Splunk rules: 13

id: '6446.7204'
title: Additional dll added to Spool Driver
description: 'This use case look for an additional dll to the print drivers as seen
  with Print Nightmare CVE-2021-1675. -- Threat Actor Association: Earth Lusca, Vice
  Society - Software Association: Black Basta, Play, Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=11 OR "<EventID>11<"
  OR "<EventID>23<" OR EventCode=23) "spoolsv.exe" "dll") | regex TargetFilename="\QC:\Windows\System32\spool\drivers\x64\E"
  | table _time, host, user, signature_id, process, process_*, parent_* | bin span=5s
  | stats values(*) as * by _time, host, process_path | where match(signature_id,
  "11") and match(signature_id, "23") '
techniques:
- persistence:boot or logon autostart execution
technique_id: 
- T1547
data_category:
- Windows Sysmon
references:
- https://github.com/cube0x0/CVE-2021-1675

id: '30662.54791'
title: ADExplorer Execution
description: Active Directory Explorer (AD Explorer) is a tool from the Sysinternals
  suite that allows users to view, search, and analyze objects within Active Directory
  to understand its structure, object properties, and security settings. A threat
  actor might leverage AD Explorer to gain detailed insights into the AD environment,
  such as identifying privileged user accounts and network resources, which can be
  exploited to escalate privileges or facilitate lateral movement within a network.
  This use case detects executions of ADExplorer .
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process OR TERM(EventCode=4648) OR "<EventID>4648<") "ADExplorer64.exe"
  OR "ADExplorer.exe" OR "ADExplorer" OR "AdExp" | regex process_name="(?i)ADExplorer(64)?|AdExp\.exe"
  | table _time, host, user, parent_process_name, process, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
- T1003.003
data_category:
- Windows event logs
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer

name: AWS Password Policy Changes
id: aee4a575-7064-4e60-b511-246f9baf9895
version: 8
creation_date: '2023-01-26'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Hunting
description: The following analytic detects successful API calls to view, update, or delete the password policy in an AWS organization. It leverages AWS CloudTrail logs to identify events such as "UpdateAccountPasswordPolicy," "GetAccountPasswordPolicy," and "DeleteAccountPasswordPolicy." This activity is significant because it is uncommon for regular users to perform these actions, and such changes can indicate an adversary attempting to understand or weaken password defenses. If confirmed malicious, this could lead to compromised accounts and increased attack surface, potentially allowing unauthorized access and control over AWS resources.
data_source:
    - AWS CloudTrail UpdateAccountPasswordPolicy
    - AWS CloudTrail GetAccountPasswordPolicy
    - AWS CloudTrail DeleteAccountPasswordPolicy
search: |-
    `cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_password_policy_changes_filter`
how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event.
references:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html
analytic_story:
    - AWS IAM Privilege Escalation
    - Compromised User Account
asset_type: AWS Account
mitre_attack_id:
    - T1201
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '27651.50275'
title: Browser Credential File Accessed - Windows
description: 'Threat actors may attempt to access stored credentials from files stored
  web browsers installed on a host. This use case detects when files containing browser
  credentials are accessed from a process outside of the standard Windows system paths. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
  "<EventID>4656<" OR TERM(EventCode=4663) OR "<EventID>4663<") "\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat"
  OR "\\cookies.sqlite" OR "release\\key3.db" OR "release\\key4.db" OR "release\\logins.json"
  OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies" OR "\\Appdata\\Local\\Chrome\\User
  Data\\Default\\Login Data" OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Local
  State" | regex parent_process_name!="(?i)msiexec\.exe|^idle$"| regex user!="\$$"|
  regex process_path!="(?i)^C:\x5cWindows\x5c(system32|syswow64)\x5c|C:\x5cProgram\sFiles(\s\(x86\))?\x5c|C:\x5cProgramData\x5cMicrosoft\x5cWindows\xDefender\x5c"|
  table _time, host, user, process_name, parent_process_name, ObjectName | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:credentials from password stores:credentials from web browsers
- credential-access:os credential dumping
technique_id:
- T1555.003
- T1003
data_category:
- Windows event logs
references:
- https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/file/file_access/file_access_win_browser_credential_stealing.yml

name: Cisco TFTP Server Configuration for Data Exfiltration
id: 1abce487-f480-4d5f-a551-01de0bece0bd
version: 5
creation_date: '2025-08-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: TTP
description: This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
data_source:
    - Cisco IOS Logs
search: |-
    | tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
      WHERE (
            All_Changes.command="*tftp-server*"
        )
        AND ( All_Changes.command="*nvram:startup-config*" OR All_Changes.command="*bootflash:running-config*" OR All_Changes.command="*system:running-config*" OR All_Changes.command="*bootflash:info*" OR All_Changes.command="*startup-config*" OR All_Changes.command="*running-config*" )
      BY All_Changes.dvc All_Changes.user
    | `drop_dm_object_name("All_Changes")`
    | rename dvc as dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_tftp_server_configuration_for_data_exfiltration_filter`
how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel. Ensure that your Cisco IOS devices are configured to send logs to your Splunk environment, with appropriate logging levels enabled to capture command logging events (PARSER-5-CFGLOG_LOGGEDCMD). Configure command logging on Cisco IOS devices using the "archive log config logging enable" command.
known_false_positives: Legitimate TFTP server configurations may be detected by this analytic during authorized backup operations or device maintenance. Network administrators sometimes use TFTP for legitimate configuration backups, firmware updates, or during troubleshooting. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames and scheduled maintenance windows.
references:
    - https://blog.talosintelligence.com/static-tundra/
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
    - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/T_through_X.html#wp3081407060
finding:
    title: Suspicious TFTP server configuration detected on Cisco device $dest$ by user $user$, potentially exposing sensitive configuration files
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious TFTP server configuration detected on Cisco device $dest$ by user $user$, potentially exposing sensitive configuration files
threat_objects:
    - field: command
      type: command
analytic_story:
    - Cisco Smart Install Remote Code Execution CVE-2018-0171
asset_type: Network
cve:
    - CVE-2018-0171
mitre_attack_id:
    - T1567
    - T1005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: ConnectWise ScreenConnect Path Traversal
id: 56a3ac65-e747-41f7-b014-dff7423c1dda
version: 9
creation_date: '2024-02-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability, which allows path traversal attacks by manipulating file_path and file_name parameters in the URL. It leverages the Endpoint datamodel Filesystem node to identify suspicious file system events, specifically targeting paths and filenames associated with ScreenConnect. This activity is significant as it can lead to unauthorized access to sensitive files and directories, potentially resulting in data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access and control over the host system, posing a severe security risk.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\ScreenConnect\\App_Extensions\\*") Filesystem.file_name IN ("*.aspx","*.ashx") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_path_traversal_filter`'
how_to_implement: This analytic utilizes the Endpoint datamodel Filesystem node to identify path traversal attempts against ScreenConnect. Note that using SACL auditing or other file system monitoring tools may also be used to detect path traversal attempts. Typically the data for this analytic will come from EDR or other properly CIM mapped data sources.
known_false_positives: False positives are not expected, as the detection is based on the presence of file system events that indicate path traversal attempts. The analytic may be modified to look for any file writes to this path as it is not common for files to write here.
references:
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
    - https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
finding:
    title: A path traversal attack against ScreenConnect has been detected on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ConnectWise ScreenConnect Vulnerabilities
    - Seashell Blizzard
asset_type: Endpoint
cve:
    - CVE-2024-1708
    - CVE-2024-1709
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect ARP Poisoning
id: b44bebd6-bd39-467b-9321-73971bcd1aac
version: 11
creation_date: '2020-08-11'
modification_date: '2026-05-13'
author: Mikael Bjerkeland, Splunk
status: experimental
type: TTP
description: The following analytic detects ARP Poisoning attacks by monitoring for Dynamic ARP Inspection (DAI) errors on Cisco network devices. It leverages logs from Cisco devices, specifically looking for events where the ARP inspection feature has disabled an interface due to suspicious activity. This activity is significant because ARP Poisoning can allow attackers to intercept, modify, or disrupt network traffic, leading to potential data breaches or denial of service. If confirmed malicious, this could enable attackers to perform man-in-the-middle attacks, compromising the integrity and confidentiality of network communications.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection"
      | eval src_interface=src_int_prefix_long+src_int_suffix
      | stats min(_time) AS firstTime max(_time) AS lastTime count
        BY host src_interface
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_arp_poisoning_filter`
how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and Dynamic ARP Inspection (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
known_false_positives: This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely).
references: []
finding:
    title: Potential ARP poisoning detected on $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Router and Infrastructure Security
asset_type: Infrastructure
mitre_attack_id:
    - T1200
    - T1498
    - T1557.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Detect Regsvr32 Application Control Bypass
id: 070e9b80-6252-11eb-ae93-0242ac130002
version: 15
creation_date: '2021-01-29'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the abuse of Regsvr32.exe to proxy execution of malicious code, specifically detecting the loading of "scrobj.dll" by Regsvr32.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line executions. This activity is significant because Regsvr32.exe is a trusted, signed Microsoft binary, often used in "Squiblydoo" attacks to bypass application control mechanisms. If confirmed malicious, this technique could allow an attacker to execute arbitrary code, potentially leading to system compromise and persistent access.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_regsvr32` Processes.process=*scrobj*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_regsvr32_application_control_bypass_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives related to third party software registering .DLL's.
references:
    - https://attack.mitre.org/techniques/T1218/010/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
    - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
    - https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Living Off The Land
    - Suspicious Regsvr32 Activity
    - Graceful Wipe Out Attack
    - Cobalt Strike
    - Compromised Windows Host
    - BlackByte Ransomware
    - PHP-CGI RCE Attack on Japanese Organizations
asset_type: Endpoint
mitre_attack_id:
    - T1218.010
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '29739.53744'
title: Impacket atexec.py  Execution
description: Impacket's atexec.py is a tool designed for executing commands on a target
  system via the Windows Task Scheduler to run arbitrary commands with the privileges
  of the account under which the scheduler is running, often providing a method for
  remote command execution which can be used by attackers during post-exploitation
  activities. This use case process creation events matching characteristics of Impacket
  atexec.py executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("cmd.exe" OR "powershell.exe" OR "pwsh.exe")
  " /c " "\\Windows\\Temp" ("2&gt;&amp;1" OR "2&>1") | regex process="(?i)Temp\x5c[A-Za-z]{8}\.tmp"
  | table _time, host, user, process, parent_process_name, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:scheduled task/job
- execution:command and scripting interpreter
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
- privilege-escalation:scheduled task/job:scheduled task
- execution:command and scripting interpreter:windows command shell
- defense-evasion:obfuscated files or information
technique_id:
- T1053
- T1059
- T1053.005
- T1059.003
- T1027
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://u0041.co/blog/post/1
- https://github.com/fortra/impacket/blob/master/examples/atexec.py
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

name: Kubernetes Unauthorized Access
id: 9b5f1832-e8b9-453f-93df-07a3d6a72a45
version: 10
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects unauthorized access attempts to Kubernetes by analyzing Kubernetes audit logs. It identifies anomalies in access patterns by examining the source of requests and their response statuses. This activity is significant for a SOC as it may indicate an attacker attempting to infiltrate the Kubernetes environment. If confirmed malicious, such access could lead to unauthorized control over Kubernetes resources, potentially compromising sensitive systems or data within the cluster.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` verb=create responseStatus.reason=Forbidden
      | fillnull
      | stats count
        BY objectRef.namespace objectRef.resource requestReceivedTimestamp
           requestURI responseStatus.code responseStatus.message
           sourceIPs{} stage user.groups{}
           user.uid user.username userAgent
           verb
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_unauthorized_access_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Unauthorized access to Kubernetes from user $user$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Ghostscript Exploitation
id: 580f99d8-a4c8-4ef1-9c84-f355867bca41
version: 2
creation_date: '2026-07-08'
modification_date: '2026-09-01'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects exploitation of Ghostscript causing command execution.
    This can be used by attackers to abuse file conversion services or embedded LibreOffice documents.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.parent_process_path IN (
        "*/gs",
        "*/ghostscript"
    )
    Processes.process="*sh -c*"

    by Processes.process Processes.vendor_product Processes.user_id
       Processes.process_hash Processes.parent_process_name
       Processes.parent_process_exec Processes.action Processes.dest
       Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name
       Processes.parent_process Processes.parent_process_path
       Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user
       Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_ghostscript_exploitation_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate use of Ghostscript for document processing or file conversion tasks may trigger this rule. Filter based on known authorized applications that rely on Ghostscript for routine document handling.
references:
    - https://www.bleepingcomputer.com/news/security/rce-bug-in-widely-used-ghostscript-library-now-exploited-in-attacks/
    - https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/
finding:
    title: Linux Ghostscript exploitation identified via [$process$] by [$user$] on [$dest$]
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Post-Exploitation
    - Unusual Processes
    - Suspicious Command-Line Executions
    - Linux Living Off The Land
asset_type: Endpoint
cve:
    - CVE-2024-29510
mitre_attack_id:
    - T1204.002
    - T1566
    - T1059
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MOVEit Certificate Store Access Failure
id: d61292d5-46e4-49ea-b23b-8049ea70b525
version: 6
creation_date: '2024-07-24'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: This detection identifies potential exploitation attempts of the CVE-2024-5806 vulnerability in Progress MOVEit Transfer. It looks for log entries indicating failures to access the certificate store, which can occur when an attacker attempts to exploit the authentication bypass vulnerability. This behavior is a key indicator of attempts to impersonate valid users without proper credentials. While certificate store access failures can occur during normal operations, an unusual increase in such events, especially from unexpected sources, may indicate malicious activity.
data_source: []
search: |-
    `moveit_sftp_logs` "IpWorksKeyService: Caught exception of type IPWorksSSHException: The certificate store could not be opened"
      | stats count
        BY source _raw
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `moveit_certificate_store_access_failure_filter`
how_to_implement: The MOVEit logs must be collected in Splunk. Currently, there is no TA available for MOVEit. Modify the analytic as needed to match the log format of your environment.
known_false_positives: False positives may occur, therefore utilize the analytic as a jump off point to identifiy potential certificate store errors.
references:
    - https://labs.watchtowr.com/auth-bypass-in-un-limited-scenarios-progress-moveit-transfer-cve-2024-5806/
analytic_story:
    - MOVEit Transfer Authentication Bypass
asset_type: Web Server
cve:
    - CVE-2024-5806
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Msmpeng Application DLL Side Loading
id: 8bb3f280-dd9b-11eb-84d5-acde48001122
version: 13
creation_date: '2021-07-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Sanjay Govind
status: production
type: TTP
description: The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. It leverages the Endpoint.Filesystem datamodel to identify instances where these files are created outside their expected directories. This activity is significant because it is associated with the REvil ransomware, which uses DLL side-loading to execute malicious payloads. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system compromise, and potential data loss or extortion.
data_source:
    - Sysmon EventID 11
search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND NOT (Filesystem.file_path IN ("*\\Program Files\\windows defender\\*","*\\WinSxS\\*defender-service*","*\\WinSxS\\Temp\\*defender-service*")) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: quite minimal false positive expected.
references:
    - https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers
finding:
    title: Suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder on host - $dest$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Ransomware
    - Revil Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 Multiple Failed MFA Requests For User
id: fd22124e-dbac-4744-a8ce-be10d8ec3e26
version: 12
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies potential "MFA fatigue" attacks targeting Office 365 users by detecting more than nine Multi-Factor Authentication (MFA) prompts within a 10-minute timeframe. It leverages O365 management activity logs, focusing on Azure Active Directory events with the UserLoginFailed operation, a Success ResultStatus, and an ErrorNumber of 500121. This activity is significant as attackers may exploit MFA fatigue to gain unauthorized access by overwhelming users with repeated MFA requests. If confirmed malicious, this could lead to data breaches, unauthorized data access, or further compromise within the O365 environment. Immediate investigation is crucial.
data_source:
    - O365 UserLoginFailed
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ResultStatus=Success ErrorNumber=500121
      | bucket span=10m _time
      | stats dc(_raw) as mfa_prompts values(LogonError) as LogonError values(signature) as signature values(action) as action values(src) as src
        BY user _time vendor_account
           vendor_product dest
      | where mfa_prompts > 9
      | `o365_multiple_failed_mfa_requests_for_user_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1621/
finding:
    title: Multiple failed MFA requestes for $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: O365 Tenant
mitre_attack_id:
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Process Deleting Its Process File Path
id: f7eda4bc-871c-11eb-b110-acde48001122
version: 11
creation_date: '2021-03-19'
modification_date: '2026-05-13'
author: Teoderick Contreras
status: production
type: TTP
description: The following analytic identifies a process attempting to delete its own file path, a behavior often associated with defense evasion techniques. This detection leverages Sysmon EventCode 1 logs, focusing on command lines executed via cmd.exe that include deletion commands. This activity is significant as it may indicate malware, such as Clop ransomware, trying to evade detection by removing its executable file if certain conditions are met. If confirmed malicious, this could allow the attacker to persist undetected, complicating incident response and remediation efforts.
data_source:
    - Sysmon EventID 1
search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" | eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product result | where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
    - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
finding:
    title: A process $process_name$ tries to delete its process path in commandline $process$ as part of defense evasion in host $dest$ by user $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A process $process_name$ tries to delete its process path in commandline $process$ as part of defense evasion in host $dest$ by user $user$
analytic_story:
    - Clop Ransomware
    - Data Destruction
    - WhisperGate
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1070
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '9037.12149'
title: RDP Connection
description: 'This use case looks for when an RDP network connection has been established.
  -- Threat Actor Association: Agrius, APT35/Phosphorus/Magic Hound, Daixin Team,
  Flax Typhoon, Karakurt, Lapsus$, Muddled Libra, Scattered Spider (aka. 0ktapus,
  UNC3944), UNC5221, UTA0178 - Software Association: Akira, AvosLocker, BianLian,
  Blackcat/ALPHV, BlackByte, Lockbit, LV, Play, Quantum, Ransom Cartel, Rhysida, Royal,
  Snatch, Trigona'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=5156 OR "Event>ID>5156<")
  (TERM(3389) OR TERM(RDP)) | table _time, host, user dest, direction, event_id, eventtype,
  parent_*, process, process_*, user, user_id, src_*, dest_* | bin span=1s | stats
  values(*) as * by _time, host | where match(dest_port, "(?i)3389|rdp") or match(src_port,
  "(?i)3389|rdp") '
techniques:
- lateral-movement:remote services:remote desktop protocol
- initial-access:external remote services
technique_id:
- T1021.001
- T1133
data_category:
- Windows event logs
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

id: '26999.49288'
title: rundll32 with No DLL in Command Line
description: rundll32.exe is a legitimate Windows utility used to run functions stored
  in Dynamic Link Libraries. Typical usage would involve specifying a DLL file and
  a function to execute. Because rundll32 is a trusted system utility with the ability
  to execute code, it is a high value target for abuse by threat actors. This use
  case detects executions of rundll32.exe without a .dll referenced in the command
  line. Benign false positives from Internet Explorer parent processes have been filtered
  out. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(rundll32) OR "rundll32.exe" | where (match(process_name,
  "(?i)rundll32\.exe") and not match(process, "(?i)(^\"C:\x5cWindows\x5csystem32\x5crundll32\.exe\"$)|(\.dll)"))
  and (not match(parent_process_name, "(?i)iexplore\.exe") and not match(process,
  "(?i)InetCpl\.cpl\,ClearMyTracksByProcess")) | table _time, host, user, process,
  process_*, parent_process, parent_process_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://redcanary.com/threat-detection-report/techniques/rundll32/

id: '19934.35266'
title: Shortcut Created in Startup Folder - Windows
description: 'Adversaries may achieve persistence by adding a program to a startup
  folder. These programs will be executed under the context of the user and will have
  the account''s associated permissions level. This use case detects shortcut creation
  commands referencing the default startup folder location. -- Threat Actor Association:
  APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM)
  - Software Association: DarkGate -- Atomics T1547.001 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ((("New-Item" OR TERM(ni) OR TERM(New-Object)) (TERM(SymbolicLink)
  OR TERM(hardlink))) OR TERM(mklink) OR ".lnk") "Startup" | regex process="(?i)Programs\SStartup\S+\.lnk"
  | table _time, host, user, process, process_*, parent_process* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
technique_id:
- T1547.001
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder

name: Windows AD Same Domain SID History Addition
id: 5fde0b7c-df7a-40b1-9b3a-294c00f0289d
version: 13
creation_date: '2022-09-08'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: The following analytic detects changes to the sIDHistory attribute of user or computer objects within the same domain. It leverages Windows Security Event Codes 4738 and 4742 to identify when the sIDHistory attribute is modified. This activity is significant because the sIDHistory attribute can be abused by adversaries to grant unauthorized access by inheriting permissions from another account. If confirmed malicious, this could allow attackers to maintain persistent access or escalate privileges within the domain, posing a severe security risk.
data_source:
    - Windows Event Log Security 4742
    - Windows Event Log Security 4738
search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P<SidHistoryMatch>.*)(\-|\\\)" | rex field=TargetSid "^(?P<TargetSidmatch>.*)(\-|\\\)" | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName | rename TargetSid as userSid, TargetDomainName as userDomainName | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user dest | `windows_ad_same_domain_sid_history_addition_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and  `Audit Computer Account Management` within `Account Management` all need to be enabled. SID resolution is not required..
known_false_positives: No false positives have been identified at this time.
references:
    - https://adsecurity.org/?p=1772
    - https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN
    - https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute
    - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection
finding:
    title: Active Directory SID History Attribute was added to $user$ by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Active Directory SID History Attribute was added to $user$ by $src_user$
analytic_story:
    - Compromised Windows Host
    - Windows Persistence Techniques
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1134.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chromium process Launched with Disable Popup Blocking
id: 95f8acd6-978e-42d6-99c1-85baacdd2b46
version: 5
creation_date: '2026-02-02'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects instances where a Windows Chromium-based browser process is launched with the `--disable-popup-blocking` flag. This flag is typically used to bypass the browser’s built-in pop-up protections, allowing automatic execution of pop-ups or redirects without user interaction. While legitimate in some testing or automation scenarios, its presence on endpoints, particularly when combined with other automation or concealment flags, may indicate attempts by malicious actors to execute web-based content stealthily or evade user interaction controls, representing a potential security risk that warrants investigation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes
    where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
    Processes.process = "*--disable-popup-blocking*"
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`| `windows_chromium_process_launched_with_disable_popup_blocking_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Administrators may enable or disable this feature for framework testing that may cause some false positive.
references:
    - https://www.trendmicro.com/en_us/research/26/a/analysis-of-the-evelyn-stealer-campaign.html
    - https://peter.sh/experiments/chromium-command-line-switches/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A Chromium-based browser process $process_name$ was launched by $parent_process_name$ on $dest$ by the user $user$ with the command-line $process$.
        - field: user
          type: user
          score: 20
          message: A Chromium-based browser process $process_name$ was launched by $parent_process_name$ on $dest$ by the user $user$ with the command-line $process$.
threat_objects:
    - field: parent_process
      type: parent_process
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
analytic_story:
    - Browser Hijacking
asset_type: Endpoint
mitre_attack_id:
    - T1497
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Disable Notification Center
id: 1cd983c8-8fd6-11ec-a09d-acde48001122
version: 15
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects the modification of the Windows registry to disable the Notification Center on a host machine. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "DisableNotificationCenter" registry value set to "0x00000001." This activity is significant because disabling the Notification Center can be a tactic used by RAT malware to hide its presence and subsequent actions. If confirmed malicious, this could allow an attacker to operate stealthily, potentially leading to further system compromise and data exfiltration.
data_source:
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
      WHERE (
            Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data = "0x00000001"
        )
      BY Registry.action Registry.dest Registry.process_guid
         Registry.process_id Registry.registry_hive Registry.registry_path
         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
         Registry.registry_value_type Registry.status Registry.user
         Registry.vendor_product
    | `drop_dm_object_name(Registry)`
    | where isnotnull(registry_value_data)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_disable_notification_center_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable this windows features.
references:
    - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The Windows notification center was disabled on $dest$ by $user$.
        - field: dest
          type: system
          score: 20
          message: The Windows notification center was disabled on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - CISA AA23-347A
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows EFI Bootloader File Modification
id: 28e1dbcd-9fd2-4de0-a637-f2b30db5dbb9
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects where a process writes to critical EFI bootloader files (bootmgfw.efi or bootx64.efi) within the \EFI\Boot\ directory.
    These files are responsible for initializing the Windows Boot Manager during system startup.
    Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.file_path IN (
        "*\\EFI\\Boot\\bootmgfw.efi",
        "*\\EFI\\Boot\\bootx64.efi"
    )

    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name
       Filesystem.user Filesystem.vendor_product Filesystem.action

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_efi_bootloader_file_modification_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate system updates or authorized IT maintenance may modify EFI bootloader files. Review changes against approved maintenance windows and tools.
references:
    - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/
    - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/
finding:
    title: Critical EFI bootloader file activity observed at $file_path$ on $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_path
      type: file_path
analytic_story:
    - Windows BootKits
asset_type: Endpoint
mitre_attack_id:
    - T1542.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5708.11694'
title: Windows IPC$ Share Access
description: 'Winndows systems have hidden network shares that are accessible only
  to administrators and provide the ability for remote file copy and other administrative
  functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have
  had an object call. Adversaries may use this technique in conjunction with administrator-level
  Valid Accounts to remotely access a networked system. -- Threat Actor Association:
  TA428, Volt Typhoon -- Atomics T1021.002 Test#1 Atomics T1021.002 Test#2 Atomics
  T1021.002 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<"
  OR TERM(EventCode=11) OR "EventID>11<") "ipc$" | table _time, host, user, signature_id,
  process, process_*, parent_process_*t `group_events("host", 1)` '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows Sysmon
references:
- https://support.malwarebytes.com/hc/en-us/articles/360038524714