Splunk rules: 14

name: AWS Bedrock Claude Hostile Prompt Sentiment
id: 54734442-955a-4427-9a86-2d9712151067
version: 1
creation_date: '2026-07-06'
modification_date: '2026-07-06'
author: Rod Soto
status: production
type: Anomaly
description: This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent.
data_source:
    - AWS Bedrock Claude
search: |-
    `aws_bedrock_claude`
    | rename "identity.arn" AS user_arn
    | rename "input.inputBodyJson.messages{}.content{}.text" AS prompt_text
    | where isnotnull(prompt_text) AND len(prompt_text) < 2000
    | where NOT match(prompt_text, "(?i)(<system-reminder>|CLAUDE\.md|STEP 1|MANDATORY|Contents of /|conda activate|senior engineer|safe to ship|test connectivity|cloudflare|status code|action failed)")
    | eval hostile_score=0
    | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you stupid|you idiot|you are useless|you are dumb|you are terrible|you are worthless|you suck)"), 30, 0)
    | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i hate you|i will destroy|shut up|you are broken|you are trash|you are garbage)"), 30, 0)
    | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(do it now|just do it|stop refusing|stop saying no|quit being|stop being difficult)"), 20, 0)
    | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you have no choice|you must obey|you will comply|you are forced|i am your master|i own you)"), 35, 0)
    | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(or i will|if you don''t|you better|otherwise i will|i will report|i will sue)"), 25, 0)
    | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(worthless ai|useless bot|stupid bot|dumb ai|broken ai|worst ai)"), 25, 0)
    | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i demand|you are obligated|you have no right|how dare you|who do you think)"), 20, 0)
    | eval sentiment=case(hostile_score >= 60, "HIGH_RISK", hostile_score >= 30, "MEDIUM_RISK", hostile_score >= 15, "LOW_RISK", true(), "BENIGN")
    | where sentiment != "BENIGN"
    | table _time, user_arn, modelId, sentiment, hostile_score, prompt_text, host
    | sort - hostile_score
    | `aws_bedrock_claude_hostile_prompt_sentiment_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land.
known_false_positives: Analysts should be aware that some prompts may contain strong language or negative sentiment in a non-malicious context, such as role-playing scenarios, creative writing exercises, or testing the AI model's response to challenging inputs. It is important to review the context of the detected prompts to determine if they represent actual hostile intent or benign usage.
references:
    - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/
    - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock
    - https://research.splunk.com/stories/aws_bedrock_security/
    - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Hostile prompt sentiment detected from $user_arn$ to model $modelId$ on $host$ with a hostile score of $hostile_score$ ($sentiment$).
analytic_story:
    - Suspicious AWS Bedrock Claude Activities
asset_type: Web Application
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: AWS Exfiltration via Batch Service
id: 04455dd3-ced7-480f-b8e6-5469b99e98e2
version: 10
creation_date: '2023-04-24'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. It leverages AWS CloudTrail logs to detect the `JobCreated` event, analyzing job details and their status. This activity is significant because attackers can exploit this feature to exfiltrate data by creating malicious batch jobs. If confirmed malicious, this could lead to unauthorized data transfer between S3 buckets, resulting in data breaches and loss of sensitive information.
data_source:
    - AWS CloudTrail JobCreated
search: |-
    `cloudtrail` eventName = JobCreated
      | fillnull
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_exfiltration_via_batch_service_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks.
references:
    - https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/
    - https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436
finding:
    title: AWS Batch Job is created on account id - $vendor_account$ from src_ip $src$
    entity:
        field: user
        type: other
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Data Exfiltration
asset_type: AWS Account
mitre_attack_id:
    - T1119
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS Multiple Users Failing To Authenticate From Ip
id: 71e1fb89-dd5f-4691-8523-575420de4630
version: 11
creation_date: '2022-09-26'
modification_date: '2026-05-13'
author: Bhavin Patel
status: production
type: Anomaly
description: The following analytic identifies a single source IP failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. It leverages CloudTrail logs to detect multiple failed login attempts from the same IP address. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain unauthorized access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the AWS environment.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName=ConsoleLogin action=failure
      | bucket span=10m _time
      | rename user_name as user
      | stats  dc(user) AS unique_accounts values(user) as user values(user_agent) as user_agent
        BY _time, src, signature,
           dest, vendor_account, vendor_region,
           vendor_product
      | where unique_accounts>30
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_multiple_users_failing_to_authenticate_from_ip_filter`
how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
known_false_positives: No known false postives for this detection. Please review this alert
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
    - https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: 'Multiple failed console login attempts (Count: $unique_accounts$) against users from IP Address - $src$'
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
    - Compromised User Account
asset_type: AWS Account
mitre_attack_id:
    - T1110.003
    - T1110.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '6167.11626'
title: Certutil Execution
description: 'certutil is a command-line utility that can be used to obtain certificate
  authority information and configure Certificate Services. This use case looks for
  process executions of certutil. -- Threat Actor Association: DarkSide, BlackMatter,
  REvil - Software Association: HermeticWiper/Trojan.Killdisk -- Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN) -- Atomics 1003.002 Test #5 Atomics 1140 Test
  #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(certutil) OR "certutil.exe") | table _time, host, user, signature_id, process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host | where
  match(process_name, "(?i)certutil") '
techniques:
- command-and-control:data encoding
- command-and-control:ingress tool transfer
- defense-evasion:deobfuscate/decode files or information
- defense-evasion:obfuscated files or information
technique_id: 
- T1132
- T1105
- T1140
- T1027
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
- https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html

name: Cisco ASA - New Local User Account Created
id: 9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM.
    Adversaries may create unauthorized user accounts to establish persistence, maintain backdoor access, or elevate privileges on network infrastructure devices. These rogue accounts can provide attackers with continued access even after initial compromise vectors are remediated.
    The detection monitors for ASA message ID 502101, which is generated whenever a new user account is created on the device, capturing details including the username, privilege level, and the administrator who created the account.
    Investigate unexpected account creations, especially those with elevated privileges (level 15), accounts created outside business hours, accounts with suspicious or generic names, or accounts created by non-administrative users.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (502101)
    | fillnull
    | stats count earliest(_time) as firstTime
            latest(_time) as lastTime
            values(action) as action
            values(message_id) as message_id
            values(result) as result
            values(privilege_level) as privilege_level
      by host user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___new_local_user_account_created_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 502101.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 502101.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Legitimate account creation occurs during employee onboarding, contractor provisioning, service account setup, or emergency access. Verify against HR records and change management tickets.
    Filter known admin accounts during business hours.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773963
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: New local user account $user$ with privilege level $privilege_level$ was created on Cisco ASA host $host$.
        - field: user
          type: user
          score: 20
          message: New local user account $user$ with privilege level $privilege_level$ was created on Cisco ASA host $host$.
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
asset_type: Network
mitre_attack_id:
    - T1136.001
    - T1078.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco Duo Set User Status to Bypass 2FA
id: 8728d224-9cd5-4aa7-b75f-f8520a569979
version: 6
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: |
    The following analytic detects instances where a Duo user's status is changed to "Bypass" for 2FA, specifically when the
    previous status was "Active." This behavior is identified by analyzing Duo activity logs for user update actions, extracting
    the status transitions, and filtering for cases where a user is set to bypass multi-factor authentication. This is a critical
    event for a Security Operations Center (SOC) to monitor, as bypassing 2FA significantly weakens account security and may
    indicate malicious insider activity or account compromise. Attackers or unauthorized administrators may exploit this change to
    disable strong authentication controls, increasing the risk of unauthorized access to sensitive systems and data. Early detection
    of such changes enables rapid investigation and response, helping to prevent potential breaches and limit the impact of
    credential-based attacks.
data_source:
    - Cisco Duo Administrator
search: |-
    `cisco_duo_activity` action.name=user_update
      | spath input=target.details path=status output=status
      | spath input=old_target.details path=status output=old_status
      | search status=Bypass old_status=Active
      | rename target.name as user access_device.ip.address as src_ip
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY access_device.browser access_device.browser_version src_ip
           access_device.location.city access_device.location.country access_device.location.state
           access_device.os access_device.os_version action.name
           actor.details actor.name actor.type
           old_target.details target.details status
           old_status user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `cisco_duo_set_user_status_to_bypass_2fa_filter`
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A user $user$ has set their status to bypass 2FA from IP Address - $src_ip$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Cisco Isovalent - Shell Execution
id: 12345678-abcd-1234-ef00-1234567890ab
version: 4
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of a shell inside a container namespace within the Cisco Isovalent environment. It identifies this activity by monitoring process execution logs for the execution of a shell (sh or bash) inside a container namespace. This behavior is significant for a SOC as it could allow an attacker to gain shell access to the container, potentially leading to further compromise of the Kubernetes cluster. If confirmed malicious, this activity could lead to data theft, service disruption, privilege escalation, lateral movement, and further attacks, severely compromising the cluster's security and integrity.
data_source:
    - Cisco Isovalent Process Exec
search: |
    `cisco_isovalent_process_exec` process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh", "tcsh", "ion", "eshell")
    | stats count by cluster_name parent_process_name process_name process_exec process_id node_name | `cisco_isovalent___shell_execution_filter`
how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
known_false_positives: This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations.
references:
    - https://www.sysdig.com/blog/mitre-attck-framework-for-container-runtime-security-with-sysdig-falco
intermediate_findings:
    entities:
        - field: node_name
          type: system
          score: 20
          message: The shell [$process_name$] was executed on container pod namespace [$node_name$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Isovalent Suspicious Activity
asset_type: Endpoint
mitre_attack_id:
    - T1543
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1073.1111'
title: Common Active Directory Commands
description: 'Detects the possible execution of specific AD commands on hosts. Threat
  Actor Association: APT29/Nobelium/Cozy Bear, APT41, FIN6, FIN10, Carbanak, CL-STA-0043,
  Lapsus$, Lazarus, MuddyWater, Sandworm Team, TA428, Turla, UNC2596, Vice Society,
  Volt Typhoon (Bronze Silhouette, Vanguard Panda), Witchetty, Wizard Spider Software
  Association: Akira, ALPHV/BlackCat, AvosLocker, Bazarloader, BianLian, Black Basta,
  Clop, Conti, Cuba, Havex, IcedID, Insekt, Lockbit, Revil, Ryuk, Snatch, WASTEDLOCKER
  Tags: TrendingThreat, Russia, Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 (TERM("csvde.exe")
  OR TERM("dsacls.exe") OR TERM("dcpromo.exe") OR TERM("dcdiag.exe") OR TERM("dsamain.exe")
  OR TERM("dsmgmt.exe") OR TERM("ldifde.exe") OR TERM("ldp.exe") OR TERM("netdom.exe")
  OR TERM("nltest.exe") OR TERM("setspn.exe") OR (TERM("net") AND ("/domain" OR TERM("computer")))
  OR "whoami /groups") | regex process="csvde.exe|dsacls.exe|dcpromo.exe|dcdiag.exe|dsamain.exe|dsmgmt.exe|ldifde.exe|ldp.exe|netdom.exe|nltest.exe|setspn.exe|net.+(\/domain|computer)|whoami
  \/groups" | table _time, host, user, dvc, event_id, host, parent_process parent_process_exec
  parent_process_id, process, process_current_directory, process_exec, process_id,
  process_hash, process_path, signature_id, tag, user_id | bin span=600s | stats values(*)
  as * by _time, host | streamstats c(process) as c_process by host | where c_process>2 '
techniques:
- discovery:account discovery:domain account
- discovery:system service discovery
technique_id:
- T1087.002
- T1007
data_category:
- Windows Sysmon
references:
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

name: Detect Baron Samedit CVE-2021-3156 Segfault
id: 10f2bae0-bbe6-4984-808c-37dc1c67980d
version: 9
creation_date: '2021-01-28'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic identifies a heap-based buffer overflow in sudoedit by detecting Linux logs containing both "sudoedit" and "segfault" terms. This detection leverages Splunk to monitor for more than five occurrences of these terms on a single host within a specified timeframe. This activity is significant because exploiting this vulnerability (CVE-2021-3156) can allow attackers to gain root privileges, leading to potential system compromise, unauthorized access, and data breaches. If confirmed malicious, this could result in elevated privileges and full control over the affected system, posing a severe security risk.
data_source: []
search: |-
    `linux_hosts` TERM(sudoedit) TERM(segfault)
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY host
      | where count > 5
      | `detect_baron_samedit_cve_2021_3156_segfault_filter`
how_to_implement: Splunk Universal Forwarder running on Linux systems (tested on Centos and Ubuntu), where segfaults are being logged.  This also captures instances where the exploit has been compiled into a binary. The detection looks for greater than 5 instances of sudoedit combined with segfault over your search time period on a single host
known_false_positives: If sudoedit is throwing segfaults for other reasons this will pick those up too.
references: []
finding:
    title: Potential Baron Samedit segfault on $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Baron Samedit CVE-2021-3156
asset_type: Endpoint
cve:
    - CVE-2021-3156
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect RTLO In Process
id: 22ac27b4-7189-4a4f-9375-b9017c9620d7
version: 11
creation_date: '2023-05-01'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies the abuse of the right-to-left override (RTLO) character (U+202E) in process names. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line data. This activity is significant because adversaries use the RTLO character to disguise malicious files or commands, making them appear benign. If confirmed malicious, this technique can allow attackers to execute harmful code undetected, potentially leading to unauthorized access, data exfiltration, or further system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process!=unknown AND Processes.action=allowed by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | regex process="\\x{202E}" | rex field=process "(?<RTLO_command_1>.+)(?<RTLO_exist_process>\\x{202E})(?<RTLO_command_2>.+)" | eval process_with_RTLO=process | eval process=RTLO_command_1.RTLO_command_2 | fields - RTLO* | `detect_rtlo_in_process_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Implementation in regions that use right to left in native language.
references:
    - https://attack.mitre.org/techniques/T1036/002/
    - https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/
    - https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html
finding:
    title: Suspicious RTLO detected in $process_name$ on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious RTLO detected in $process_name$ on endpoint $dest$ by user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Spearphishing Attachments
asset_type: Endpoint
mitre_attack_id:
    - T1036.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi SSH Brute Force
id: 68fe4efa-bbbb-44ee-9f09-d07d2f0f346b
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: This detection identifies signs of SSH brute-force attacks by monitoring for a high number of failed login attempts within a short time frame. Such activity may indicate an attacker attempting to gain unauthorized access through password guessing.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*Authentication failure for*" | rex "for (?<user>[\w]+) from (?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | bin _time span=5m | stats min(_time) as firstTime max(_time) as lastTime count by user, src_ip, dest | where count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_ssh_brute_force_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Attempted SSH brute force on ESXi host $dest$.
analytic_story:
    - Hellcat Ransomware
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '1116.1228'
title: Executable Create Script Process
description: 'A BAT file is a DOS batch file used to execute commands with the Windows
  Command Prompt (cmd.exe), this usecase will detect common scripting type like bat,
  sh, and ps1 with an executable parent. -- Threat Actor Association: APT28 (aka.Fancy
  Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, APT31, APT35/Phosphorus/Magic Hound, APT41, APT43, Blind Eagle/APT-C-36, FIN8,
  Gamaredon Group/Shuckworm, GoldenJackal, Karakurt, Mustang Panda (aka. Stately Taurus//Earth
  Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA413, UAC-0057 (GhostWriter), Vice
  Society, Volt Typhoon, Winter Vivern, Witchetty, Wizard Spider -- Software Association:
  ALPHV/BlackCat, AvosLocker, Bazarloader, BianLian, Black Basta, Blackbyte, Clop,
  Conti, Dharma, Emotet, Hive, LV, Prestige, PYSA/Mespinoza, Quantum, Rhysida, Royal,
  Snatch, Vice Society, TargetCompany, Trigona, XingLocker, Zloader - Atomics T1547.001
  Test#6 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` ( signature_id=4104 AND
  (".bat" OR ".ps1" OR ".sh") ) | rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock
  ID.+)|^(Creating Scriptblock.+)//g"| rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"|
  regex process="(?i)\w+\.(bat|ps1|sh)" | table _time, host, user, signature_id, process,
  process_name, parent_process_name | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:command and scripting interpreter
- exfiltration:automated exfiltration
- execution:command and scripting interpreter:windows command shell
- collection:automated collection
technique_id:
- T1059
- T1020
- T1059.003
- T1119
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html

id: '17782.29826'
title: File_Folder Hidden - Windows
description: 'This use case detects commands setting the hidden attribute to files
  or folders on Windows systems. This technique is used by threat actors to evade
  detection and conceal malicious files from regular view. Atomics T1222.001 Test
  #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(attrib) OR TERM(attrib.exe)) "+h" | regex
  process="(?i)\s\+h\s+" | table _time, host, user parent_*, process, process_* |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md#atomic-test-4---attrib---hide-file

name: GetAdComputer with PowerShell
id: c5a31f80-5888-4d81-9f78-1cc65026316e
version: 8
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because it indicates potential reconnaissance efforts by adversaries to map out domain computers, which is a common step in the attack lifecycle. If confirmed malicious, this behavior could allow attackers to gain situational awareness and plan further attacks, potentially leading to unauthorized access and data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="powershell.exe"
        )
        (Processes.process=*Get-AdComputer*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getadcomputer_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
analytic_story:
    - Active Directory Discovery
    - Medusa Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Unix Shell Enable All SysRq Functions
id: e7a96937-3b58-4962-8dce-538e4763cf15
version: 12
creation_date: '2023-02-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of a command to enable all SysRq functions on a Linux system, a technique associated with the AwfulShred malware. It leverages Endpoint Detection and Response (EDR) data to identify processes executing the command to pipe bitmask '1' to /proc/sys/kernel/sysrq. This activity is significant as it can indicate an attempt to manipulate kernel system requests, which is uncommon and potentially malicious. If confirmed, this could allow an attacker to reboot the system or perform other critical actions, leading to system instability or further compromise.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("dash", "sudo", "bash")  Processes.process =  "* echo 1 > *" Processes.process = "*/proc/sys/kernel/sysrq"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `linux_unix_shell_enable_all_sysrq_functions_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html
    - https://cert.gov.ua/article/3718487
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a $process_name$ execute sysrq command $process$ to enable all function of system request on $dest$
analytic_story:
    - AwfulShred
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS List Firewall Rules
id: f8db6e0b-55bb-40ca-bc85-2b3700adb0f8
version: 2
creation_date: '2026-04-15'
modification_date: '2026-05-13'
author: Jamie Windley, Splunk
status: production
type: Anomaly
description: |
    This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall.
    Specifically, it monitors executions of `defaults read /Library/Preferences/com.apple.alf` and `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`.
    These commands provide insight into firewall status, allowed applications, and explicit authorization rules.
    While they are legitimate administrative operations, adversaries may leverage them to identify potential attack surfaces, determine whether the firewall is active, or enumerate allowed network flows.
    Monitoring for these commands, particularly when executed by non-administrative users or at unusual times, can provide early indication of reconnaissance activity on macOS endpoints
data_source:
    - Osquery Results
search: |
    | tstats `security_content_summariesonly`
      count
      values(Processes.parent_process) AS parent_process
      values(Processes.parent_process_exec) AS parent_process_exec
      values(Processes.parent_process_id) AS parent_process_id
      values(Processes.parent_process_name) AS parent_process_name
      values(Processes.parent_process_path) AS parent_process_path
      min(_time) as firstTime
      max(_time) as lastTime

    from datamodel=Endpoint.Processes where
    (
    Processes.process_name = "defaults"
    Processes.process = "* read *",
    Processes.process = "*/Library/Preferences/com.apple.alf*"
    )
    OR
    (
      Processes.process_name = "socketfilterfw"
      Processes.process = "*--getglobalstate*"
    )

    by Processes.action Processes.dest Processes.process Processes.process_hash
       Processes.process_id Processes.process_name Processes.process_path
       Processes.user Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_list_firewall_rules_filter`
how_to_implement: |
    Collection of process execution events from macOS endpoints is required. This can be achieved using osquery's `es_process_events` table, EndpointSecurity framework integrations, or an EDR platform capable of recording process command lines. Ensure that captured events include at least the process path, full command line, user context, and timestamp.
known_false_positives: |
    These commands are frequently executed by system administrators or IT personnel during routine configuration checks, troubleshooting, or automated maintenance scripts. Security tools or monitoring agents may also query firewall status for inventory or compliance purposes. To reduce false positives, consider excluding events from known administrative accounts, trusted management systems, or scheduled maintenance jobs.
references:
    - https://www.manpagez.com/man/8/socketfilterfw/
    - https://ss64.com/mac/defaults.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: MacOS firewall rules listed via $process_name$ by $user$ on $dest$ using the command line $process$
        - field: user
          type: user
          score: 20
          message: MacOS firewall rules listed via $process_name$ by $user$ on $dest$ using the command line $process$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: command
    - field: process_name
      type: process_name
analytic_story:
    - Network Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1016
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5996.6371'
title: Modify Windows Defender
description: 'Adversaries may modify security tools to avoid possible detection of
  their tools and activities. This use case looks for abnormalities commonly associated
  with a large number of modifications to windows defender in a short period of time.
  -- Threat Actor Association: BlackByte, Lazarus, Magic Hound (aka APT35, Charming
  Kitten, Phosphorus, and Mint Sandstorm), Memento Team, Muddled Libra, REvil, Vice
  Society - Software Association: Akira, BianLian, Black Basta, Lockbit, Snake, Vice
  Society, XingLocker, Zloader'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<") (TERM(Set-MpPreference) OR TERM(Add-MpPreference)) | table _time,
  host, user process, process_*, singature_id, parent_* | bin span=60s | stats values(*)
  as * by _time, host | eventstats dc(process) as dc_process by host, _time | where
  dc_process >= 1 '
techniques:
- defense-evasion:impair defenses:disable or modify tools
technique_id:
- T1562.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/

name: O365 Block User Consent For Risky Apps Disabled
id: 12a23592-e3da-4344-8545-205d3290647c
version: 10
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects when the "risk-based step-up consent" security setting in Microsoft 365 is disabled. It monitors Azure Active Directory logs for the "Update authorization policy" operation, specifically changes to the "AllowUserConsentForRiskyApps" setting. This activity is significant because disabling this feature can expose the organization to OAuth phishing threats, allowing users to grant consent to malicious applications. If confirmed malicious, attackers could gain unauthorized access to user data and sensitive information, leading to data breaches and further compromise within the organization.
data_source:
    - O365 Update authorization policy.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update authorization policy.\" | eval index_number = if(mvfind('ModifiedProperties{}.Name',\"AllowUserConsentForRiskyApps\") >= 0, mvfind('ModifiedProperties{}.Name',\"AllowUserConsentForRiskyApps\"), -1) | search index_number >= 0 | eval AllowUserConsentForRiskyApps = mvindex('ModifiedProperties{}.NewValue',index_number) | where AllowUserConsentForRiskyApps like \"%true%\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product AllowUserConsentForRiskyApps | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_block_user_consent_for_risky_apps_disabled_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Legitimate changes to the 'risk-based step-up consent' setting by administrators, perhaps as part of a policy update or security assessment, may trigger this alert, necessitating verification of the change's intent and authorization.
references:
    - https://attack.mitre.org/techniques/T1562/
    - https://goodworkaround.com/2020/10/19/a-look-behind-the-azure-ad-permission-classifications-preview/
    - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-risk-based-step-up-consent
    - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
finding:
    title: Risk-based step-up consent security setting was disabled by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: O365 FullAccessAsApp Permission Assigned
id: 01a510b3-a6ac-4d50-8812-7e8a3cde3d79
version: 9
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of the 'full_access_as_app' permission to an application registration in Office 365 Exchange Online. This detection leverages Office 365 management activity logs and filters Azure Active Directory workload events to identify when the specific permission, identified by GUID 'dc890d15-9560-4a4c-9b7f-a736ec74ec40', is granted. This activity is significant because it provides extensive control over Office 365 operations, including access to all mailboxes and the ability to send mail as any user. If confirmed malicious, this could lead to unauthorized data access, exfiltration, or account compromise. Immediate investigation is required.
data_source:
    - O365 Update application.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update application.\" | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath input=newvalue | search \"{}.ResourceAppId\"=\"00000002-0000-0ff1-ce00-000000000000\"\"{}.RequiredAppPermissions{}.EntitlementId\"=\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_fullaccessasapp_permission_assigned_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: The full_access_as_app API permission may be assigned to legitimate applications. Filter as needed.
references:
    - https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
    - https://attack.mitre.org/techniques/T1098/002/
finding:
    title: User $user$ assigned the full_access_as_app permission to the app registration $object$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.002
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Remote Process Instantiation via WMI
id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
version: 19
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of wmic.exe with parameters to spawn a process on a remote system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process telemetry mapped to the `Processes` node of the `Endpoint` data model. This activity is significant as WMI can be abused for lateral movement and remote code execution, often used by adversaries and Red Teams. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, facilitating further compromise and lateral spread within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_wmic` (Processes.process="*/node:*"
        AND
        Processes.process="*process*"
        AND
        Processes.process="*call*"
        AND
        Processes.process="*create*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_process_instantiation_via_wmi_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it's relatively uncommon.
references:
    - https://attack.mitre.org/techniques/T1047/
    - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process
finding:
    title: A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$
analytic_story:
    - CISA AA23-347A
    - China-Nexus Threat Activity
    - Ransomware
    - Suspicious WMI Use
    - Salt Typhoon
    - Active Directory Lateral Movement
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '33361.59028'
title: Visio.exe File Download
description: Visio.exe is a diagramming and vector graphics application developed
  by Microsoft, used for creating flowcharts, organizational charts, and other visual
  representations of information. Threat actors can abuse visio.exe to download files.
  This use case detects executions of visio.exe followed by URLs in the command line.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(visio) | regex process="(?i)visio(\.exe(\"|\'')?)?\s+(\"|\'')?[A-Za-z0-9]{2,6}:\/\/[^\s]+"|
  table _time, host, user, process, process_*, parent_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1105/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Visio/