log/nms/containers/service-proxy/serviceproxy-access.log".
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
    - https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE
analytic_story:
    - Cisco Catalyst SD-WAN Analytics
asset_type: Network
mitre_attack_id:
    - T1595
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Cisco Secure Firewall - Remote Access Software Usage Traffic
id: ac54d39e-a75d-4f42-971d-006db3a0423a
version: 9
creation_date: '2025-05-28'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects network traffic associated with known remote access software applications
    that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
    It leverages Cisco Secure Firewall Threat Defense Connection Event.
    This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
    If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate
    data, or deploy additional malware, posing a severe threat to the organization's security.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    `cisco_secure_firewall` EventType=ConnectionEvent
    | stats min(_time) as firstTime max(_time) as lastTime
          values(dest_port) as dest_port
          values(dest) as dest
          values(transport) as transport
          values(url) as url
          values(rule) as rule
          count by src ClientApplication action
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description
    | search category IN ("remote administration", "remote desktop control")
    | `remote_access_software_usage_exceptions`
    | `cisco_secure_firewall___remote_access_software_usage_traffic_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The access policy must also enable logging.
    The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions"
    that lets you track and maintain device- based exceptions for this set of detections.
known_false_positives: |
    It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Traffic to known remote access software [$ClientApplication$] was detected from $src$.
threat_objects:
    - field: ClientApplication
      type: signature
analytic_story:
    - Insider Threat
    - Command And Control
    - Ransomware
    - Remote Monitoring and Management Software
    - Cisco Secure Firewall Threat Defense Analytics
    - Scattered Spider
    - Interlock Ransomware
    - Scattered Lapsus$ Hunters
asset_type: Network
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure
id: bef92f3f-7dc8-413a-8989-50581039e250
version: 5
creation_date: '2025-07-02'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |
    This detection identifies potential exploitation attempts of CVE-2025-5777 (CitrixBleed 2), a memory disclosure vulnerability in Citrix NetScaler ADC and Gateway.
    The vulnerability is triggered by sending POST requests with incomplete form data to the /p/u/doAuthentication.do endpoint, causing the device to leak memory contents including session tokens and authentication materials.
    This search looks for POST requests to the vulnerable endpoint that may indicate scanning or exploitation attempts.
data_source:
    - Suricata
search: |
    | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where
    Web.url IN ("*/p/u/doAuthentication.do*")
    Web.http_method="POST"
    Web.status=200
    by Web.http_user_agent, Web.status, Web.http_method,
       Web.url, Web.url_length, Web.src, Web.dest, sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `citrix_adc_and_gateway_citrixbleed_2_memory_disclosure_filter`
how_to_implement: |
    To implement this search, ensure that web traffic logs from Citrix NetScaler ADC and Gateway devices are being ingested into Splunk and mapped to the Web data model.
    The logs should include URL paths, HTTP methods, status codes, source and destination IPs, and user agents.
    Look specifically for POST requests to /p/u/doAuthentication.do endpoint which is the primary attack vector for CVE-2025-5777.
known_false_positives: |
    Legitimate authentication flows will trigger this detection as they access the doAuthentication.do endpoint. However, repeated automated requests, especially from HeadlessChrome user agents or with incomplete form data, should be investigated.
    Focus on unusual patterns like multiple rapid requests or non-standard user agents.
references:
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
    - https://www.netscaler.com/blog/news/critical-security-updates-for-netscaler-netscaler-gateway-and-netscaler-console/
    - https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-
    - https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
    - https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
    - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential CitrixBleed 2 (CVE-2025-5777) exploitation from $src$ to $dest$ detected. POST requests to /p/u/doAuthentication.do may indicate memory disclosure vulnerability exploitation.
threat_objects:
    - field: src
      type: system
analytic_story:
    - Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777
asset_type: Web Application
cve:
    - CVE-2025-5777
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527
id: f56936c0-ae6f-4eeb-91ff-ecc1448c6105
version: 9
creation_date: '2024-01-24'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies attempts to exploit a critical template injection vulnerability (CVE-2023-22527) in outdated Confluence Data Center and Server versions. It detects POST requests to the "/template/aui/text-inline.vm" endpoint with HTTP status codes 200 or 202, indicating potential OGNL injection attacks. This activity is significant as it allows unauthenticated attackers to execute arbitrary code remotely. If confirmed malicious, attackers could gain full control over the affected Confluence instance, leading to data breaches, system compromise, and further network infiltration. Immediate patching is essential to mitigate this threat.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url="*/template/aui/text-inline.vm*" Web.http_method=POST Web.status IN (200, 202)
      BY Web.src, Web.dest, Web.http_user_agent,
         Web.url, Web.status
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to confluence servers.
references:
    - https://github.com/cleverg0d/CVE-2023-22527
    - https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html
finding:
    title: Exploitation attempts on a known vulnerability in Atlassian Confluence detected. The source IP is $src$ and the destination hostname is $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Confluence Data Center and Confluence Server Vulnerabilities
asset_type: Web Application
cve:
    - CVE-2023-22527
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Detect AzureHound File Modifications
id: 1c34549e-c31b-11eb-996b-acde48001122
version: 12
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. It leverages data from the Endpoint.Filesystem datamodel, focusing on file creation events with specific filenames. This activity is significant because AzureHound is a tool used to gather information about Azure environments, similar to SharpHound for on-premises Active Directory. If confirmed malicious, this activity could indicate an attacker is collecting sensitive Azure environment data, potentially leading to further exploitation or privilege escalation within the cloud infrastructure.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_azurehound_file_modifications_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
references:
    - https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
    - https://github.com/BloodHoundAD/Legacy-AzureHound.ps1/blob/master/AzureHound.ps1
finding:
    title: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Windows Discovery Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
    - T1069.002
    - T1087.001
    - T1087.002
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Email files written outside of the Outlook directory
id: 8d52cf03-ba25-4101-aa78-07994aed4f74
version: 13
creation_date: '2020-04-29'
modification_date: '2026-07-02'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories.
    It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*".
    This activity is significant as it may indicate data exfiltration or unauthorized access to email data.
    If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count values(Filesystem.file_path) as file_path
            min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Filesystem WHERE

    Filesystem.action IN (
        "created",
        "modified"
    )
    Filesystem.file_name IN (
        "*.pst",
        "*.ost"
    )
    NOT Filesystem.file_path IN (
        "C:\\Users\\*\\My Documents\\Outlook Files\\*",
        "C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*"
    )

    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
       Filesystem.user Filesystem.vendor_product

    | `drop_dm_object_name("Filesystem")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `email_files_written_outside_of_the_outlook_directory_filter`
how_to_implement: To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
known_false_positives: |-
    Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search.
    You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$.
analytic_story:
    - Collection and Staging
asset_type: Endpoint
mitre_attack_id:
    - T1114.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '1040.1061'
title: Executable File Written to Disk
description: 'Detects when a potentially malicious file is written to the disk. -
  Threat Actor Association: Alloy Taurus/Gallium, Andariel, APT28 (aka.Fancy Bear,
  Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, APT34/OilRig, APT37, APT41, Arid Viper/APT C-23, Babuk, Carbanak, Evilnum,
  FIN6, FIN7, FIN8, Gamaredon (aka. Armageddon, UAC-0010), Kimsuky, Lazarus, MalKamak,
  Memento Team, Mustang Panda, Night Spider, TA2541, TA,505, TA551, Prophet Spider,
  Phosphorus/Magic Hound/APT35, SaintBear (aka UAC-0056, UNC2589, TA471), Scatter
  Swine, TA576, Wizard Spider -- Software Association: BadHatch, Bazar, Black Basta,
  BlackByte, Clop, Conti, Cring, Emotet, GhostShell, Hancitor, Harvester, IcedID,
  Lapsus$, MirrorBlast, PYSA/Mespinoza, QakBot, Ransom Cartel, Remcos, Ryuk, SquirrelWaffle,
  TargetCompany, Trickbot, Vidar Stealer, WhisperGate, XingLocker, Yanluowang, Zloader'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
  "<EventID>4656<") (Accesses="*write*" OR Accesses="*add*" OR AccessList="*%%4417*"
  OR AccessList="*%%4418*") (TERM("bat") OR TERM("bin") OR TERM("cmd") OR TERM("com")
  OR TERM("e_e") OR TERM("ex_") OR TERM("exe") OR TERM("hta") OR TERM("jar") OR TERM("js")
  OR TERM("out") OR TERM("plx") OR TERM("ps1") OR TERM("py") OR TERM("pyc") OR TERM("rgs")
  OR TERM("script") OR TERM("sct") OR TERM("server") OR TERM("vb") OR TERM("ws") OR
  TERM("docm") OR TERM("dotm") OR TERM("xlm") OR TERM("xlsm") OR TERM("xltm") OR TERM("xla")
  OR TERM("xlam") OR TERM("xll") OR TERM("otm") OR TERM("pptm") OR TERM("potm") OR
  TERM("ppsm") OR TERM("sldm")) | rename Object_Name as file_path | regex file_path="\.(bat|bin|cmd|com|e_e|ex_|exe|hta|jar|js|out|plx|ps1|py|pyc|rgs|script|sct|server|vb|ws|docm|dotm|xlm|xlsm|xltm|xla|xlam|xll|otm|pptm|potm|ppsm|sldm)$"
  | table _time, host, user, event_id, file_path, process_name, process_path, signature_id,
  tag | bin span=1s | stats values(*) as * by _time, host, file_path '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows event logs
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656

id: '29738.53741'
title: Impacket atexec.py Temp File Creation
description: Impacket's atexec.py is a tool designed for executing commands on a target
  system via the Windows Task Scheduler to run arbitrary commands with the privileges
  of the account under which the scheduler is running, often providing a method for
  remote command execution which can be used by attackers during post-exploitation
  activities. This use case detects the file creation events matching characteristics
  of those created by Impacket atexec.py.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=11) OR "<EventID>11<")
  ("\\Windows\\System32\\Tasks\\" "svchost.exe") OR ("\\Windows\\Temp\\" ".tmp" "cmd.exe")
  | regex file_name="^([a-zA-Z]){8}(\.tmp)?$" | table _time, host, user, file_name,
  file_path, process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:scheduled task/job
- execution:command and scripting interpreter
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
- privilege-escalation:scheduled task/job:scheduled task
- execution:command and scripting interpreter:windows command shell
- defense-evasion:obfuscated files or information
technique_id:
- T1053
- T1059
- T1053.005
- T1059.003
- T1027
data_category:
- Windows Sysmon
references:
- https://u0041.co/blog/post/1
- https://github.com/fortra/impacket/blob/master/examples/atexec.py
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

name: Jscript Execution Using Cscript App
id: 002f1e24-146e-11ec-a470-acde48001122
version: 14
creation_date: '2021-09-14'
modification_date: '2026-08-31'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of JScript using the cscript.exe process.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry.
    This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics.
    If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise.
data_source:
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE
    (
        (
            Processes.parent_process_name = "cscript.exe"
            Processes.parent_process = "*//e:jscript*"
        )
        OR
        (
            Processes.process_name = "cscript.exe"
            Processes.process = "*//e:jscript*"
        )
    )

    NOT Processes.process="*/Job:AgentHIScript*"
    NOT Processes.parent_process="*/Job:AgentHIScript*"

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `jscript_execution_using_cscript_app_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Symantec Host Integrity check uses Jscript through cscript.exe
references:
    - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
    - https://attack.mitre.org/groups/G0046/
    - https://nasbench.medium.com/symantec-endpoint-protection-meets-com-using-symantec-sshelper-as-a-lolbin-40d515a121ce
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The process [$parent_process_name$] with commandline [$parent_process$] launched [$process_name$] with commandline [$process$] on [$dest$]
threat_objects:
    - field: parent_process
      type: process
    - field: process
      type: process
analytic_story:
    - FIN7
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1059.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Microsoft Intune DeviceManagementConfigurationPolicies
id: 3c49e5ed-625c-408c-a2c7-8e2b524efb2c
version: 5
creation_date: '2025-01-06'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: Hunting
description: >-
    Microsoft Intune device management configuration policies are a tool
    administrators can use to remotely manage policies and settings on intune
    managed devices. This functionality can also be abused to disable defences &
    evade detection. This detection identifies when a new device management
    configuration policy has been created.
data_source:
    - Azure Monitor Activity
search: >-
    `azure_monitor_activity` operationName="*
    DeviceManagementConfigurationPolicy*" | rename identity as user,
    properties.TargetObjectIds{} as TargetObjectId,
    properties.TargetDisplayNames{} as TargetDisplayName,
    properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin | eval
    details=mvzip('properties.Targets{}.ModifiedProperties{}.Name','properties.Targets{}.ModifiedProperties{}.New',":
    ") | rex field="operationName" "^(?P<action>\w+)\s" | replace "Patch" with
    "updated", "Create" with "created", "Delete", with "deleted", "assign", with
    "assigned" IN action | eval action=if(match(operationName
    ,"Assignment$"),"assigned",'action') | table _time operationName action user
    user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId details
    status tenantId correlationId |
    `microsoft_intune_devicemanagementconfigurationpolicies_filter`
how_to_implement: >-
    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest
    In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune
    > Tenant administration > Diagnostic settings > Add diagnostic settings & send
    events to the activity audit event hub. Deploy as a risk based alerting rule
    for quick deployment or perform baselining & tune accordingly.
known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
references:
    - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
    - https://securityintelligence.com/x-force/detecting-intune-lateral-movement/
    - https://posts.specterops.io/maestro-9ed71d38d546
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1072
    - T1484
    - T1021.007
    - T1685
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: O365 Multiple AppIDs and UserAgents Authentication Spike
id: 66adc486-224d-45c1-8e4d-9e7eeaba988f
version: 11
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies unusual authentication activity in an O365 environment, where a single user account experiences more than 8 authentication attempts using 3 or more unique application IDs and over 5 unique user agents within a short timeframe. It leverages O365 audit logs, focusing on authentication events and applying statistical thresholds. This behavior is significant as it may indicate an adversary probing for multi-factor authentication weaknesses. If confirmed malicious, it suggests a compromised account, potentially leading to unauthorized access, privilege escalation, and data exfiltration. Early detection is crucial to prevent further exploitation.
data_source:
    - O365 UserLoggedIn
    - O365 UserLoginFailed
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn OR Operation=UserLoginFailed)
      | bucket span=5m _time
      | stats dc(_raw) as failed_attempts dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) values(OS) values(signature) as signature
        BY _time user src
           vendor_account vendor_product dest
      | where failed_attempts > 5 and unique_user_agents > 5 and unique_app_ids > 2
      | `o365_multiple_appids_and_useragents_authentication_spike_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Rapid authentication from the same user using more than 5 different user agents and 3 application IDs is highly unlikely under normal circumstances. However, there are potential scenarios that could lead to false positives.
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/
    - https://github.com/dafthack/MFASweep
    - https://www.youtube.com/watch?v=SK1zgqaAZ2E
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ authenticated in a short period of time with more than 5 different user agents across 3 or more unique application ids.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '45003.90189'
title: PowerShell CreateDecryptor
description: Threat actors may abuse the CreateDecryptor() method within PowerShell
  scripts to dynamically decrypt embedded payloads, configuration files, or sensitive
  data at runtime. CreateDecryptor() is part of legitimate .NET cryptographic operations,
  but its presence in PowerShell ScriptBlock or CommandLine activity — especially
  outside normal application behavior — often signals malware unpacking, fileless
  attacks, or ransomware staging. This use case detects references to CreateDecryptor
  in PowerShell activity, potentially indicating obfuscated payload execution or preparation
  for in-memory attacks.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(powershell) OR TERM(pwsh)) "CreateDecryptor" | regex process="(?i)CreateDecryptor"
  | table _time, host, user process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- defense-evasion:obfuscated files or information
technique_id:
- T1059.001
- T1027
data_category:
- Windows Sysmon
references:
- https://www.cybereason.com/blog/threat-analysis-lummastealer-2.0
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.createdecryptor?view=net-9.0
- https://www.virustotal.com/gui/file/034694376c291c82789e7dc2c8771a4dff47c1c447f2ea7427edb968f480fa71

id: '24501.45205'
title: PuTTY Secure Copy Client Execution
description: pscp.exe is a tool in the PuTTY suite used for secure copy and has been
  used by threat actors including BlackCat and Agrius to exfiltrate data. This use
  case detects executions of pscp.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) OR (TERM(EventCode=5156) OR "<EventID>5156<"))
  "pscp.exe" | table _time, host, user process, process_*, signature_id, parent_*
  | bin span=60s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over alternative protocol
technique_id: 
- T1048
data_category:
- Windows event logs
references:
- https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
- https://www.trendmicro.com/en_us/research/23/f/malvertising-used-as-entry-vector-for-blackcat-actors-also-lever.html

id: '39090.70294'
title: RDP File Executed from Outlook Temp Directory
description: Remote desktop is a common feature in operating systems. It allows a
  user to log into an interactive session with a system desktop graphical user interface
  on a remote system. Targeted spear-phishing campaigns attributed to Russia’s APT29
  have been observed distributing .rdp files to victims to initiate a remote connection.
  This use case detects the execution of .rdp files in the temporary directory that
  Outlook uses when opening attachments.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ".rdp" ("\\AppData\\Local\\Packages\\Microsoft.Outlook_"
  OR ("\\AppData\\Local\\Microsoft\\Windows\\" "\\Content.Outlook\\"))| where match(process,
  "(?i)((\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5c.*\x5cContent\.Outlook\x5c)|(\x5cAppData\x5cLocal\x5cPackages\x5cMicrosoft\.Outlook_)).*\.rdp")
  | table _time, host, user, process_*, process, parent_*, file_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:remote desktop protocol
- initial-access:phishing:spearphishing attachment
technique_id:
- T1021.001
- T1566.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://x.com/cyb3rops/status/1851880158640099675?s=46
- https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
- https://cert.gov.ua/article/6281076
- https://aws.amazon.com/blogs/security/amazon-identified-internet-domains-abused-by-apt29/
- https://github.com/SigmaHQ/sigma/pull/5063/files

id: '19108.32983'
title: Suspicious Child Process for lsass.exe
description: 'This use case detects when the Local Security Authority Subsystem Service
  (lsass.exe) spawns a child process. This can indicate process injection/hollowing,
  masquerading, or other suspicious activity. Normal activity for lsass.exe does not
  typically include spawning child processes, with the exception of EFS (Encrypting
  File System). Atomics T1134.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(lsass) OR "lsass.exe" | regex parent_process_name="(?i)lsass\.exe"
  | table _time, host, user process, process_*, parent_process_name, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading:masquerade task or service
- defense-evasion:process injection
technique_id:
- T1036.004
- T1055
data_category:
- Windows event logs
references:
- https://andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/

name: Suspicious Rundll32 no Command Line Arguments
id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
version: 15
creation_date: '2021-02-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |-
    The following analytic detects the execution of rundll32.exe without any command line arguments.
    This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution logs.
    It is significant because rundll32.exe typically requires command line arguments to function properly, and its absence is often associated with malicious activities, such as those performed by Cobalt Strike.
    If confirmed malicious, this activity could indicate an attempt to execute arbitrary code, potentially leading to credential dumping, unauthorized file writes, or other malicious actions.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    `process_rundll32`
    Processes.process IN ("*rundll32","*rundll32.exe", "*rundll32.exe\"")

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_rundll32_no_command_line_arguments_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
references:
    - https://attack.mitre.org/techniques/T1218/011/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
    - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
    - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
finding:
    title: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$
analytic_story:
    - Suspicious Rundll32 Activity
    - Cobalt Strike
    - BlackByte Ransomware
    - PrintNightmare CVE-2021-34527
    - Graceful Wipe Out Attack
    - Hellcat Ransomware
asset_type: Endpoint
cve:
    - CVE-2021-34527
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious wevtutil Usage
id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f
version: 21
creation_date: '2019-10-16'
modification_date: '2026-08-23'
author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |-
    The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
    This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
    If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    (
        Processes.process_name="wevtutil.exe"
        OR
        Processes.original_file_name="wevtutil.exe"
    )

    Processes.process IN ("* cl *", "*clear-log*")
    Processes.process IN (
        "*/Trace*",
        "*AMSI/Debug*",
        "*Application*",
        "*CiscoSecureEndpoint*",
        "*Microsoft-Windows-BitLocker*",
        "*Microsoft-Windows-Bits*",
        "*Microsoft-Windows-CAPI2*",
        "*Microsoft-Windows-Kernel-File*",
        "*Microsoft-Windows-Kernel-Process*",
        "*Microsoft-Windows-LDAP*",
        "*Microsoft-Windows-PowerShell*",
        "*Microsoft-Windows-Sysmon*",
        "*Microsoft-Windows-TerminalServices-LocalSessionManager*",
        "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*",
        "*Microsoft-Windows-WMI-Activity*",
        "*OpenSSH/*",
        "*PowerShellCore/*",
        "*Security*",
        "*Setup*",
        "*System*",
        "*Windows Firewall With Advanced Security*",
        "*Windows PowerShell*"
    )

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_wevtutil_usage_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
finding:
    title: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$
analytic_story:
    - Windows Log Manipulation
    - Ransomware
    - Rhysida Ransomware
    - Clop Ransomware
    - CISA AA23-347A
    - ShrinkLocker
    - Storm-2460 CLFS Zero Day Exploitation
    - Scattered Spider
    - Storm-0501 Ransomware
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1685.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5995.6369'
title: Windows Firewall Disabled
description: 'Adversaries may disable or windows firewalls in order to bypass controls
  enable adversary C2 communications, lateral movement, and/or data exfiltration that
  would otherwise not be allowed. -- Threat Actor Association: APT41, Muddled Libra
  - Software Association: Agent Tesla, BlackByte, Conti, Insekt, Lockbit, PurpleFox,
  Prometheus / Spook, Ransom Cartel, Trickbot Atomics T1562.004 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4688) (TERM(netsh)
  (TERM(firewall) OR TERM(advfirewall)) TERM(set) (("mode=disable") OR (TERM(state)
  TERM(off)))) OR (TERM(NetFirewallProfile) TERM(-Enabled) TERM(false)) OR ((TERM(sc)
  OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service)) TERM(windows)
  TERM(firewall)) OR ((TERM(REG) OR "reg.exe") TERM(ADD) TERM(FirewallPolicy) TERM(EnableFirewall)
  TERM(0)) | table _time, host, user process, process_*, parent_*, signature_id |
  bin span=1s | stats values(*) as * by _time, host | where match(process_name, "(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe") '
techniques:
- defense-evasion:impair defenses:disable or modify system firewall
technique_id:
- T1562.004
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://us-cert.cisa.gov/sites/default/files/publications/MAR-10135536-G.PDF
- https://blogs.cisco.com/security/talos/opening-zxshell