Splunk rules: 1a

name: Azure AD High Number Of Failed Authentications From Ip
id: e5ab41bf-745d-4f72-a393-2611151afd8e
version: 14
creation_date: '2023-01-23'
modification_date: '2026-05-13'
author: Mauricio Velazco, Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects an IP address with 20 or more failed authentication attempts to an Azure AD tenant within 10 minutes. It leverages Azure AD SignInLogs to identify repeated failed logins from the same IP. This behavior is significant as it may indicate a brute force attack aimed at gaining unauthorized access or escalating privileges. If confirmed malicious, the attacker could potentially compromise user accounts, leading to unauthorized access to sensitive information and resources within the Azure environment.
data_source:
    - Azure Active Directory
search: |
    `azure_monitor_aad`
    category=SignInLogs
    properties.status.errorCode=50126
    properties.authenticationDetails{}.succeeded=false
    | rename properties.* as *
    | bin span=10m _time
    | fillnull value=null
    | stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest values(user) as user values(user_agent) as user_agent by src _time vendor_account vendor_product
    | where count > 20
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `azure_ad_high_number_of_failed_authentications_from_ip_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 10 minutes may also be triggered by a broken application.
references:
    - https://attack.mitre.org/techniques/T1110/
    - https://attack.mitre.org/techniques/T1110/001/
    - https://attack.mitre.org/techniques/T1110/003/
finding:
    title: $src$ failed to authenticate more than 20 times in the span of 10 minutes.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Compromised User Account
    - Azure Active Directory Account Takeover
    - NOBELIUM Group
asset_type: Azure Tenant
mitre_attack_id:
    - T1110.001
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Azure AD OAuth Application Consent Granted By User
id: 10ec9031-015b-4617-b453-c0c1ab729007
version: 11
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents. This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access. If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks.
data_source:
    - Azure Active Directory Consent to application
search: "`azure_monitor_aad` operationName=\"Consent to application\" properties.result=success | rename properties.* as * | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\"), -1) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) | rex field=permissions \"Scope: (?<Scope> [ ^,]+)\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_oauth_application_consent_granted_by_user_filter`"
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: False positives may occur if users are granting consents as part of legitimate application integrations or setups. It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices.
references:
    - https://attack.mitre.org/techniques/T1528/
    - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
    - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
    - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
    - https://www.alteredsecurity.com/post/introduction-to-365-stealer
    - https://github.com/AlteredSecurity/365-Stealer
finding:
    title: User $user$ consented an OAuth application.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1528
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco Isovalent - Late Process Execution
id: 7f4b9b8e-5d6a-4a21-9e3f-0f1e8f2d1c3a
version: 5
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    Detects process executions that occur well after a container has initialized, which can indicate
    suspicious activity (e.g., interactive shells, injected binaries, or post-compromise tooling).
    The analytic compares the process start time to the container start time and flags processes
    launched more than 5 minutes (300 seconds) after initialization.
data_source:
    - Cisco Isovalent Process Exec
search: |
    `cisco_isovalent_process_exec` process_name="sh"
    | rename process_exec.process.start_time as ProcessStartTime
    | rename process_exec.process.pod.container.start_time as ContainerStartTime
    | eval ProcessStartTime=strptime(ProcessStartTime, "%Y-%m-%dT%H:%M:%S.%3Q")
    | eval ContainerStartTime=strptime(ContainerStartTime, "%Y-%m-%dT%H:%M:%S.%9Q")
    | eval ContainerTime5min=relative_time(ContainerStartTime, "+5m")
    | where ProcessStartTime > ContainerTime5min
    | table node_name cluster_name, pod_name, container_id, process_name, process_exec, process, ProcessStartTime, ContainerTime5min | `security_content_ctime(ProcessStartTime)`
    | `security_content_ctime(ContainerTime5min)`
    | `cisco_isovalent___late_process_execution_filter`
how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
known_false_positives: This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations.
references:
    - https://docs.isovalent.com/user-guide/sec-ops-visibility/process-execution/index.html
intermediate_findings:
    entities:
        - field: pod_name
          type: system
          score: 20
          message: Late process execution [$process_name$] detected in pod [$pod_name$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Isovalent Suspicious Activity
asset_type: Endpoint
mitre_attack_id:
    - T1543
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: CMLUA Or CMSTPLUA UAC Bypass
id: f87b5062-b405-11eb-a889-acde48001122
version: 11
creation_date: '2021-05-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the use of COM objects like CMLUA or CMSTPLUA to bypass User Account Control (UAC). It leverages Sysmon EventCode 7 to identify the loading of specific DLLs (CMLUA.dll, CMSTPLUA.dll, CMLUAUTIL.dll) by processes not typically associated with these libraries. This activity is significant as it indicates an attempt to gain elevated privileges, a common tactic used by ransomware adversaries. If confirmed malicious, this could allow attackers to execute code with administrative rights, leading to potential system compromise and further malicious activities.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Legitimate windows application that are not on the list loading this dll. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1218/003/
finding:
    title: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - DarkSide Ransomware
    - Ransomware
    - LockBit Ransomware
    - ValleyRAT
asset_type: Endpoint
mitre_attack_id:
    - T1218.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Remote Access Software Usage Traffic
id: 885ea672-07ee-475a-879e-60d28aa5dd42
version: 16
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: |
    The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
    It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
    If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
data_source:
    - Palo Alto Network Traffic
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(All_Traffic.dest_port) as dest_port
            latest(All_Traffic.user) as user
    from datamodel=Network_Traffic where
    All_Traffic.app=*
    NOT All_Traffic.app IN ("-", "unknown")
    by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in
       All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip
       All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
       All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
       All_Traffic.src_port All_Traffic.transport All_Traffic.user
       All_Traffic.vendor_product
    | `drop_dm_object_name("All_Traffic")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category
    | search isutility = True
    | `remote_access_software_usage_exceptions`
    | `detect_remote_access_software_usage_traffic_filter`
how_to_implement: The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
    - https://applipedia.paloaltonetworks.com/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Application traffic for a known remote access software [$signature$] was detected from $src$.
        - field: user
          type: user
          score: 20
          message: Application traffic for a known remote access software [$signature$] was detected from $src$.
threat_objects:
    - field: signature
      type: signature
analytic_story:
    - Insider Threat
    - Command And Control
    - Ransomware
    - Remote Monitoring and Management Software
    - Scattered Spider
    - Interlock Ransomware
    - Scattered Lapsus$ Hunters
asset_type: Network
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '30731.54883'
title: Driver Loaded from Unusual Path - Windows
description: 'Adversaries may exploit software vulnerabilities in an attempt to elevate
  privileges. Exploitation of a software vulnerability occurs when an adversary takes
  advantage of a programming error in a program, service, or within the operating
  system software or kernel itself to execute adversary-controlled code. Adversaries
  may also use services to install and execute malicious drivers. For example, after
  dropping a driver file (ex: .sys) to disk, the payload can be loaded and registered
  via Native API functions. This use case detects Driver loaded events excluding expected
  paths Windows\System32\drivers, Windows\SysWOW64\drivers, Windows\INF, and Windows\System32\DriverStore.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=6) OR "<EventID>6<")
  | regex ImageLoaded!="(?i)\x5cWindows\x5c((System32|sysWOW64)\x5cDrivers(tore)?)|inf"
  | table _time, host, user, ImageLoaded, signature_id, process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:create or modify system process:windows service
- privilege-escalation:exploitation for privilege escalation
technique_id:
- T1543.003
- T1068
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1543/003/
- https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/strategies-to-monitor-and-prevent-vulnerable-driver-attacks/ba-p/4103985
- https://www.loldrivers.io/

name: GitHub Workflow File Creation or Modification
id: 2a9f3a2e-2c07-4c5f-9e42-8f8f0b6b6a12
version: 2
creation_date: '2025-11-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: |
    The following analytic hunts for any creations or modifications to GitHub Actions workflow YAML files across the organization's Linux or Windows endpoints.
    This hunting query tracks all workflow file activity under .github/workflows directories to help defenders establish baselines of legitimate CI/CD workflow creation patterns, identify unusual or unauthorized changes, and detect anomalies that may indicate supply chain compromise.
    GitHub Actions workflows execute with privileged access to secrets and deployment credentials, making them high-value targets for attackers.
    By monitoring workflow file modifications over time, defenders can identify suspicious patterns such as unexpected workflow creation on developer workstations, modifications outside normal change windows, or activity in repositories that don't typically contain workflows.
    This data is essential for detecting supply chain attacks like Shai-Hulud that inject malicious workflows across multiple repositories.
data_source:
    - Sysmon for Linux EventID 11
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.file_path IN (
      "*/.github/workflows/*.yaml",
      "*/.github/workflows/*.yml",
      "*\\.github\\workflows\\*.yaml",
      "*\\.github\\workflows\\*.yml"
    )

    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
       Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user
       Filesystem.vendor_product

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `github_workflow_file_creation_or_modification_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain filesystem events, specifically file creation
    events. These logs must be processed using the appropriate Splunk Technology Add-ons
    that are specific to the EDR product. The logs must also be mapped to the `Filesystem`
    node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM)
    to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Legitimate engineering activity regularly creates workflow YAMLs. Suppress by repository path allowlisting, CI hosts, change windows, or approval timeframes.
references:
    - https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem
    - https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547/
    - https://github.com/SigmaHQ/sigma/pull/5658/files
    - https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
analytic_story:
    - NPM Supply Chain Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1574.006
    - T1554
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '29247.52789'
title: Impacket atexec.py Scheduled Task Creation
description: Impacket's atexec.py is a tool designed for executing commands on a target
  system via the Windows Task Scheduler to run arbitrary commands with the privileges
  of the account under which the scheduler is running, often providing a method for
  remote command execution which can be used by attackers during post-exploitation
  activities. This use case detects the creation of scheduled tasks matching characteristics
  of those created by Impacket atexec.py, notably the presence of commands in the
  task content and an 8 character mixed-case alphabetic task name.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4698) OR
  "<EventID>4698<") "exec" "/C" ".tmp" | where match(TaskName, "^\x5c[A-Za-z]{8}$")
  | table _time, host, user, TaskName | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:scheduled task/job
- execution:command and scripting interpreter
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
- privilege-escalation:scheduled task/job:scheduled task
- execution:command and scripting interpreter:windows command shell
- defense-evasion:obfuscated files or information
technique_id:
- T1053
- T1059
- T1053.005
- T1059.003
- T1027
data_category:
- Windows event logs
references:
- https://u0041.co/blog/post/1
- https://github.com/fortra/impacket/blob/master/examples/atexec.py
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

id: '5971.18224'
title: Indirect Command Execution
description: 'An adversary may use default tools, usually not restricted, to gain
  execution without using cmd. Threat Actor Association: Andariel, APT28 - Software
  Association: IcedId - Atomics T1548.002 Test#3 Atomics T1202 Test #1 Atomics T1202
  Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  (TERM(forfiles) OR TERM(fodhelper) OR TERM(ftp) OR TERM(pcalua)) | regex parent_process_name="(?i)(forfiles|fodhelper|ftp|pcalua)\.exe"
  | table _time, host, user parent_*, process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indirect command execution
- privilege-escalation:abuse elevation control mechanism
technique_id: 
- T1202
- T1548
data_category:
- Windows Sysmon
references:
- https://pentestlab.blog/tag/pcalua-exe/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1202/T1202.md#atomic-test-1---indirect-command-execution---pcaluaexe

name: Jenkins Arbitrary File Read CVE-2024-23897
id: c641260d-2b48-4eb1-b1e8-2cc5b8b99ab1
version: 10
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies attempts to exploit Jenkins Arbitrary File Read CVE-2024-23897. It detects HTTP POST requests to Jenkins URLs containing "*/cli?remoting=false*" with a 200 status code. This activity is significant as it indicates potential unauthorized access to sensitive files on the Jenkins server, such as credentials and private keys. If confirmed malicious, this could lead to severe data breaches, unauthorized access, and further exploitation within the environment.
data_source:
    - Nginx Access
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url="*/cli?remoting=false*" Web.status=200 Web.http_method=POST
      BY Web.src, Web.dest, Web.http_user_agent,
         Web.url Web.status, Web.http_method
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `jenkins_arbitrary_file_read_cve_2024_23897_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. If unable to utilize the Web datamodel, modify query to your data source.
known_false_positives: False positives should be limited as this detection is based on a specific URL path and HTTP status code. Adjust the search as necessary to fit the environment.
references:
    - https://github.com/projectdiscovery/nuclei-templates/pull/9025
    - https://github.com/jenkinsci-cert/SECURITY-3314-3315
    - https://github.com/binganao/CVE-2024-23897
    - https://github.com/h4x0r-dz/CVE-2024-23897
    - https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
    - https://www.shodan.io/search?query=product%3A%22Jenkins%22
    - https://thehackernews.com/2024/01/critical-jenkins-vulnerability-exposes.html
finding:
    title: Jenkins Arbitrary File Read CVE-2024-23897 against $dest$ by $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Jenkins Server Vulnerabilities
    - Hellcat Ransomware
asset_type: Web Server
cve:
    - CVE-2024-23897
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: JetBrains TeamCity Authentication Bypass CVE-2024-27198
id: fbcc04c7-8a79-453c-b3a9-c232c423bdd4
version: 9
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies attempts to exploit the JetBrains TeamCity Authentication Bypass vulnerability (CVE-2024-27198). It detects suspicious POST requests to the `/app/rest/users` and `/app/rest/users/id:1/tokens` endpoints, which are indicative of attempts to create new administrator users or generate admin access tokens without authentication. This detection leverages the Web datamodel and CIM-compliant log sources, such as Nginx or TeamCity logs. This activity is significant as it can lead to full control over the TeamCity server, including all projects, builds, agents, and artifacts. If confirmed malicious, attackers could gain unauthorized administrative access, leading to severe security breaches.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE (
            (Web.url="*?jsp=*"
            AND
            Web.url="*;.jsp*") Web.status=200 Web.http_method=POST
        )
        OR (Web.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") Web.status=200 Web.http_method=POST )
      BY Web.src, Web.dest, Web.http_user_agent,
         Web.url, Web.status, Web.http_method,
         sourcetype, source
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter`
how_to_implement: The detection relies on the Web datamodel and a CIM compliant log source, that may include Nginx, TeamCity logs, or other web server logs.
known_false_positives: False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
references:
    - https://github.com/projectdiscovery/nuclei-templates/pull/9279/files
    - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
    - https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
    - https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
    - https://github.com/yoryio/CVE-2024-27198/blob/main/CVE-2024-27198.py
finding:
    title: Possible JetBrains TeamCity Authentication Bypass CVE-2024-27198 Attempt against $dest$ from $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - JetBrains TeamCity Vulnerabilities
asset_type: Web Server
cve:
    - CVE-2024-27198
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Auditd Unload Module Via Modprobe
id: 90964d6a-4b5f-409a-85bd-95e261e03fe9
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious use of the `modprobe` command to unload kernel modules, which may indicate an attempt to disable critical system components or evade detection. The `modprobe` utility manages kernel modules, and unauthorized unloading of modules can disrupt system security features, remove logging capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized `modprobe` operations involving module unloading, this analytic helps identify potential tampering with kernel functionality, enabling security teams to investigate and address possible threats to system integrity.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command = "*modprobe*" AND execve_command = "*-r *"
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_unload_module_via_modprobe_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
finding:
    title: A [$execve_command$] event occurred on host - [$dest$] to unload a kernel module via the modprobe command.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1547.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32821.58284'
title: Proxy Execution via Appcert
description: Threat actors may exploit legitimate developer utilities to execute malicious
  payloads by proxy. One such utility is appcert.exe, a command-line tool included
  in the Windows Application Certification Kit, which is typically used to verify
  the compliance of Windows applications with Microsoft's certification standards.
  This use case detects appcert executions with commands to proxy execution of another
  binary. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(appcert) OR "appcert.exe") TERM(test) |
  regex process!="(?i)\-setupcommandline"| regex process="(?i)\stest\s"| rex field=process
  "-setuppath\s+(?:\"|'')?(?<proxy_exec>[^\s\"'']+\.exe)(?:\"|'')?" | table _time,
  host, user, process, parent_*, process_*, proxy_exec | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:trusted developer utilities proxy execution
technique_id: 
- T1127
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1218/007/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appcert/

id: '5367.8147'
title: Service Stop Commands
description: 'Adversaries may stop or disable services on a system to render those
  services unavailable to legitimate users. Stopping critical services can inhibit
  or stop response to an incident or aid in the adversary''s overall objectives to
  cause damage to the environment. Threat Actor Association: APT29/Nobelium/Cozy Bear,
  FIN6, Kimsuky, Lapsus$, Lazarus, TA2541, Traveling Spider - Software Association:
  BlackByte, Blackcat/ALPHV, Black Basta, Conti, Cring, Cuba, GhostShell, Lockbit,
  Nefilim, Prometheus / Spook, Ryuk, TeamTNT, WatchDog, WhisperGate, XingLocker --
  Atomics T1489 #Test1 Atomics T1489 #Test2 Atomics T1489 #Test3 -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventID>1<" OR TERM(EventCode=1))
  ((TERM(sc.exe) OR TERM(sc) OR TERM(net) OR TERM(net.exe) ) AND TERM(stop) AND (TERM(ShellHWDetection)
  OR TERM(AVPSUS) OR TERM(McAfeeDLPAgentService) OR TERM(mfewc) OR TERM(eventlog)
  OR (TERM(BMR) AND TERM(SERVICE)))) OR ( TERM(taskkill) AND ( TERM(/IM) OR TERM(/PID)
  OR TERM(/T) ) AND TERM(/F)) OR ((TERM(sc.exe) OR TERM(sc)) AND TERM(CONFIG) AND
  TERM(START=) AND TERM(DISABLED)) | table _time, host, user event_id, parent_process,
  parent_process_id, parent_process_name, parent_process_path, process, process_current_directory,
  process_id, process_name, process_path, signature_id, user_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lockergoga-ransomware-family-used-in-targeted-attacks/
- https://kcm.trellix.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/91000/KB91373/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20LockerGoga.pdf

name: Windows Defender ASR Rules Stacking
id: 425a6657-c5e4-4cbb-909e-fc9e5d326f01
version: 8
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies security events from Microsoft Defender, focusing on Exploit Guard and Attack Surface Reduction (ASR) features. It detects Event IDs 1121, 1126, 1131, and 1133 for blocked operations, and Event IDs 1122, 1125, 1132, and 1134 for audit logs. Event ID 1129 indicates user overrides, while Event ID 5007 signals configuration changes. This detection uses a lookup to correlate ASR rule GUIDs with descriptive names. Monitoring these events is crucial for identifying unauthorized operations, potential security breaches, and policy enforcement issues. If confirmed malicious, attackers could bypass security measures, execute unauthorized actions, or alter system configurations.
data_source:
    - Windows Event Log Defender 1121
    - Windows Event Log Defender 1122
    - Windows Event Log Defender 1125
    - Windows Event Log Defender 1126
    - Windows Event Log Defender 1129
    - Windows Event Log Defender 1131
    - Windows Event Log Defender 1133
    - Windows Event Log Defender 1134
    - Windows Event Log Defender 5007
search: |-
    `ms_defender` EventCode IN (1121, 1122, 1125, 1126, 1129, 1131, 1132, 1133, 1134, 5007)
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY host Parent_Commandline, Process_Name,
           Path, ID, EventCode
      | lookup asr_rules ID OUTPUT ASR_Rule
      | fillnull value=NULL
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | rename host as dest
      | `windows_defender_asr_rules_stacking_filter`
how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. The analytic can be modified to look for specific ASR rules, or to look for specific Event IDs. EventID 5007 is a change in the registry, and may be a false positive. This can be removed from the search if desired.
known_false_positives: False positives are not expected with this analytic, since it is a hunting analytic. It is meant to show the use of ASR rules and how they can be used to detect malicious activity.
references:
    - https://asrgen.streamlit.app/
    - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide
analytic_story:
    - Windows Attack Surface Reduction
asset_type: Endpoint
mitre_attack_id:
    - T1566.001
    - T1566.002
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Event For Service Disabled
id: 9c2620a8-94a1-11ec-b40c-acde48001122
version: 11
creation_date: '2022-02-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects when a Windows service is modified from a start type to disabled. It leverages system event logs, specifically EventCode 7040, to identify this change. This activity is significant because adversaries often disable security or other critical services to evade detection and maintain control over a compromised host. If confirmed malicious, this action could allow attackers to bypass security defenses, leading to further exploitation and persistence within the environment.
data_source:
    - Windows Event Log System 7040
search: |-
    `wineventlog_system` EventCode=7040  EventData_Xml="*disabled*"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY Computer EventCode Name
           UserID service ServiceName
      | rename Computer as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_event_for_service_disabled_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
known_false_positives: Windows service update may cause this event. In that scenario, filtering is needed.
references:
    - https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
analytic_story:
    - Windows Defense Evasion Tactics
    - RedLine Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Disable Defender Protocol Recognition
id: b2215bfb-6171-4137-af17-1a02fdd8d043
version: 12
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that disable the Windows Defender protocol recognition feature. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "DisableProtocolRecognition" setting. This activity is significant because disabling protocol recognition can hinder Windows Defender's ability to detect and respond to malware or suspicious software. If confirmed malicious, this action could allow an attacker to bypass antivirus defenses, facilitating further malicious activities such as data exfiltration or system compromise.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\NIS\\DisableProtocolRecognition" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_defender_protocol_recognition_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender Protocol Recognition set to disable on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Disable PUA Protection
id: fbfef407-cfee-4866-88c1-f8de1c16147c
version: 12
creation_date: '2024-01-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a modification in the Windows registry to disable Windows Defender PUA protection by setting PUAProtection to 0. This detection leverages data from the Endpoint.Registry datamodel, focusing on registry path changes related to Windows Defender. Disabling PUA protection is significant as it reduces defenses against Potentially Unwanted Applications (PUAs), which, while not always malicious, can negatively impact user experience and security. If confirmed malicious, this activity could allow an attacker to introduce adware, browser toolbars, or other unwanted software, potentially compromising system integrity and user productivity.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\PUAProtection" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_pua_protection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender PUA protection set to disable on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Auto Update Notif
id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12
version: 11
creation_date: '2023-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a suspicious modification to the Windows registry that changes the auto-update notification setting to "Notify before download." This detection leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant because it is a known technique used by adversaries, including malware like RedLine Stealer, to evade detection and potentially deploy additional payloads. If confirmed malicious, this modification could allow attackers to bypass security measures, maintain persistence, and exploit vulnerabilities on the target host.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions" AND Registry.registry_value_data="0x00000002" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_auto_update_notif_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: administrators may enable or disable this feature that may cause some false positive.
references:
    - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A registry modification in Windows auto update notification on $dest$
analytic_story:
    - RedLine Stealer
asset_type: Endpoint
atomic_guid:
    - 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Scheduled Task Service Spawned Shell
id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8
version: 12
creation_date: '2023-07-11'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: |
    The following analytic detects when the Task Scheduler service ("svchost.exe -k netsvcs -p -s Schedule") spawns common command line, scripting, or shell execution binaries such as "powershell.exe" or "cmd.exe".
    This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships.
    This activity is significant as attackers often abuse the Task Scheduler for execution and persistence, blending in with legitimate Windows operations.
    If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges within the environment.
data_source:
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
    count min(_time) as firstTime
          max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.parent_process_name="svchost.exe"
    Processes.parent_process="*-k*"
    Processes.parent_process= "*netsvcs*"
    Processes.parent_process="*-p*"
    Processes.parent_process="*-s*"
    Processes.parent_process="*Schedule*"
    Processes.process_name IN(
        "bash.exe",
        "cmd.exe",
        "cscript.exe",
        "ksh.exe",
        "powershell.exe",
        "pwsh.exe",
        "scrcons.exe",
        "sh.exe",
        "wscript.exe",
        "zsh.exe"
    )

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_scheduled_task_service_spawned_shell_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Certain scheduled tasks will intentionally call a script via PowerShell or Cmd for example.
    These will trigger this detection. Evaluate if they are legitimate and apply filters as needed.
references:
    - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
    - https://nasbench.medium.com/a-deep-dive-into-windows-scheduled-tasks-and-the-processes-running-them-218d1eed4cce
    - https://attack.mitre.org/techniques/T1053/005/
finding:
    title: A windows scheduled task spawned the shell application $process_name$ on $dest$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A windows scheduled task spawned the shell application $process_name$ on $dest$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows ScManager Security Descriptor Tampering Via Sc.EXE
id: 04023928-0381-4935-82cb-03372b2ef644
version: 9
creation_date: '2024-12-06'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects changes in the ScManager service security descriptor settings. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for any process execution involving the "sc.exe" binary with the "sdset" flag targeting the "scmanager" service. If confirmed malicious, this could allow an attacker to escalate their privileges.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=sc.exe
            OR
            Processes.original_file_name=sc.exe
        )
        Processes.process="*sdset *" Processes.process="*scmanager*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_scmanager_security_descriptor_tampering_via_sc_exe_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time. descriptor settings of the scmanager service should be immediately investigated and understood.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/8ac5c4f84692b11ea2832d18d3dc6f1ce7fb4e41/atomics/T1569.002/T1569.002.md#atomic-test-7---modifying-acl-of-service-control-manager-via-sdet
    - https://0xv1n.github.io/posts/scmanager/
    - https://attack.mitre.org/techniques/T1569/002/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Defense Evasion or Unauthorized Access Via SDDL Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1569.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint