Splunk rules: 17

id: '6142.6639'
title: 1 or 2 Character Executable
description: 'Adversaries have been known to occasionally use executable files named
  with only 1 or 2 word characters. - Threat Actor Association: Lotus Blossom, OilRig,
  Trigona, Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process OR TERM(ingress.event.procstart)) NOT "sc.exe"
  | where match(parent_process_name, "(?i)^\w{1,2}\.exe") OR match(process_name, "(?i)^\w{1,2}\.exe")
  | table _time, host, user, signature_id, process, process_*, parent_process_* |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- defense-evasion:masquerading
technique_id: 
- T1059
- T1036
data_category:
- Windows event logs
references:
- https://www.proofpoint.com/us/threat-insight/post/operation-rat-cook-chinese-apt-actors-use-fake-game-thrones-leaks-lures

name: Active Directory Privilege Escalation Identified
id: 583e8a68-f2f7-45be-8fc9-bf725f0e22fd
version: 10
creation_date: '2023-04-19'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: experimental
type: Correlation
description: The following analytic identifies potential privilege escalation activities within an organization's Active Directory (AD) environment. It detects this activity by correlating multiple analytics from the Active Directory Privilege Escalation analytic story within a specified time frame. This is significant for a SOC as it helps identify coordinated attempts to gain elevated privileges, which could indicate a serious security threat. If confirmed malicious, this activity could allow attackers to gain unauthorized access to sensitive systems and data, leading to potential data breaches and further compromise of the network.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
      WHERE All_Risk.analyticstories="Active Directory Privilege Escalation" All_Risk.risk_object_type="system"
      BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >= 4
    | `active_directory_privilege_escalation_identified_filter`
how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, but the number may need to be increased as the analytic story includes over 30 analytics. In addition, based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance.
known_false_positives: False positives will most likely be present based on risk scoring and how the organization handles system to system communication. Filter, or modify as needed. In addition to count by analytics, adding a risk score may be useful. In our testing, with 22 events over 30 days, the risk scores ranged from 500 to 80,000. Your organization will be different, monitor and modify as needed.
references:
    - https://attack.mitre.org/tactics/TA0004/
    - https://research.splunk.com/stories/active_directory_privilege_escalation/
finding:
    title: Active Directory Privilege Escalation Identified - $risk_object$
    entity:
        field: risk_object
        type: system
        score: 0
analytic_story:
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1484
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: AWS Defense Evasion Delete CloudWatch Log Group
id: d308b0f1-edb7-4a62-a614-af321160710f
version: 12
creation_date: '2022-07-19'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the deletion of CloudWatch log groups in AWS, identified through `DeleteLogGroup` events in CloudTrail logs. This detection leverages CloudTrail data to monitor for successful log group deletions, excluding console-based actions. This activity is significant as it indicates potential attempts to evade logging and monitoring, which is crucial for maintaining visibility into AWS activities. If confirmed malicious, this could allow attackers to hide their tracks, making it difficult to detect further malicious actions or investigate incidents within the compromised AWS environment.
data_source:
    - AWS CloudTrail DeleteLogGroup
search: |-
    `cloudtrail` eventName = DeleteLogGroup eventSource = logs.amazonaws.com userAgent !=console.amazonaws.com errorCode = success
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_defense_evasion_delete_cloudwatch_log_group_filter`
how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity.
references:
    - https://attack.mitre.org/techniques/T1562/008/
finding:
    title: User $user$ has deleted a CloudWatch logging group for account id $vendor_account$ from IP $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Defense Evasion
asset_type: AWS Account
mitre_attack_id:
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco NVM - Non-Network Binary Making Network Connection
id: c6db35af-8a0e-4b61-88ed-738e66f15715
version: 6
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects network connections initiated by binaries that are not typically associated with network communication,
    such as 'notepad.exe', 'calc.exe' or 'write.exe'.
    It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information.
    These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    process_name IN (
            "notepad.exe", "write.exe", "mspaint.exe", "calc.exe",
            "win32calc.exe", "addinutil.exe", "cmstp.exe", "dialer.exe",
            "eqnedt32.exe", "IMEWDBLD.exe"
            )
    NOT dest IN (
            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
            )
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___non_network_binary_making_network_connection_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Rare cases may exist where these binaries are used by plugins or third-party extensions to initiate outbound communication.
    However, such behavior is extremely uncommon and should be investigated for potential injection or abuse.
references:
    - https://redcanary.com/threat-detection-report/techniques/process-injection/
    - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The host $src$ observed $process_path$ initiating a network connection to $dest$ over port $dest_port$, which is highly unusual
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1055
    - T1036
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco SA - Automated Web Reconnaissance via HTTP Access Errors
id: 4cd44520-d404-4ca8-b736-c9d6b86ecf31
version: 2
creation_date: '2026-05-08'
modification_date: '2026-06-09'
author: Mahamudul Chowdhury, Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    This analytic detects probable automated web reconnaissance using Cisco Secure Access proxy telemetry.
    A high volume of HTTP client errors (401/403/404/etc) across many unique URLs in a short window is consistent with directory/file enumeration behavior generated by tools such as Gobuster, DirBuster, ffuf, or Burp Intruder.
    Detecting this pattern helps identify pre-exploitation scanning activity, insider reconnaissance, compromised endpoints performing discovery, and attempts to find hidden administrative paths, APIs, backups, and exposed application files.
data_source:
    - Cisco Secure Access Proxy
search: |-
    `cisco_secure_access_proxy`
    | eval src_ip=coalesce(src_ip, src)
    | eval host=coalesce(hostname, host)
    | eval user=coalesce(user, identities)
    | eval status=tonumber(status)
    | eval domain=replace(url, "^https?://([^/]+).*$", "\\1")
    | eval user_agent=coalesce(http_user_agent, user_agent)
    | where status IN (400, 401, 403, 404, 405, 407, 414, 429, 431)
    | bucket _time span=10m
    | stats count as errors dc(url) as unique_urls values(status) as statuses values(user_agent) as user_agent values(host) as host values(user) as user by src_ip domain _time
    | where errors > 100 AND unique_urls > 50
    | eval firstTime=_time, lastTime=_time
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_sa___automated_web_reconnaissance_via_http_access_errors_filter`
how_to_implement: |
    Ingest Cisco Secure Access proxy logs into Splunk using the Splunk Add-on for Cisco Security Cloud.
    Update the `cisco_secure_access_proxy` macro so it resolves to the index, source, and sourcetype values used in your deployment.
known_false_positives: |
    Aggressive web vulnerability scanners, QA automation, uptime monitoring, and authorized security assessments can generate high HTTP error volumes with large URL diversity.
    Tune by allow-listing known scanner hosts, user agents, test domains, and approved assessment windows using the filter macro.
references:
    - https://attack.mitre.org/techniques/T1595/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Source $src_ip$ triggered probable automated web reconnaissance on $domain$ with $errors$ HTTP access errors across $unique_urls$ unique URLs.
threat_objects:
    - field: domain
      type: domain
    - field: src_ip
      type: ip_address
analytic_story:
    - Cisco Secure Access Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1595
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: threat

name: Disable Defender MpEngine Registry
id: cc391750-3024-11ec-955a-acde48001122
version: 16
creation_date: '2021-10-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the Windows Defender MpEngine registry value, specifically setting MpEnablePus to 0x00000000. This detection leverages endpoint registry logs, focusing on changes within the path "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*". This activity is significant as it indicates an attempt to disable key Windows Defender features, potentially allowing malware to evade detection. If confirmed malicious, this could lead to undetected malware execution, persistence, and further system compromise. Immediate investigation and endpoint isolation are recommended.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_mpengine_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
finding:
    title: Modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - IcedID
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: DNS Exfiltration Using Nslookup App
id: 2452e632-9e0d-11eb-bacd-acde48001122
version: 14
creation_date: '2021-04-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Wouter Jansen
status: production
type: TTP
description: The following analytic identifies potential DNS exfiltration using the nslookup application. It detects specific command-line parameters such as query type (TXT, A, AAAA) and retry options, which are commonly used by attackers to exfiltrate data. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process execution logs. This activity is significant as it may indicate an attempt to communicate with a Command and Control (C2) server or exfiltrate sensitive data. If confirmed malicious, this could lead to data breaches and unauthorized access to critical information.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*"
        OR
        Processes.process="*-qt=*"
        OR
        Processes.process="*-q=*"
        OR
        Processes.process="*-type=*"
        OR
        Processes.process="*-retry=*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `dns_exfiltration_using_nslookup_app_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: admin nslookup usage
references:
    - https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings
    - https://www.varonis.com/blog/dns-tunneling
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious DNS Traffic
    - Dynamic DNS
    - Data Exfiltration
    - Command And Control
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1048
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31087.55678'
title: EnableLUA Registry Value Modified
description: Adversaries may bypass UAC mechanisms to elevate process privileges on
  system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. This use case detects
  registry modification events or process executions with registry modification commands
  targeting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR
  "<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)
  "ADD" OR "Set-ItemProperty" OR "sp ")) "EnableLUA" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  | table _time, host, user user, process, process_*, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1548/002/

name: Execution of File with Multiple Extensions
id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
version: 17
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of files with multiple extensions, such as ".doc.exe" or ".pdf.exe". This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the file name contains double extensions. This activity is significant because attackers often use double extensions to disguise malicious executables as benign documents, increasing the likelihood of user execution. If confirmed malicious, this technique can lead to unauthorized code execution, potentially compromising the endpoint and allowing further malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", "*.docx.exe", "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*.rtf.exe")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name(Processes)`
    | `execution_of_file_with_multiple_extensions_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
finding:
    title: process $process$ have double extensions in the file name is executed on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: process $process$ have double extensions in the file name is executed on $dest$ by $user$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows File Extension and Association Abuse
    - Masquerading - Rename System Utilities
    - AsyncRAT
    - DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
    - T1036.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GSuite Email Suspicious Attachment
id: 6d663014-fe92-11eb-ab07-acde48001122
version: 10
creation_date: '2021-08-16'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious attachment file extensions in GSuite emails, potentially indicating a spear-phishing attack. It leverages GSuite Gmail logs to identify emails with attachments having file extensions commonly associated with malware, such as .exe, .bat, and .js. This activity is significant as these file types are often used to deliver malicious payloads, posing a risk of compromising targeted machines. If confirmed malicious, this could lead to unauthorized code execution, data breaches, or further network infiltration.
data_source:
    - G Suite Gmail
search: |-
    `gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go")
      | eval phase="plan"
      | eval severity="medium"
      | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size
        BY destination{}.service num_message_attachments subject
           destination{}.address source.address phase
           severity
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gsuite_email_suspicious_attachment_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
references:
    - https://www.redhat.com/en/topics/devops/what-is-devsecops
intermediate_findings:
    entities:
        - field: destination{}.address
          type: user
          score: 20
          message: Suspicious email from $source.address$ to $destination{}.address$
threat_objects:
    - field: source.address
      type: email_address
analytic_story:
    - Dev Sec Ops
asset_type: GSuite
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint

name: Internal Horizontal Port Scan NMAP Top 20
id: 3141a041-4f57-4277-9faa-9305ca1f8e5b
version: 12
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using on of the NMAP top 20 ports. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
data_source:
    - AWS CloudWatchLogs VPCflow
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            dc(All_Traffic.dest_ip) as totalDestIPCount
            values(All_Traffic.action) as action
            values(All_Traffic.dest_zone) as dest_zone
            values(All_Traffic.rule) as rule
            values(All_Traffic.src_category) as src_category
            values(All_Traffic.src_port) as src_port
            values(All_Traffic.src_zone) as src_zone

    from datamodel=Network_Traffic where

    All_Traffic.src_ip IN (
      "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
      "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
      "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
      "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
      "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4"
    )
    All_Traffic.dest_port IN (
      21, 22, 23, 25, 53, 80, 110, 111,
      135, 139, 143, 443, 445, 993, 995,
      1723, 3306, 3389, 5900, 8080
    )

    by span=1h _time
       All_Traffic.src_ip All_Traffic.dest_port
       All_Traffic.transport

    | `drop_dm_object_name("All_Traffic")`
    | where totalDestIPCount>=250
    | eval dest_port=transport + "/" + dest_port
    | stats min(firstTime) as firstTime
            max(lastTime) as lastTime
            dc(dest_port) as num_ports_scanned
            sum(totalDestIPCount) as totalDestIPCount
            values(action) as action
            values(dest_port) as dest_ports
            values(dest_zone) as dest_zone
            values(rule) as rule
            values(src_category) as src_category
            values(src_zone) as src_zone
      by _time src_ip
    | fields - _time
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `internal_horizontal_port_scan_nmap_top_20_filter`
how_to_implement: To properly run this search, Splunk needs to ingest data from networking telemetry sources such as firewalls like Cisco Secure Firewall, NetFlow, or host-based networking events. Ensure that the Network_Traffic data model is populated to enable this search effectively.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination IPs
    entity:
        field: src_ip
        type: system
        score: 50
analytic_story:
    - Network Discovery
    - Cisco Secure Firewall Threat Defense Analytics
    - China-Nexus Threat Activity
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1046
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Linux Auditd Install Kernel Module Using Modprobe Utility
id: 95165985-ace5-4d42-9c42-93a89a5af901
version: 11
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd` type=SYSCALL comm=modprobe
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY comm exe syscall
           uid ppid pid
           success dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_install_kernel_module_using_modprobe_utility_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
    - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
    - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to install a Linux kernel module using the modprobe utility.
analytic_story:
    - Linux Privilege Escalation
    - Linux Rootkit
    - Linux Persistence Techniques
    - Compromised Linux Host
    - China-Nexus Threat Activity
asset_type: Endpoint
mitre_attack_id:
    - T1547.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Virtual Disk File And Directory Discovery
id: eec78cef-d4c8-4b35-8f5b-6922102a4a41
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring for unusual or unauthorized searches for virtual disk files and directories, this analytic helps identify potential reconnaissance activities, enabling security teams to respond promptly and safeguard against unauthorized access and data breaches.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command IN ("*find*", "*grep*")  AND execve_command IN ("*.vhd*", "*.vhdx*", "*.vmdk*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_virtual_disk_file_and_directory_discovery_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
    - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$execve_command$] event occurred on host - [$dest$] to discover virtual disk files and directories.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1083
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Suspicious Redis Activity
id: 098bbfa8-a591-44ab-9ec0-ae8ee82b4450
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects Redis processes spawning a system shell command. This can indicate exploitation activity of a redis server to gain code execution.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    (
        Processes.parent_process_name IN (
            "redis-sentinel",
            "redis-server"
        )
        OR
        Processes.parent_process_path = "*/bin/redis*"
    )

    Processes.process_name IN (
        "awk", "bash", "curl", "dash", "gawk", "id", "ifconfig",
        "lua", "nc", "ncat", "netcat", "openssl", "perl", "php",
        "python", "python2", "python3", "ruby", "sh", "socat",
        "wget", "whoami", "zsh"
    )

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_current_directory Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_suspicious_redis_activity_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate administrative scripts or automated maintenance tasks may trigger this detection when managing Redis configurations or performing system operations. Filter based on known administrative activity and approved management tools.
references:
    - https://thesecmaster.com/how-to-fix-cve-2022-0543-a-critical-lua-sandbox-escape-vulnerability-in-redis/
    - https://www.bleepingcomputer.com/news/security/new-p2pinfect-worm-malware-targets-linux-and-windows-redis-servers/
finding:
    title: Suspicious Redis Activity identified on [$dest$] via [$process_name$] with the Command Line [$process$]
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Post-Exploitation
    - Compromised Linux Host
    - Linux Persistence Techniques
    - Linux Privilege Escalation
    - Linux Living Off The Land
    - Command And Control
asset_type: Endpoint
cve:
    - CVE-2022-0543
mitre_attack_id:
    - T1505
    - T1210
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1050.1080'
title: Malicious Document Execution
description: 'This rule is attempting to detect anytime a Microsoft Office OR Adobe
  program (ex. Word, Excel, Adobe) spawns a process that could be indicative of those
  Office programs used to deliver malicious code. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT10/menuPass, APT29, APT34/OilRig, APT37, Arid Viper/APT C-23, Blind Eagle/APT-C-36,
  Carbanak, Evilnum, FIN6, FIN7, Gamaredon Group/Shuckworm, Kimsuky, Lazarus, ModifiedElephant,
  MuddyWater, NewsPenguin, RedEyes, RomCom, SideWinder, TA428, TA505, TA551, Turla
  (akaSecret Blizzard, KRYPTON, and UAC-0003), Winter Vivern, WIRTE, Wizard Spider
  -- Software Association: Bazarloder, Black Basta, Clop, Conti, Dridex, Emotet, GlowSand,
  Hancitor, IcedID, Lockbit, MINEBRIDGE, MirrorBlast, PowerShortShell, QakBot, RATDispenser,
  Sodinokibi/REvil, SquirrelWaffle, Trickbot, Zumkong -- #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM("powershell.exe") OR TERM("cmd.exe") OR
  TERM("wscript.exe") OR TERM("cscript.exe") OR "regsvr32.exe" OR "rundll32.exe" OR
  "wmic" OR "control.exe") ((TERM(Microsoft) TERM(Office)) OR TERM(WINWORD.EXE) OR
  TERM(EXCEL.EXE) OR TERM(POWERPNT.EXE) OR TERM(MSACCESS.EXE) OR TERM(OUTLOOK.EXE)
  OR TERM(VISIO.EXE) OR TERM(WINPROJ.EXE) OR TERM(pdf) OR TERM(wordpad.exe) OR TERM(ONENOTE.EXE))|
  regex "(?i)(Microsoft Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(ONENOTE\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(AcroRd32\.exe)|(Acrobat\.exe)|(FoxitPhantomPDF\.exe)|(FoxitReader\.exe)|(wordpad\.exe)"
  | table _time, host, user process, parent_*, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host, parent_process_name | where match(parent_process_path,"(?i)(Microsoft
  Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(ONENOTE\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(AcroRd32\.exe)|(Acrobat\.exe)|(FoxitPhantomPDF\.exe)|(FoxitReader\.exe)|(wordpad\.exe)") '
techniques:
- initial-access:phishing:spearphishing attachment
- execution:user execution:malicious link
- execution:user execution:malicious file
technique_id:
- T1566.001
- T1204.001
- T1204.002
data_category:
- Windows event logs
references:
- https://success.trendmicro.com/solution/000279049

id: '8155.17236'
title: Radmin execution
description: Adversaries may gain access to and use third-party software suites installed
  within an enterprise network, such as administration, monitoring, and deployment
  systems, to move laterally through the network. Radmin is a remote management software
  that can be used to remotely control workstations. Silence Atomics T1072 Test#1
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "radmin.exe" OR "/connect:*" | table _time, host, user process, process_*, signature_id,
  parent_* | bin span=1s | stats values(*) as * by _time, host | where match(process_name,
  "(?i)radmin") OR match(process, "(?i)\/connect\:.*?\:") '
techniques:
- execution:software deployment tools
- lateral-movement:software deployment tools
technique_id: 
- T1072
data_category:
- Windows Sysmon
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

id: '9038.12147'
title: RDP Logon_Logoff Event
description: 'This use case looks for Other Logon/Logoff Events, where an rdp logon/logoff
  event has occurred. -- Threat Actor Association: Agrius, Daixin Team, Flax Typhoon,
  Karakurt, Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944), UNC5221, UTA0178
  - Software Association: Akira, AvosLocker, BianLian, Blackcat/ALPHV, BlackByte,
  Lockbit, LV, Play, Quantum, Rhysida, Royal, Snatch, Trigona'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=4778 OR "Event>ID>4778<"
  OR EventCode=4779 OR "Event>ID>4779<") TERM(RDP) | table _time, host, user dest,
  direction, event_id, eventtype, parent_*, process, process_*, user, user_id, src_*,
  dest_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:remote desktop protocol
- initial-access:external remote services
technique_id:
- T1021.001
- T1133
data_category:
- Windows event logs
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

name: Suspicious DLLHost no Command Line Arguments
id: ff61e98c-0337-4593-a78f-72a676c56f26
version: 14
creation_date: '2021-02-23'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects instances of DLLHost.exe executing without command line arguments. This behavior is unusual and often associated with malicious activities, such as those performed by Cobalt Strike. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because DLLHost.exe typically requires arguments to function correctly, and its absence may indicate an attempt to evade detection. If confirmed malicious, this could lead to unauthorized actions like credential dumping or file manipulation, posing a severe threat to the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where
    (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
    Processes.process IN ("*dllhost","*dllhost.exe", "*dllhost.exe\"")
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_dllhost_no_command_line_arguments_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process.
references:
    - https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/
finding:
    title: Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$
analytic_story:
    - BlackByte Ransomware
    - Cobalt Strike
    - Graceful Wipe Out Attack
    - Cactus Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint