Splunk rules: 16

id: '5986.18206'
title: Access Common Package Config file
description: 'Adversaries may establish persistence and/or elevate privileges using
  system mechanisms that trigger execution based on specific events. An Adversary
  with access could identify or modify configuration of packages in order to execute
  code and evade defenses. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  (TERM(vi) OR TERM(vim) OR TERM(nano) OR TERM(visudo) OR TERM(edit) OR (TERM(copy)
  TERM(con)) OR TERM(cat) OR TERM(more) OR TERM(gc) OR TERM(get-Content) OR ">>" OR
  ">") ("requirements.txt" OR "pip.conf" OR "package.json" OR "gemspec" OR "gemrc")
  | regex process="(?i)(vi|vim|nano|visudo|edit|copy\s+con|cat|more|gc|get-content|type|\>\>|\>)\s+.+(requirements\.txt|pip\.conf|package.json|\.gemspec|gemrc)"
  | table _time, host, user, process, process_*, parent_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution
- privilege-escalation:event triggered execution
technique_id: 
- T1546
data_category:
- Windows Sysmon
references:
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

name: AWS IAM Successful Group Deletion
id: e776d06c-9267-11eb-819b-acde48001122
version: 10
creation_date: '2021-04-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies the successful deletion of an IAM group in AWS. It leverages CloudTrail logs to detect `DeleteGroup` events with a success status. This activity is significant as it could indicate potential changes in user permissions or access controls, which may be a precursor to further unauthorized actions. If confirmed malicious, an attacker could disrupt access management, potentially leading to privilege escalation or unauthorized access to sensitive resources. Analysts should review related IAM events, such as recent user additions or new group creations, to assess the broader context.
data_source:
    - AWS CloudTrail DeleteGroup
search: |-
    `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success (userAgent!=*.amazonaws.com)
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_iam_successful_group_deletion_filter`
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
references:
    - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1069.003
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: Azure AD Multi-Factor Authentication Disabled
id: 482dd42a-acfa-486b-a0bb-d6fcda27318e
version: 14
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects attempts to disable multi-factor authentication (MFA) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Disable Strong Authentication" operation. This activity is significant because disabling MFA can allow adversaries to maintain persistence using compromised accounts without raising suspicion. If confirmed malicious, this action could enable attackers to bypass an essential security control, potentially leading to unauthorized access and prolonged undetected presence in the environment.
data_source:
    - Azure Active Directory Disable Strong Authentication
search: |-
    `azure_monitor_aad` category=AuditLogs operationName="Disable Strong Authentication"
      | rename properties.* as *
      | rename targetResources{}.type as type
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           initiatedBy signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_multi_factor_authentication_disabled_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
    - https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
    - https://attack.mitre.org/tactics/TA0005/
    - https://attack.mitre.org/techniques/T1556/
finding:
    title: MFA disabled for User $user$ initiated by $initiatedBy$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1556.006
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Azure Automation Runbook Created
id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b
version: 14
creation_date: '2022-08-22'
modification_date: '2026-05-13'
author: Mauricio Velazco, Brian Serocki, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new Azure Automation Runbook within an Azure tenant. It leverages Azure Audit events, specifically the Azure Activity log category, to identify when a new Runbook is created or updated. This activity is significant because adversaries with privileged access can use Runbooks to maintain persistence, escalate privileges, or execute malicious code. If confirmed malicious, this could lead to unauthorized actions such as creating Global Administrators, executing code on VMs, and compromising the entire Azure environment.
data_source:
    - Azure Audit Create or Update an Azure Automation Runbook
search: |-
    `azure_audit` operationName.value="Microsoft.Automation/automationAccounts/runbooks/write" object!=AzureAutomationTutorial* status.value=Succeeded
      | dedup object
      | rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.value as operationName
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product object
           object_path
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_automation_runbook_created_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
known_false_positives: Administrators may legitimately create Azure Automation Runbooks. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/azure/automation/overview
    - https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
    - https://docs.microsoft.com/en-us/azure/automation/manage-runbooks
    - https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
    - https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
    - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
    - https://attack.mitre.org/techniques/T1136/003/
finding:
    title: A new Azure Automation Runbook $object$ was created by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: Azure Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: Cisco SNMP Community String Configuration Changes
id: b0ce5521-2533-4f24-b8d5-c2ff977aae08
version: 6
creation_date: '2025-08-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: Anomaly
description: This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. After gaining initial access to network devices, threat actors like Static Tundra often modify SNMP configurations to enable unauthorized monitoring and data collection. This detection specifically looks for the configuration of SNMP community strings with read-write (rw) or read-only (ro) permissions, as well as the configuration of SNMP hosts that may be used to exfiltrate data. These activities are particularly concerning as they may represent attempts to establish persistent access or extract sensitive information from compromised devices.
data_source:
    - Cisco IOS Logs
search: |-
    | tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
      WHERE (
            (All_Changes.command="*snmp-server community*rw*")
            OR
            (All_Changes.command="*snmp-server community*ro*")
            OR
            (All_Changes.command="*snmp-server host*")
        )
      BY All_Changes.dvc All_Changes.user
    | `drop_dm_object_name("All_Changes")`
    | rename dvc as dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_snmp_community_string_configuration_changes_filter`
how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel. Ensure that your Cisco IOS devices are configured to send logs to your Splunk environment, with appropriate logging levels enabled to capture configuration commands. Configure command logging on Cisco IOS devices using the "archive log config logging enable" command to ensure that SNMP configuration changes are properly logged.
known_false_positives: Legitimate SNMP configuration changes may trigger this detection during routine network maintenance or initial device setup. Network administrators often need to configure SNMP for monitoring and management purposes. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames, typical times for SNMP configuration changes, and scheduled maintenance windows. You may also want to create a lookup table of approved SNMP hosts and filter out alerts for these destinations.
references:
    - https://blog.talosintelligence.com/static-tundra/
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
    - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/command/snmp-cr-book/snmp-s1.html#wp1307296356
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious SNMP community string configuration changes detected on Cisco device $dest$ by user $user$, which may indicate persistence establishment
        - field: user
          type: user
          score: 20
          message: Suspicious SNMP community string configuration changes detected on Cisco device $dest$ by user $user$, which may indicate persistence establishment
threat_objects:
    - field: command
      type: command
analytic_story:
    - Cisco Smart Install Remote Code Execution CVE-2018-0171
asset_type: Network
cve:
    - CVE-2018-0171
mitre_attack_id:
    - T1685
    - T1040
    - T1552
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '6001.6380'
title: Common LSASS Memory Dump Behavior
description: 'Adversaries may attempt to access credential material stored in the
  process memory of the Local Security Authority Subsystem Service (LSASS). This use
  case looks for behaviors from common tools such as mimikatz, ATPminidump, Dumpert,
  and CreateMiniDump. -- Threat Actor association: Alloy Taurus/Gallium, APT29/Nobelium,
  BlackCat, Cadet Blizzard, Carbanak, FIN6, FIN7, FIN12, Flax Typhoon, Lancefly, MalKamak,
  Phosphorus/Magic Hound/APT35, TA505, TA551, Traveling Spider, UNC2628, Volt Typhoon,
  Wizard Spider -- Software association: Bazar, BianLian, Blackcat/ALPHV, Clop, Conti,
  IcedID, GhostShell, Hafnium, Hive, Nefilim, Play, Sodinokibi/REvil, Quantum, Trigona,
  Trickbot, XingLocker -- Atomics T1003.001 Test #4 Atomics T1003.001 Test #7 Atomics
  T1003.001 Test #8 Atomics T1003.001 Test #11 Atomics T1003.001 Test #12 Atomics
  T1003.004 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "exe") OR ((TERM(EventCode=4656) OR "<EventID>4656<")
  "lsass.exe") OR ((TERM(EventCode=4703) OR "<EventID>4703<") "exe") | regex user!="\$"|
  regex process_name!="(?i)(system32|syswow64)"| table _time, host, user parent_*,
  process, process_*, signature_id | bin span=5s | stats values(*) as * by _time,
  host, process_name | where event_count < 5 AND (match(signature_id, "4688") and
  match(signature_id, "4656")) OR (match(signature_id, "4688") and match(signature_id,
  "4703")) '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows event logs
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass

name: HTTP Request to Reserved Name on IIS Server
id: 1e45e6a8-110b-4886-b815-8d69cf35bf0a
version: 6
creation_date: '2025-10-21'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects attempts to exploit a request smuggling technique against IIS that leverages a Windows quirk where requests for reserved Windows device names such as "/con" trigger an early server response before the request body is received.
    When combined with a Content-Length desynchronization, this behavior can lead to a parsing confusion between frontend and backend.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url IN (
        "*/aux",
        "*/com1",
        "*/com2",
        "*/com3",
        "*/com4",
        "*/com5",
        "*/com6",
        "*/com7",
        "*/con",
        "*/nul",
        "*/prn"
    )

    BY Web.src Web.dest Web.http_user_agent
       Web.url Web.url_domain Web.status Web.http_method

    | `drop_dm_object_name("Web")`
    ```
    We have to add the logic below because the TA does not extract the URI path from the URL, and the anchors are short. Hence to avoid false positives, we need to extract the URI path from the URL and check if it is a reserved name.
    ```
    | eval uri=replace(url, url_domain, "")
    | where uri IN (
        "/aux",
        "/com1",
        "/com2",
        "/com3",
        "/com4",
        "/com5",
        "/com6",
        "/com7",
        "/con",
        "/nul",
        "/prn"
    )
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `http_request_to_reserved_name_on_iis_server_filter`
how_to_implement: |-
    To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The analytic was written against Suricata. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
known_false_positives: |-
    False positives are not expected on IIS servers, as the detection is based on the presence of web requests to reserved names, which is not a common page to be accessed by legitimate users.
    Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
references:
    - https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
    - https://portswigger.net/research/http1-must-die
    - https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
    - https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
finding:
    title: Known scripting tool was used against a web request. The source IP is $src$ and the destination is $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - HTTP Request Smuggling
asset_type: Network
mitre_attack_id:
    - T1071.001
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: HTTP RMM User Agent
id: 61884b02-0dcf-44c5-9094-db33bac09fa6
version: 5
creation_date: '2026-01-06'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of Remote Monitoring and Mangement applications. This activity can signify possible compromised hosts on the network.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.http_user_agent != null
      BY Web.http_user_agent Web.http_method, Web.url,
         Web.url_length Web.src, Web.dest
    | `drop_dm_object_name("Web")`
    | lookup rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool
    | where isnotnull(tool)
    | stats count min(firstTime) as first_seen max(lastTime) as last_seen
      BY tool url http_user_agent
         src dest
    | `security_content_ctime(first_seen)`
    | `security_content_ctime(last_seen)`
    | `http_rmm_user_agent_filter`
how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
known_false_positives: Noise and false positive can be seen if these programs are allowed to be used within corporate network. In this case, a filter is needed.
references:
    - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_http_user_agents_list.csv
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A known rmm user agent $http_user_agent$ was performing a request from $src$.
threat_objects:
    - field: http_user_agent
      type: http_user_agent
analytic_story:
    - Remote Monitoring and Management Software
    - Suspicious User Agents
asset_type: Network
mitre_attack_id:
    - T1071.001
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '31900.57001'
title: Invoke-DCOM.ps1 - PowerShell
description: 'Adversaries may use Valid Accounts to interact with remote machines
  by taking advantage of Distributed Component Object Model (DCOM). The adversary
  may then perform actions as the logged-on user. This use case detects the usage
  of Invoke-DCOM PowerShell script to remotely obtain arbitrary and direct shellcode
  execution through Office applications as well as other Windows objects that contain
  insecure methods. Note: PowerShell logging is recommended for best detection. Detection
  using other log sources is dependent on commands being run in manner that creates
  a new process, such as powershell -c.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ((("MMC20.Application" OR "ShellWindows" OR "ShellBrowserWindow"
  OR "CheckDomain" OR "ServiceCheck" OR "MinimizeAll" OR "ServiceStop" OR "ServiceStart"
  OR "DetectOffice" OR "RegisterXLL" OR "ExcelDDE") OR ("9BA05972-F6A8-11CF-A442-00A0C90A8F39"
  OR "C08AFD90-F2A1-11D1-8455-00A0C91F3880" OR "7e0423cd-1119-0928-900c-e6d4a52a0715"))
  OR ("Application.ServiceStart" OR "Application.ServiceStop" OR "Application.IsServiceRunning"
  OR "Application.ShutDownWindows" OR "Application.GetSystemInformation" OR "DDEInitiate"
  OR "Application.RegisterXLL" OR "Application.ProductCode" OR "Application.MinimizeAll"
  OR "ActiveView.ExecuteShellCommand") ("cmd.exe" OR "powershell.exe" OR "pwsh.exe"))
  AND NOT ("rundll32.exe" OR TERM(rundll32)) | table _time, host, user, process |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:distributed component object model
technique_id:
- T1021.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1021/003/
- https://github.com/EmpireProject/Empire/blob/master/data/module_source/lateral_movement/Invoke-DCOM.ps1
- https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/

name: Linux Auditd Disable Or Modify System Firewall
id: 07052556-d4b5-4bae-89aa-cbdc1bb11250
version: 12
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the suspicious disable or modify system firewall. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
data_source:
    - Linux Auditd Service Stop
search: |-
    `linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw")
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY type pid comm
           exe unit dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_disable_or_modify_system_firewall_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A service event - [$type$] to disable or modify system firewall occurred on host - [$dest$] .
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Kernel Module Enumeration
id: d1b088de-c47a-4572-9339-bdcc26493b32
version: 10
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. This detection leverages data from Linux Auditd, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd` type=SYSCALL comm=lsmod
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY comm exe syscall
           uid ppid pid
           success dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_kernel_module_enumeration_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://man7.org/linux/man-pages/man8/kmod.8.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to list kernel modules.
analytic_story:
    - Compromised Linux Host
    - XorDDos
    - Linux Rootkit
asset_type: Endpoint
mitre_attack_id:
    - T1082
    - T1014
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '7825.9432'
title: Mavinject Execution
description: 'Mavinject is a legitimate Windows component that can be used, and abused,
  to perform arbitrary code injections inside any running process. As this is a common
  component on Windows, it can be leveraged to perform living-off-the-land attacks.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Threat Actor Assocaition:
  Lancefly -- Atomics T1218 Test #1 Atomics T1055.001 Test#1 Atomics T1056.004 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("mavinject.exe") OR TERM(/INJECTRUNNING) | table
  _time, host, user process, process_*, signature_id, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:process injection:dynamic-link library injection
- collection:input capture:credential api hooking
- defense-evasion:system binary proxy execution
- credential-access:input capture:credential api hooking
- privilege-escalation:process injection:dynamic-link library injection
technique_id:
- T1056.004
- T1218
- T1055.001
data_category:
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Mavinject/
- https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e

id: '35191.61843'
title: MSI Installation via Appcert
description: An MSI file is a Microsoft Installer package used for installing software
  on Windows systems. Typically, .msi files are installed by msiexec.exe; AppCert.exe
  is a component of the Windows Application Compatibility Toolkit used primarily for
  application compatibility testing and can be used to install MSI files, but this
  is not normal usage for appcert. Threat actors may use appcert to install malicious
  MSI files in an attempt to evade detection. This use case detects appcert executions
  with commands to install an msi file. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(appcert) OR
  "appcert.exe") TERM(test) "-setupcommandline" | regex process="(?i)\stest\s.+\-setupcommandline"
  | table _time, host, user, process, parent_*, process_*, proxy_exec | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1218/007/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appcert/

id: '21865.38561'
title: Net.exe Use with URL
description: This use case detects net share commands mapping a drive to a URL as
  observed by the BumbleBee loader.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(net) TERM(use) "://" | regex process="://"
  | table _time, host, user process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://twitter.com/Kostastsale/status/1701111694611898446

name: Okta MFA Exhaustion Hunt
id: 97e2fe57-3740-402c-988a-76b64ce04b8d
version: 9
creation_date: '2022-12-19'
modification_date: '2026-05-13'
author: Michael Haag, Marissa Bower, Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects patterns of successful and failed Okta MFA push attempts to identify potential MFA exhaustion attacks. It leverages Okta event logs, specifically focusing on push verification events, and uses statistical evaluations to determine suspicious activity. This activity is significant as it may indicate an attacker attempting to bypass MFA by overwhelming the user with push notifications. If confirmed malicious, this could lead to unauthorized access, compromising the security of the affected accounts and potentially the entire environment.
data_source:
    - Okta
search: |-
    `okta` eventType=system.push.send_factor_verify_push OR ((legacyEventType=core.user.factor.attempt_success) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH)) OR ((legacyEventType=core.user.factor.attempt_fail) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH))
      | stats count(eval(legacyEventType="core.user.factor.attempt_success"))  as successes count(eval(legacyEventType="core.user.factor.attempt_fail")) as failures count(eval(eventType="system.push.send_factor_verify_push")) as pushes
        BY user,_time
      | stats latest(_time) as lasttime earliest(_time) as firsttime sum(successes) as successes sum(failures) as failures sum(pushes) as pushes
        BY user
      | eval seconds=lasttime-firsttime
      | eval lasttime=strftime(lasttime, "%c")
      | search (pushes>1)
      | eval totalattempts=successes+failures
      | eval finding="Normal authentication pattern"
      | eval finding=if(failures==pushes AND pushes>1,"Authentication attempts not successful because multiple pushes denied",finding)
      | eval finding=if(totalattempts==0,"Multiple pushes sent and ignored",finding)
      | eval finding=if(successes>0 AND pushes>3,"Probably should investigate. Multiple pushes sent, eventual successful authentication!",finding)
      | `okta_mfa_exhaustion_hunt_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
references:
    - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
    - https://sec.okta.com/everythingisyes
    - https://splunkbase.splunk.com/app/6553
analytic_story:
    - Okta Account Takeover
    - Okta MFA Exhaustion
    - Scattered Lapsus$ Hunters
asset_type: Okta Tenant
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '1083.1125'
title: ProcDump Credential Harvest
description: 'Mimikatz is largely detected by AntiVirus software.As Procdump is a
  legitimate Microsoft tool, it''s not detected by AntiVirus. The goal is to dump
  the lsass.exe process, which contains the credentials, and then give this dump to
  mimikatz.You need Admin rights to use it. Dump the lsass process which contains
  credentials. -- Threat Actor Association: Agrius, Alloy Taurus/Gallium, Antlion,
  BlackCat, FamousSparrow, FIN12, FIN13, Hydrochasma, Lazarus, MuddyWater, TA551,
  Wizard Spider - Software Association: Bazarloader, Conti, Hafnium , IcedID, LockBit,
  NetWalker, Rhysida -- Atomics T1003.001 Test #2 Atomics T1003.001 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ("procdump" OR "dump64")
  "lsass" | rex field=_raw max_match=2 "(?<file>[a-zA-Z0-9]+\.dmp") | table _time,
  host, user process, file, session_id, signature_id parent_process_name| bin span=30s
  | stats values(*) as * by _time, host |where match(process, "(?i)procdump|dump64")
  AND match(process, "(?i)lsass") | table _time, host, user process, file, session_id,
  signature_id parent_process_name `hec_collect`'
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1003/001/
- https://github.com/LOLBAS-Project/LOLBAS/pull/182/commits/e14a01bbb5c0b06990cd8f6fc85ee5908ae3da32

id: '42185.81281'
title: Regini.exe Execution
description: Regini is a Windows command-line tool used to modify registry permissions
  and settings via scriptable .ini files, allowing administrators to automate registry
  management. Threat actors may abuse regini.exe to escalate privileges or establish
  persistence by modifying registry keys—such as SAM, SECURITY, or SYSTEM—to manipulate
  user access rights, enabling RID hijacking or unauthorized credential access. This
  use case detects executions of regini.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "regini.exe" OR TERM(regini) | where match(process_path, "(?i)\x5cregini\.exe")
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Regini/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini

id: '5851.11627'
title: Rundll32 Command Line
description: 'Adversaries may abuse rundll32.exe to proxy execution of malicious code.
  Using rundll32.exe, may avoid triggering security tools that may not monitor execution
  of the rundll32.exe process because of allowlists or false positives from normal
  operations. Rundll32.exe is commonly associated with executing DLL payloads. This
  use case specifically looks for command line argument executions with rundll32.
  -- Threat Actor Association: Alloy Taurus/Gallium, APT-K-47/Mysterious Elephant,
  APT29/Nobelium/Cozy Bear, APT35/Phosphorus/Magic Hound, FIN7, MuddyWater, Night
  Spider, TA413, TA551, Witchetty, Wizard Spider - Software Association: ALPHV/BlackCat,
  Bazar, Black Basta, Clop, Conti, Hancitor, HermeticWizard, Hive, IcedID, LOWZERO,
  MINEBRIDGE, PowerShortShell, PYSA/Mespinoza, Quantum, Qakbot/Qbot, Ransom Cartel,
  RATDispenser, Rhysida, Sodinokibi/REvil, SquirrelWaffle, Trickbot, XingLocker --
  Atomics T1218.011 Test#1 Atomics T1218.011 Test#2 Atomics T1218.011 Test#3 Atomics
  T1218.011 Test#4 Atomics T1218.011 Test#5 Atomics T1218.011 Test#6 Atomics T1218.011
  Test#7 Atomics T1218.011 Test#8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<")
  TERM(rundll32) | regex process="(?i)(rundll32)" | table _time, host, user parent_*,
  process, process_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://redcanary.com/threat-detection-report/techniques/rundll32/

id: '5850.6131'
title: Rundll32.exe as Parent Process
description: 'Adversaries may abuse rundll32.exe to proxy execution of malicious code.
  Using rundll32.exe, may avoid triggering security tools that may not monitor execution
  of the rundll32.exe process because of allowlists or false positives from normal
  operations. Rundll32.exe is commonly associated with executing DLL payloads. Threat
  Actor Association: MuddyWater, TA505, Wizard Spider - Software Association: Bazar,
  Clop, Conti, Quantum, Rhysida, Trickbot'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") TERM(rundll32) | regex parent_process_name="(?i)(rundll32)" |
  table _time, host, user parent_*, process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://redcanary.com/threat-detection-report/techniques/rundll32/

id: '24804.45866'
title: SoftPerfect Network Scanner Execution
description: 'SoftPerfect Network Scanner is a free port scanner that can be run without
  installation. Due to its portability, it is an attractive tool for threat actors
  during post-compromise discovery activities as reported by DFIR. This use case detects
  executions of netscan.exe, netscan32.exe, or netscan64.exe. While the tool itself
  is not considered malicious, unexpected use should be investigated as it may indicate
  unauthorized discovery activity. -- Software Association: Akira'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "netscan" | where match(process_name, "(?i)\x5cnetscan(32|64)?\.exe")
  or match(process_path, "(?i)\x5cnetscan_portable") | table _time, host, user, process,
  process_*, parent_process, parent_process_*, user | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows event logs
references:
- https://www.softperfect.com/products/networkscanner/
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://thedfirreport.com/2020/07/13/ransomware-again-but-we-changed-the-rdp-port/
- https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/

id: '5703.11169'
title: Windows Service Started
description: 'Adversaries may abuse the Windows service control manager to execute
  malicious commands or payloads. - Threat Actor Association: APT28 (aka.Fancy Bear,
  Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, Blackbyte, Carbanak, Earth Estries, Magic Hound (aka APT35, Charming Kitten,
  Phosphorus, and Mint Sandstorm) - Software Association: Ryuk, Snatch, WannaCry -
  Atomics T1569.002 Test#1 Atomics T1543.003 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  ) (TERM(sc) OR TERM(sc.exe) OR TERM(net) OR TERM(net.exe) OR TERM(net1.exe)) TERM(start)
  | table _time, host, user, signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:system services:service execution
technique_id:
- T1569.002
data_category:
- Process command-line parameters
- Windows Sysmon
references: null