Splunk rules: 19

name: Cisco Secure Firewall - File Download Over Uncommon Port
id: f26445a8-a6a2-4855-bec0-0c39e52e5b8f
version: 8
creation_date: '2025-04-09'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). Adversaries may attempt to bypass protocol-based detection or use alternate ports to blend in with other traffic. This analytic identifies these non-conventional flows and surfaces potential evasion techniques. If confirmed malicious this indicate potential malware delivery or other nefarious activity.
data_source:
    - Cisco Secure Firewall Threat Defense File Event
search: |
    `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" NOT dest_port IN (80, 443)
    | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(file_name) as file_name
            values(uri) as uri
            values(ClientApplication) as ClientApplication
            values(file_hash) as file_hash
            values(SHA_Disposition) as SHA_Disposition
            by FileDirection FileType app ThreatName dest_port Description src dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime src dest dest_port FileDirection FileType Description uri ClientApplication file_name file_hash SHA_Disposition ThreatName
    | `cisco_secure_firewall___file_download_over_uncommon_port_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: Some legitimate applications may download files over custom ports (e.g., CDN mirrors, APIs). Apply additional filters accordingly.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The host $src$ downloaded a file $file_name$ of type $FileType$ from $dest$ over the uncommon port $dest_port$
threat_objects:
    - field: file_hash
      type: file_hash
    - field: file_name
      type: file_name
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1105
    - T1571
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Cisco Secure Firewall - Oracle E-Business Suite Correlation
id: 9e995d21-6870-43de-acd9-76f372bcf323
version: 7
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk, Talos NTDR
status: production
type: TTP
description: |
    This correlation rule identifies potential exploitation attempts of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884) by correlating multiple intrusion signatures from Cisco Secure Firewall Threat Defense logs.
    The detection looks for specific signatures that indicate attempts to exploit the TemplatePreview functionality and vulnerable SyncServlet endpoints as well as post compromise activity involving Cl0p.
    By correlating these signatures, the analytic aims to identify coordinated exploitation attempts that may indicate an attacker is targeting Oracle E-Business Suite installations.
    Security teams should investigate any instances of these correlated signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (65454, 65455, 65377, 65378, 65413, 65414, 65415, 65456)
    | bin _time span=5m
    | fillnull
    | stats dc(signature_id) as unique_signature_count
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
            sum(eval(signature_id==65454)) as sig_template_preview
            sum(eval(signature_id==65455)) as sig_sync_servlet
            sum(eval(signature_id IN (65377,65378,65413,65414,65415,65456))) as sig_exploit_activity
      by src dest
    | where (
              (
                sig_exploit_activity >= 1
                AND
                (
                  sig_template_preview >= 1
                  OR
                  sig_sync_servlet >= 1
                )
              )
            OR
              (
                sig_template_preview >= 1
                AND
                sig_sync_servlet >= 1
              )
            OR
              unique_signature_count >= 2
            )
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___oracle_e_business_suite_correlation_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: False positives should be very unlikely.
references:
    - https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
    - https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
    - https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/
    - https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
finding:
    title: Multiple Oracle E-Business Suite exploitation signatures $signature_id$ detected from source IP $src$ to destination IP $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Oracle E-Business Suite Exploitation
asset_type: Network
cve:
    - CVE-2025-61882
    - CVE-2025-61884
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Crowdstrike Admin With Duplicate Password
id: b8bccfbf-6ac2-40f2-83b6-e72b7efaa7d4
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects CrowdStrike alerts for admin accounts with duplicate password risk, identifying instances where administrative users share the same password. This practice significantly increases the risk of unauthorized access and potential breaches. Addressing these alerts promptly is crucial for maintaining strong security protocols, ensuring each admin account uses a unique, secure password to protect critical systems and data.
data_source: []
search: |-
    `crowdstrike_identities` primaryDisplayName = "*admin*"
      | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY domain dn primaryDisplayName
           risk_type severity riskScore
           riskScoreSeverity user role_type
      | where risk_type = "DUPLICATE_PASSWORD"
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_admin_with_duplicate_password_filter`
how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
finding:
    title: Duplicate Password for Admin User found on $domain$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Distributed Password Spray Attempts
id: b1a82fc8-8a9f-4344-9ec2-bde5c5331b57
version: 7
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: Hunting
description: This analytic employs the 3-sigma approach to identify distributed password spray attacks. A distributed password spray attack is a type of brute force attack where the attacker attempts a few common passwords against many different accounts, connecting from multiple IP addresses to avoid detection. By utilizing the Authentication Data Model, this detection is effective for all CIM-mapped authentication events, providing comprehensive coverage and enhancing security against these attacks.
data_source:
    - Azure Active Directory Sign-in activity
search: >-
    | tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts
    dc(Authentication.src) as unique_src values(Authentication.app) as app values(Authentication.src)
    as src count(Authentication.user) as total_failures from datamodel=Authentication.Authentication
    where Authentication.action="failure" NOT Authentication.src IN ("-","unknown")
    Authentication.user_agent="*" by Authentication.signature_id, Authentication.user_agent,
    sourcetype, _time  span=10m
    | `drop_dm_object_name("Authentication")`
    ```fill out time buckets for 0-count events during entire search length```
    | appendpipe [| timechart limit=0 span=10m count | table _time]
    | fillnull value=0 unique_accounts, unique_src
    ``` Create aggregation field & apply to all null events```
    | eval counter=sourcetype+"__"+signature_id
    | eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)  |
    stats values(total_failures) as total_failures values(signature_id) as signature_id
    values(src) as src values(sourcetype) as sourcetype values(app) as app count by
    counter unique_accounts unique_src user_agent _time
      ``` remove 0 count rows where counter has data```
    | sort - _time unique_accounts
    | dedup _time counter
    ``` 3-sigma detection logic ```
    | eventstats avg(unique_accounts) as comp_avg_user , stdev(unique_accounts) as comp_std_user
    avg(unique_src) as comp_avg_src , stdev(unique_src) as comp_std_src by counter user_agent
    | eval upperBoundUser=(comp_avg_user+comp_std_user*3), upperBoundsrc=(comp_avg_src+comp_std_src*3)
    | eval isOutlier=if((unique_accounts > 30 and unique_accounts >= upperBoundUser)
    and (unique_src > 30 and unique_src >= upperBoundsrc), 1, 0)
    | replace "::ffff:*" with * in src
    | where isOutlier=1
    | foreach *
        [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)]
    | mvexpand src  | iplocation src  | table _time, unique_src, unique_accounts, total_failures,
    sourcetype, signature_id, user_agent, src, Country
    | eval date_wday=strftime(_time,"%a"), date_hour=strftime(_time,"%H")
    | `detect_distributed_password_spray_attempts_filter`
how_to_implement: Ensure that all relevant authentication data is mapped to the Common Information Model (CIM) and that the src field is populated with the source device information. Additionally, ensure that fill_nullvalue is set within the security_content_summariesonly macro to include authentication events from log sources that do not feature the signature_id field in the results.
known_false_positives: It is common to see a spike of legitimate failed authentication events on monday mornings.
references:
    - https://attack.mitre.org/techniques/T1110/003/
analytic_story:
    - Compromised User Account
    - Active Directory Password Spraying
asset_type: Endpoint
atomic_guid:
    - 90bc2e54-6c84-47a5-9439-0a2a92b4b175
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

name: Detect Windows DNS SIGRed via Splunk Stream
id: babd8d10-d073-11ea-87d0-0242ac130003
version: 9
creation_date: '2020-08-04'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic detects attempts to exploit the SIGRed vulnerability (CVE-2020-1350) in Windows DNS servers. It leverages Splunk Stream DNS and TCP data to identify DNS SIG and KEY records, as well as TCP payloads exceeding 65KB. This activity is significant because SIGRed is a critical wormable vulnerability that allows remote code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially disrupt services, leading to severe data breaches and infrastructure compromise. Immediate investigation and remediation are crucial to mitigate these risks.
data_source: []
search: |
    `stream_dns`
    | spath "query_type{}"
    | search "query_type{}" IN (SIG,KEY)
    | spath protocol_stack
    | search protocol_stack="ip:tcp:dns"
    | append [search `stream_tcp` bytes_out>65000]
    | stats count by flow_id
    | where count>1
    | fields - count
    | `detect_windows_dns_sigred_via_splunk_stream_filter`
how_to_implement: You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We are detecting SIG and KEY records via stream:dns and TCP payload over 65KB in size via stream:tcp.  Replace the macro definitions ('stream:dns' and 'stream:tcp') with configurations for your Splunk environment.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: Potential SIGRed activity detected [ $flow_id$ ]
    entity:
        field: flow_id
        type: other
        score: 50
analytic_story:
    - Windows DNS SIGRed CVE-2020-1350
asset_type: Endpoint
cve:
    - CVE-2020-1350
mitre_attack_id:
    - T1203
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Disable Defender AntiVirus Registry
id: aa4f695a-3024-11ec-9987-acde48001122
version: 19
creation_date: '2021-10-18'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of Windows Defender registry settings to disable antivirus and antispyware protections. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with Windows Defender policies. This activity is significant because disabling antivirus protections is a common tactic used by adversaries to evade detection and maintain persistence on compromised systems. If confirmed malicious, this action could allow attackers to execute further malicious activities undetected, leading to potential data breaches, system compromise, and further propagation of malware within the network.
data_source:
    - Sysmon EventID 13
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
    WHERE (
            Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" AND
            Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") AND
            Registry.registry_value_data IN (1, 0x00000001)
          )
            by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
            | `drop_dm_object_name(Registry)`
            | where isnotnull(registry_value_data)
            | `security_content_ctime(firstTime)`
            | `security_content_ctime(lastTime)`
            | `disable_defender_antivirus_registry_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
finding:
    title: Modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - Windows Registry Abuse
    - CISA AA24-241A
    - IcedID
    - Black Basta Ransomware
    - Cactus Ransomware
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '16818.27145'
title: File and Directory Discovery Output to File - Windows
description: 'Adversaries may enumerate files and directories or may search in specific
  locations of a host or network share for certain information within a file system.
  Adversaries may use the information from File and Directory Discovery during automated
  discovery to shape follow-on behaviors, including whether or not the adversary fully
  infects the target and/or attempts specific actions. -- Threat Actor Association:
  APT28 (aka. Fancy Bear, Forest Blizzard, Strontium, Tsar Team) -- Atomics T1083
  Test #1 Atomics T1083 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(tree) OR TERM(dir) OR TERM(Get-ChildItem) OR TERM(gci) OR TERM(ls) OR TERM(locate)
  OR TERM(find)) (TERM(>>) OR "&gt;&gt;" OR TERM(Out-File)) | table _time, host, user
  process, process_*, parent_process_name | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- discovery:file and directory discovery
technique_id: 
- T1083
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1083/T1083.md#atomic-test-1---file-and-directory-discovery-cmdexe

name: GitHub Organizations Disable Dependabot
id: 69078d8c-0de6-45de-bb00-14e78e042fd6
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when a user disables Dependabot security features within a GitHub repository. Dependabot helps automatically identify and fix security vulnerabilities in dependencies. The detection monitors GitHub Enterprise logs for configuration changes that disable Dependabot functionality. This behavior could indicate an attacker attempting to prevent the automatic detection of vulnerable dependencies, which would allow them to exploit known vulnerabilities that would otherwise be patched. For a SOC, identifying the disabling of security features like Dependabot is critical as it may be a precursor to supply chain attacks where attackers exploit vulnerable dependencies. The impact could be severe if vulnerabilities remain unpatched, potentially leading to code execution, data theft, or other compromises through the software supply chain.
data_source:
    - GitHub Organizations Audit Logs
search: |-
    `github_organizations` vendor_action=repository_vulnerability_alerts.disable
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_ip,
           actor_is_bot, actor_location.country_code, business,
           business_id, org, org_id,
           repo, repo_id, user,
           user_agent, user_id, vendor_action
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_organizations_disable_dependabot_filter`
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Dependabot security features are disabled in repository $repo$ by $user$
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
asset_type: GitHub
mitre_attack_id:
    - T1685
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '6091.6540'
title: Go Run Execution
description: Malicious actors are beginning to turn to Golang as a malware language
  since it is not typically picked up by antivirus software. Although the language
  is about 10 years old, and is used by many legitimate programmers, there has not
  been as much activity with Golang malware. This use case looks for run executions
  by go.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(GO) OR "go.exe") TERM(RUN) | rex field=process
  (?<ioc>"(?i)\S+\.go") | table _time, host, user, signature_id, process, process_*,
  parent_process_* ioc | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.f5.com/labs/articles/threat-intelligence/new-golang-malware-is-spreading-via-multiple-exploits-to-mine-mo

name: Kubernetes Scanning by Unauthenticated IP Address
id: f9cadf4e-df22-4f4e-a08f-9d3344c2165d
version: 10
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic identifies potential scanning activities within a Kubernetes environment by unauthenticated IP addresses. It leverages Kubernetes audit logs to detect multiple unauthorized access attempts (HTTP 403 responses) from the same source IP. This activity is significant as it may indicate an attacker probing for vulnerabilities or attempting to exploit known issues. If confirmed malicious, such scanning could lead to unauthorized access, data breaches, or further exploitation of the Kubernetes infrastructure, compromising the security and integrity of the environment.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` "user.groups{}"="system:unauthenticated" "responseStatus.code"=403
      | iplocation sourceIPs{}
      | stats count values(userAgent) as userAgent values(user.username) as user.username values(user.groups{}) as user.groups{} values(verb) as verb values(requestURI) as requestURI values(responseStatus.code) as responseStatus.code values(responseStatus.message) as responseStatus.message values(responseStatus.reason) as responseStatus.reason values(responseStatus.status) as responseStatus.status
        BY sourceIPs{} Country City
      | where count > 5
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_scanning_by_unauthenticated_ip_address_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Kubernetes scanning from ip $src_ip$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1046
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Deletion Of Services
id: b509bbd3-0331-4aaa-8e4a-d2affe100af6
version: 12
creation_date: '2022-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the deletion of services on a Linux machine. It leverages filesystem event logs to identify when service files within system directories (e.g., /etc/systemd/, /lib/systemd/, /run/systemd/) are deleted. This activity is significant because attackers may delete or modify services to disable security features or evade defenses. If confirmed malicious, this behavior could indicate an attempt to impair system functionality or execute a destructive payload, potentially leading to system instability or data loss. Immediate investigation is required to determine the responsible process and user.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=deleted Filesystem.file_path IN ( "/etc/systemd/*", "*/lib/systemd/*", "*/run/systemd/*") Filesystem.file_path = "*.service"
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_deletion_of_services_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
    - https://unix.stackexchange.com/questions/224992/where-do-i-put-my-systemd-unit-file
    - https://cert.gov.ua/article/3718487
finding:
    title: A services file $file_name$ deteted on host $dest$ by process GUID -  $process_guid$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - AwfulShred
    - AcidRain
    - Data Destruction
    - AcidPour
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux RPM Privilege Escalation
id: f8e58a23-cecd-495f-9c65-6c76b4cb9774
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the RPM Package Manager with elevated privileges, specifically when it is used to run system commands as root via the `--eval` and `lua:os.execute` options. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to gain root access. If confirmed malicious, this could lead to full system compromise, unauthorized access to sensitive data, and further exploitation of the environment.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*rpm*--eval*"
        AND
        Processes.process="*lua:os.execute*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_rpm_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/rpm/
    - https://en.wikipedia.org/wiki/RPM_Package_Manager
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '13811.20280'
title: Potential DCSync
description: 'Adversaries may attempt to access credentials and other sensitive information
  by abusing a Windows Domain Controller''s application programming interface (API)
  to simulate the replication process from a remote domain controller using a technique
  called DCSync. -- Threat Actor Association: FIN8 (Syssphinx), Muddled Libra'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4662) OR
  "<EventID>4662<") "0x100" ("Replicating Directory Changes all" OR "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
  OR "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" OR "9923a32a-3607-11d2-b9be-0000f87a36b2"
  OR "89e95b76-444d-4c62-991a-0facbeda640c") |regex user!=".*\$" | table _time, host,
  user process, process_*, signature_id, parent_*, parameters | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:dcsync
technique_id:
- T1003.006
data_category:
- Windows event logs
references:
- https://blog.blacklanternsecurity.com/p/detecting-dcsync

name: Print Processor Registry Autostart
id: 1f5b68aa-2037-11ec-898e-acde48001122
version: 12
creation_date: '2021-09-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious modifications or new entries in the Print Processor registry path. It leverages registry activity data from the Endpoint data model to identify changes in the specified registry path. This activity is significant because the Print Processor registry is known to be exploited by APT groups like Turla for persistence and privilege escalation. If confirmed malicious, this could allow an attacker to execute a malicious DLL payload by restarting the spoolsv.exe process, leading to potential control over the compromised machine.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `print_processor_registry_autostart_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
known_false_positives: possible new printer installation may add driver component on this registry.
references:
    - https://attack.mitre.org/techniques/T1547/012/
    - https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Data Destruction
    - Windows Privilege Escalation
    - Hermetic Wiper
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1547.012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious Computer Account Name Change
id: 35a61ed8-61c4-11ec-bc1e-acde48001122
version: 14
creation_date: '2021-12-20'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects a suspicious computer account name change in Active Directory. It leverages Event ID 4781, which logs account name changes, to identify instances where a computer account name is changed to one that does not end with a `$`. This behavior is significant as it may indicate an attempt to exploit CVE-2021-42278 and CVE-2021-42287, which can lead to domain controller impersonation and privilege escalation. If confirmed malicious, this activity could allow an attacker to gain elevated privileges and potentially control the domain.
data_source:
    - Windows Event Log Security 4781
search: |-
    `wineventlog_security` EventCode=4781 OldTargetUserName="*$" NewTargetUserName!="*$"
      | table _time, Computer, Caller_User_Name, OldTargetUserName, NewTargetUserName
      | rename Computer as dest
      | `suspicious_computer_account_name_change_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
known_false_positives: Renaming a computer account name to a name that not end with '$' is highly unsual and may not have any legitimate scenarios.
references:
    - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
finding:
    title: A computer account $OldTargetUserName$ was renamed with a suspicious computer name on $dest$
    entity:
        field: OldTargetUserName
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A computer account $OldTargetUserName$ was renamed with a suspicious computer name on $dest$
analytic_story:
    - Active Directory Privilege Escalation
    - Compromised Windows Host
    - sAMAccountName Spoofing and Domain Controller Impersonation
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
cve:
    - CVE-2021-42287
    - CVE-2021-42278
mitre_attack_id:
    - T1078.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '8445.10630'
title: Suspicious process Spawned by Java
description: 'Detect Java Spawning suspicious processes. This could indicate successful
  execution of vulnerabilities such as log4j CVE-2021-44228. - Threat Actor Association:
  Evilnum, Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "java.exe" ("powershell.exe" OR "cmd.exe" OR "AppInstaller.exe"
  OR "Bitsadmin.exe" OR "CertOC.exe" OR "CertReq.exe" OR "cmdl32.exe" OR "Control.exe"
  OR "Cscript.exe" OR "Desktopimgdownldr.exe" OR "Diantz.exe" OR "Esentutl.exe" OR
  "Eventvwr.exe" OR "Expand.exe" OR "Extrac32.exe" OR "Findstr.exe" OR "Finger.exe"
  OR "Ftp.exe" OR "GfxDownloadWrapper.exe" OR "Hh.exe" OR "IMEWDBLD.exe" OR "Ieexec.exe"
  OR "Installutil.exe" OR "Makecab.exe" OR "MpCmdRun.exe" OR "Mshta.exe" OR "Msiexec.exe"
  OR "OneDriveStandaloneUpdater.exe" OR "PrintBrm.exe" OR "Regasm.exe" OR "Regsvr32.exe"
  OR "Replace.exe" OR "Rundll32.exe" OR "Sc.exe" OR "Schtasks.exe" OR "Wmic.exe" OR
  "Wscript.exe" OR "Xwizard.exe" OR "Excel.exe" OR "Powerpnt.exe" OR "Squirrel.exe"
  OR "Winword.exe" OR "Wsl.exe" OR "nslookup.exe" OR "Certutil.exe") | table _time,
  host, user event_id, parent_*, process_*, process, signature_id | bin span=1s |
  stats values(*) as * by _time, host | where match(parent_process_name,"(?i)java\.exe") '
techniques:
- execution:exploitation for client execution
technique_id: 
- T1203
data_category:
- Windows event logs
references:
- https://blog.qualys.com/vulnerabilities-threat-research/2021/12/14/log4shell-exploit-detection-and-response-with-qualys-multi-vector-edr

name: Suspicious Process With Discord DNS Query
id: 4d4332ae-792c-11ec-89c1-acde48001122
version: 14
creation_date: '2022-01-19'
modification_date: '2026-06-25'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies a process making a DNS query to Discord, excluding legitimate Discord application paths. It leverages Sysmon logs with Event ID 22 to detect DNS queries containing "discord" in the QueryName field. This activity is significant because Discord can be abused by adversaries to host and download malicious files, as seen in the WhisperGate campaign. If confirmed malicious, this could indicate malware attempting to download additional payloads from Discord, potentially leading to further code execution and compromise of the affected system.
data_source:
    - Sysmon EventID 22
search: '`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`'
how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query.
known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
references:
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
intermediate_findings:
    entities:
        - field: dvc
          type: system
          score: 20
          message: suspicious process $process_name$ has a dns query in $QueryName$ on $dvc$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Data Destruction
    - WhisperGate
    - PXA Stealer
    - Cactus Ransomware
    - BlankGrabber Stealer
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1059.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Unusual Number of Kerberos Service Tickets Requested
id: eb3e6702-8936-11ec-98fe-acde48001122
version: 14
creation_date: '2022-02-16'
modification_date: '2026-05-13'
author: Mauricio Velazco, Dean Luxton, Splunk
status: production
type: Anomaly
description: The following analytic identifies an unusual number of Kerberos service ticket requests, potentially indicating a kerberoasting attack. It leverages Kerberos Event 4769 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This activity is significant as kerberoasting allows adversaries to request service tickets and crack them offline, potentially gaining privileged access to the domain. If confirmed malicious, this could lead to unauthorized access to sensitive accounts and escalation of privileges within the Active Directory environment.
data_source:
    - Windows Event Log Security 4769
search: |-
    `wineventlog_security` EventCode=4769 ServiceName!="*$" TicketEncryptionType=0x17
      | bucket span=2m _time
      | stats dc(ServiceName) AS unique_services values(ServiceName) as requested_services values(user_category) as user_category values(src_category) as src_category values(dest) as dest
        BY _time, user, src
      | eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std
        BY user, src
      | eval upperBound=(comp_avg+comp_std*3)
      | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0)
      | search isOutlier=1
      | `unusual_number_of_kerberos_service_tickets_requested_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
references:
    - https://attack.mitre.org/techniques/T1558/003/
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: User $user$ requested a service ticket for $unique_services$ services indicating a potential kerberoasting attack
        - field: user
          type: user
          score: 20
          message: User $user$ requested a service ticket for $unique_services$ services indicating a potential kerberoasting attack
analytic_story:
    - Active Directory Kerberos Attacks
asset_type: Endpoint
mitre_attack_id:
    - T1558.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc
id: 44badcb1-2e8c-4628-9537-021bbae571ad
version: 7
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the `sfc.exe` utility, in order to stop the Immunet Protect service. The Sfc.exe utility is part of Cisco Secure Endpoint installation. This detection leverages telemetry from the endpoint, focusing on command-line executions involving the `-k` parameter. This activity is significant as it indicates potential tampering with defensive mechanisms. If confirmed malicious, attackers could partially blind the EDR, enabling further compromise and lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -k*" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_stop_immunet_service_via_sfc_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
references:
    - https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Suspicious use of `sfc.exe` stopping the Immunet Protect service on $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: Suspicious use of `sfc.exe` stopping the Immunet Protect service on $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Security Solution Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint