Splunk rules: 1b

id: '32338.57521'
title: Consent.exe Suspicious Child Process
description: Consent.exe is a process created by Microsoft Windows that is responsible
  for managing User Account Control (UAC) consent. This use case detects any suspicious
  child process of consent.exe in attempt to escalate privileges.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "consent.exe" | regex parent_process_path="(?i):\x5cWindows\x5csystem32\x5cconsent\.exe"
  | regex process_path!="(?i):\x5cWindows\x5csystem32\x5cWerFault\.exe"| table _time,
  host, user, process, process_*, parent_* | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- execution:command and scripting interpreter
- privilege-escalation:exploitation for privilege escalation
technique_id: 
- T1059
- T1068
data_category:
- Windows event logs
references:
- https://blog.snapattack.com/hunting-cve-2024-30051-8de021f0cf77
- https://www.youtube.com/watch?v=G5tlqwWZdJA
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1548/002/

name: Detect Remote Access Software Usage FileInfo
id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454
version: 15
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network.
data_source:
    - Sysmon EventID 1
search: |-
    `sysmon` EventCode=1
      | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product
        BY action dest original_file_name
           parent_process parent_process_exec parent_process_guid
           parent_process_id parent_process_name parent_process_path
           process process_exec process_guid
           process_hash process_id process_integrity_level
           process_name process_path user
           user_id vendor_product
      | lookup remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category
      | search isutility = True
      | `remote_access_software_usage_exceptions`
      | `detect_remote_access_software_usage_fileinfo_filter`
how_to_implement: This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A file attributes for known a remote access software [$process_name$] was detected on $dest$
        - field: user
          type: user
          score: 20
          message: A file attributes for known a remote access software [$process_name$] was detected on $dest$
threat_objects:
    - field: process_name
      type: process_name
    - field: signature
      type: signature
analytic_story:
    - Insider Threat
    - Command And Control
    - Ransomware
    - Gozi Malware
    - Remote Monitoring and Management Software
    - Cactus Ransomware
    - Seashell Blizzard
    - Scattered Spider
    - Interlock Ransomware
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Renamed RClone
id: 6dca1124-b3ec-11eb-9328-acde48001122
version: 12
creation_date: '2021-05-13'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.original_file_name=rclone.exe
            AND
            Processes.process_name!=rclone.exe
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_renamed_rclone_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case.
references:
    - https://redcanary.com/blog/rclone-mega-extortion/
    - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
analytic_story:
    - DarkSide Ransomware
    - Ransomware
    - Black Basta Ransomware
    - Cactus Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1020
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disabling Defender Services
id: 911eacdc-317f-11ec-ad30-acde48001122
version: 15
creation_date: '2021-10-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the disabling of Windows Defender services by monitoring registry modifications. It leverages registry event data to identify changes to specific registry paths associated with Defender services, where the 'Start' value is set to '0x00000004'. This activity is significant because disabling Defender services can indicate an attempt by an adversary to evade detection and maintain persistence on the endpoint. If confirmed malicious, this action could allow attackers to execute further malicious activities undetected, leading to potential data breaches or system compromise.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_defender_services_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - IcedID
    - Windows Registry Abuse
    - RedLine Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27060.49389'
title: DLL Called with RS32
description: Threat actors including Qbot have been observed using rundll32.exe to
  invoke the RS32 function during post-compromise activity. This use case detects
  DLL files invoking RS32 , accounting for instances where rundll32.exe has been renamed.
  While these exexcutions may be legitimate, unexpected executions should be investigated.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ".dll" "RS32" | where match(process, "(?i)\.dll\,RS32") | table _time, host, user,
  process, process_*, parent_process, parent_process_*, called_function | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Windows Sysmon
references:
- https://redcanary.com/blog/lolbins-abuse/

id: '27166.49585'
title: DLLRegisterServer Called from Command Line
description: Threat actors including SocGhoulish may use explicit calls to DLLRegisterServer
  in the command line as a technique to register malicious DLLs, often bypassing standard
  registration methods like regsvr32. This use case detects instances where any process,
  including those masquerading as legitimate system utilities, explicitly invokes
  DLLRegisterServer in the command line. While such executions could be part of legitimate
  software installations or development activities, unexpected executions should be
  investigated.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ".dll" "DLLRegisterServer" | where match(process, "(?i)\.dll\"?,DLLRegisterServer")
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- PowerShell logs
references:
- https://redcanary.com/blog/lolbins-abuse/

id: '6129.6614'
title: Driver as Command Parameter
description: 'Adversaries may use signed drivers in order to take advantage of vulnerabilities
  in order to execute malicious code or establish persistence. This use case looks
  for when a driver file (.sys) has been passed as a command line parameter. -- Threat
  Actor Association: Bluebottle, Lancefly, Lazarus - Software Association: Cuba, DirtyMoe,
  HermeticWiper - Atomics T1014 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "sys" | regex process="(?i)\.sys"| table _time,
  host, user, signature_id, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- privilege-escalation:exploitation for privilege escalation
technique_id: 
- T1218
- T1068
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://zerosum0x0.blogspot.com/2017/07/puppet-strings-dirty-secret-for-free.html
- http://www.fuzzysecurity.com/tutorials/28.html

id: '17787.29931'
title: hh.exe Remote File Execution
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. This use case detects hh.exe executions accessing a
  remote compiled HTML file. LOLBAS Atomics T1218.001 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(hh) OR TERM(hh.exe)) | where match(process_name,
  "(?i)hh\.exe") AND match(process, "(?i)\w+tps?://") | table _time, host, user process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-2---compiled-html-help-remote-payload
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/

id: '6108.6588'
title: IIS Worker (W3WP) Spawn Command Line
description: 'IIS instances (w3wp.exe) host various web-facing client services such
  as Outlook on the web (formerly known as Outlook Web App or OWA) or Exchange admin
  center (EAC; formerly known as the Exchange Control Panel or ECP). This use case
  looks for w3wp executions of command terminal. - Threat Actor Association: CL-STA-0043,
  OilRig -- Software Association: ALPHV/BlackCat, Clop'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(w3wp) (TERM(cmd) OR TERM(powershell))| regex
  Creator_Process_Name="(?i)w3wp"| regex New_Process_Name="(?i)cmd\.exe|powershell(\_ISE)?\.exe|pwsh\.exe|csc\.exe"
  | table _time, host, user, signature_id, process, process_*, parent_process_* |
  bin span=1s | stats values(*) as * by _time, host, process_name | eventstats c(process_name)
  as c_process_name by process_name| where c_process_name < 25 '
techniques:
- persistence:server software component:iis components
- defense-evasion:system binary proxy execution
technique_id:
- T1505.004
- T1218
data_category:
- Windows event logs
references:
- https://www.microsoft.com/security/blog/2021/02/11/web-shell-attacks-continue-to-rise/
- https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response

name: Linux Possible Nimbuspwn Privilege Escalation
id: 24a540b7-6eec-4972-ad85-1f2232f9a849
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects directory traversal attempts associated with Nimbuspwn, a Linux privilege escalation vulnerability affecting the networkd-dispatcher service.
    Nimbuspwn exploits weaknesses in the networkd-dispatcher service to traverse directories and execute arbitrary code with elevated privileges.
    If confirmed malicious, this activity could allow an attacker to escalate privileges to root, potentially leading to full system compromise, persistent unauthorized access, and the ability to deploy additional malicious payloads.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process="*networkd-dispatcher*"
    Processes.process="*../*"

    by Processes.process Processes.vendor_product Processes.user_id
       Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_nimbuspwn_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate system processes or administrative scripts that traverse directories in a similar pattern may trigger this detection. Filter based on known administrative activity and verified system processes.
references:
    - https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/
finding:
    title: Possible Nimbuspwn privilege escalation via [$process$] by [$user$] on [$dest$]
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Post-Exploitation
asset_type: Endpoint
cve:
    - CVE-2022-29799
    - CVE-2022-29800
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Stop Services
id: d05204a5-9f1c-4946-a7f3-4fa58d76d5fd
version: 10
creation_date: '2022-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects attempts to stop or clear a service on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. This activity is significant as adversaries often terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("systemctl", "service", "svcadm")  Processes.process ="*stop*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_stop_services_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://cert.gov.ua/article/39518
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to stop services on endpoint $dest$ by $user$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - AwfulShred
    - Data Destruction
    - Industroyer2
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: PaperCut NG Suspicious Behavior Debug Log
id: 395163b8-689b-444b-86c7-9fe9ad624734
version: 8
creation_date: '2023-05-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies potential exploitation attempts on a PaperCut NG server by analyzing its debug log data. It detects unauthorized or suspicious access attempts from public IP addresses and searches for specific URIs associated with known exploits. The detection leverages regex to parse unstructured log data, focusing on admin login activities. This activity is significant as it can indicate an active exploitation attempt on the server. If confirmed malicious, attackers could gain unauthorized access, potentially leading to data breaches or further compromise of the server.
data_source: []
search: |-
    `papercutng`
    (loginType=Admin OR userName=admin)

    | eval uri_match=if(match(_raw, "(?i)(\/app\?service=page\/SetupCompleted|\/app|\/app\?service=page\/PrinterList|\/app\?service=direct\/1\/PrinterList\/selectPrinter&sp=l1001|\/app\?service=direct\/1\/PrinterDetails\/printerOptionsTab\.tab)"), "URI matches", null())

    | eval ip_match=if(match(_raw, "(?i)((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))") AND NOT match(_raw, "(?i)(10\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(172\.(1[6-9]|2[0-9]|3[0-1])\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(192\.168\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))"), "IP matches", null())

    | where  (isnotnull(uri_match) OR isnotnull(ip_match))
    | stats sparkline, count, values(uri_match) AS uri_match, values(ip_match) AS ip_match latest(_raw) BY host, index, sourcetype
    | `papercut_ng_suspicious_behavior_debug_log_filter`
how_to_implement: Debug logs must be enabled and shipped to Splunk in order to properly identify behavior with this analytic.
known_false_positives: False positives may be present, as this is based on the admin user accessing the Papercut NG instance from a public IP address. Filter as needed.
references:
    - https://www.papercut.com/kb/Main/HowToCollectApplicationServerDebugLogs
    - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/HAFNIUM.md
    - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
    - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
    - https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/
    - https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
    - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
analytic_story:
    - PaperCut MF NG Vulnerability
asset_type: Web Server
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Powershell Creating Thread Mutex
id: 637557ec-ca08-11eb-bd0a-acde48001122
version: 15
creation_date: '2021-06-14'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of PowerShell scripts using the `mutex` function via EventCode 4104. This detection leverages PowerShell Script Block Logging to identify scripts that create thread mutexes, a technique often used in obfuscated scripts to ensure only one instance runs on a compromised machine. This activity is significant as it may indicate the presence of sophisticated malware or persistence mechanisms. If confirmed malicious, the attacker could maintain exclusive control over a process, potentially leading to further exploitation or persistence within the environment.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_creating_thread_mutex_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: powershell developer may used this function in their script for instance checking too.
references:
    - https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
finding:
    title: A suspicious powershell script contains Thread Mutex on host $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious powershell script contains Thread Mutex on host $dest$
analytic_story:
    - Malicious PowerShell
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1027.005
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '29624.53382'
title: QEMU Network Tunneling - Windows
description: 'QEMU is an open-source machine emulator that allows for running multiple
  operating systems as separate processes. The use of QEMU executions with specific
  networking commands may indicate attempts at network tunneling or bypassing security
  controls, which was observed in intrusion reported on SecureList. This use case
  detects QEMU executions with command-line arguments that could be used to tunnel
  traffic. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "qemu-system-" ("-net " OR "-netdev" OR "-redir" OR "socket" OR
  "listen" OR "-device" OR "hostfwd=") | table _time, host, user, process, process_*,
  parent_process_name, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id: 
- T1572
- T1095
data_category:
- PowerShell logs
references:
- https://securelist.com/network-tunneling-with-qemu/111803/

id: '21595.38208'
title: regsvr32 Referencing Unusual Paths
description: Adversaries may abuse regsvr32.exe to proxy execution of malicious code.
  regsvr32 is a command-line program used to register and unregister object linking
  and embedding controls including .dlls. This use case detects executions of regsvr32
  involving frequently abused file paths as observed with the DarkWatchMan remote
  access trojan. Applications with normal use from AppData\Local should be whitelisted
  using the full file path. LOLBAS/LOLBINS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(regsvr32) ("\\Temp\\" OR "\\AppData\\Local" OR "\\Users\\Public") | where (match(process,
  "(?i)\x5c(Temp|Appdata\x5cLocal|Users\x5cPublic)") and match(process_name, "(?i)regsvr32\.exe"))
  | table _time, host, user, signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:regsvr32
technique_id:
- T1218.010
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.virustotal.com/gui/file/d439a3ce7353ef96cf3556abba1e5da77eac21fdba09d6a4aad42d1fc88c1e3c/behavior

id: '5412.5535'
title: SecretsDump Credential Harvest
description: 'SecretsDump.py Performs various techniques to dump hashes from the remote
  machine without executing any agent there. -- Threat Actor Association: APT15, Scattered
  Spider (aka. 0ktapus, UNC3944), Volt Typhoon -- Software Association: Rhysida'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4624) OR
  "<EventID>4624<") Authentication_Package="NTLM") OR ((TERM(EventCode=4661) OR "<EventID>4661<")
  TERM(SAM)) OR ((TERM(EventCode=5145) OR "<EventID>5145<") TERM(SAMR)) | rex field=_raw
  "Account Name:\s+(?<user>\S+\$)" | table _time, host, user signature_id, Account_Name,
  user, Relative_Target_Name, signature_id, src_ip, session_id | bin span=1s | stats
  values(*) as * by _time, host, session_id | where (match(signature_id, "(?i)4624")
  AND match(signature_id, "(?i)5145") AND match(signature_id, "(?i)4661")) | eventstats
  dc(src_ip) as dc_src_ip by host| where dc_src_ip=1 '
techniques:
- credential-access:os credential dumping:security account manager
technique_id:
- T1003.002
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py

id: '17711.29476'
title: Suspicious Conhost.exe Commands
description: 'Adversaries may abuse utilities that allow for command execution to
  bypass security restrictions that limit the use of command-line interpreters. This
  use case detects commands using conhost.exe to launch other executables, which may
  be used by adversaries to evade detection and bypass restrictions. -- Software Association:
  Qakbot -- Atomics T1202 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(conhost) | regex process="(?i)conhost\.exe.*?\.exe"|
  rex field=process "(?i)conhost\.exe\s+\"(?<spawned_process>[^\"]+)\.exe" | table
  _time, host, user parent_*, process, process_*, signature_id, spawned_process| bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indirect command execution
- defense-evasion:exploitation for defense evasion
technique_id: 
- T1202
- T1211
data_category:
- Process command-line parameters
- Windows event logs
references:
- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1202/T1202.md#atomic-test-3---indirect-command-execution---conhostexe

id: '8961.24525'
title: Timestamp Manipulation
description: 'Adversaries may modify file time attributes to hide new or changes to
  existing files. Timestomping is a technique that modifies the timestamps of a file
  (the modify, access, create, and change times), often to mimic files that are in
  the same folder. Threat Actor Association: WatchDog Atomics T1070.006 Test #1 Atomics
  T1070.006 Test #2 Atomics T1070.006 Test #3 Atomics T1070.006 Test #4 Atomics T1070.006
  Test #5 Atomics T1070.006 Test #6 Atomics T1070.006 Test #7 Atomics T1070.006 Test
  #8'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103)
  OR "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "CreationTime"
  OR "LastWriteTime" OR "LastAccessTime" OR "timestomp" | regex process="(?i)\.(Creation|Last(Write|Access))Time\s+?=|timestomp"
  | table _time, host, user, process* | bin span=1s | stats values(*) as * by _time,
  host `hec_collect`'
techniques:
- defense-evasion:indicator removal:timestomp
technique_id:
- T1070.006
data_category:
- PowerShell logs
references:
- https://www.cadosecurity.com/coinstomp-malware-family-targets-asian-cloud-service-providers/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md

id: '8961.20833'
title: Timestamp Manipulation
description: 'Adversaries may modify file time attributes to hide new or changes to
  existing files. Timestomping is a technique that modifies the timestamps of a file
  (the modify, access, create, and change times), often to mimic files that are in
  the same folder. Threat Actor Association: WatchDog Atomics T1070.006 Test #1 Atomics
  T1070.006 Test #2 Atomics T1070.006 Test #3 Atomics T1070.006 Test #4 Atomics T1070.006
  Test #5 Atomics T1070.006 Test #6 Atomics T1070.006 Test #7 Atomics T1070.006 Test
  #8'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_windows` (LastAccessTime OR LastWriteTime
  OR CreationTime OR SetCreationTime OR SetLastAccessTime OR SetLastWriteTime) | regex
  process="(?i)(set|\.)(creation|(last(access|write)))time(\(|\s*=)" | table _time,
  host, user, *process* `group_events("host,process",10s)` | where event_count < 10
  `hec_collect`'
techniques:
- defense-evasion:indicator removal:timestomp
technique_id:
- T1070.006
data_category:
- Process command-line parameters
references:
- https://www.cadosecurity.com/coinstomp-malware-family-targets-asian-cloud-service-providers/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md

name: Windows Audit Policy Auditing Option Modified - Registry
id: 27914692-9c62-44ea-9129-ceb429b61bd0
version: 7
creation_date: '2025-02-19'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects potentially suspicious modifications to the Audit Policy auditing options registry values. It leverages data from the Endpoint.Registry data model, focusing on changes to one of the following auditing option values "CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects" and "AuditBaseDirectories" within the "HKLM\\System\\CurrentControlSet\\Control\\Lsa\\" registry key. This activity is significant as it could be a sign of a threat actor trying to tamper with the audit policy configuration, and disabling SACLs configuration. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Control\\Lsa*" Registry.registry_value_name IN ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_auditing_option_modified___registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Active setup installer may add or modify this registry.
references:
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpac/262a2bed-93d4-4c04-abec-cf06e9ec72fd
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The auditing option $registry_value_name$ from the configured Audit Policy was modified on $dest$.
        - field: user
          type: user
          score: 20
          message: The auditing option $registry_value_name$ from the configured Audit Policy was modified on $dest$.
analytic_story:
    - Windows Audit Policy Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1547.014
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows ConsoleHost History File Deletion
id: a203040e-f8fd-49bb-8424-d2fabf277322
version: 5
creation_date: '2025-03-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the deletion of the ConsoleHost_history.txt file, which stores command history for PowerShell sessions. Attackers may attempt to remove this file to cover their tracks and evade detection during post-exploitation activities. This detection focuses on file deletion commands executed via PowerShell, Command Prompt, or scripting languages that specifically target ConsoleHost_history.txt, typically located at %APPDATA%\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt. Identifying such activity can help uncover potential anti-forensic behavior and suspicious administrative actions.
data_source:
    - Sysmon EventID 23
    - Sysmon EventID 26
search: '`sysmon` EventCode IN ("23","26") TargetFilename = "*\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" | stats count min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_name process_exec process_id process_path user_id vendor_product process_guid signature signature_id user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_consolehost_history_file_deletion_filter`'
how_to_implement: To successfully implement this search, you need to ingest logs that include the deleted target file name, process name, and process ID from your endpoints. If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
known_false_positives: An administrator may delete the ConsoleHost history file on a specific machine, potentially triggering this detection. However, this action is uncommon for regular users who are not accustomed to using the PowerShell command line
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a process $process_name$ delete ConsoleHost_History.txt on $dest$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Medusa Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1070.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Disable RDP
id: 11ed764f-eb9c-4be7-bdad-2209b9d33ee1
version: 10
creation_date: '2024-07-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic is developed to detect suspicious registry modifications that disable Remote Desktop Protocol (RDP) by altering the "fDenyTSConnections" key. Changing this key's value to 1 prevents remote connections, which can disrupt remote management and access. Such modifications could indicate an attempt to hinder remote administration or isolate the system from remote intervention, potentially signifying malicious activity.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_rdp_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: administrators may enable or disable this feature that may cause some false positive.
references:
    - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A registry modification in Windows RDP registry settings on $dest$
analytic_story:
    - ShrinkLocker
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows MpCmdRun RemoveDefinitions Execution
id: b2442e49-bd3f-4685-a2dc-2bdc292563bf
version: 4
creation_date: '2026-03-16'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    This detection identifies the execution of MpCmdRun.exe with the "-RemoveDefinitions" argument, which is used to remove definitions from the Windows Malware Protection Engine.
    This behavior can be significant as it might indicate potential malware activity or attempts to bypass security measures.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
      from datamodel=Endpoint.Processes where
      (Processes.process_name ="MpCmdRun.exe" OR Processes.original_file_name = MpCmdRun.exe)
      Processes.process = "*-RemoveDefinitions *"
      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
         Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
         Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
         Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_mpcmdrun_removedefinitions_execution_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Administrators may execute this command for testing or auditing.
references:
    - https://cert.gov.ua/article/6284730
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of [$process_name$] attempting to remove definitions from the Windows Malware Protection Engine via the Command [$process$] on [$dest$] by user [$user$].
        - field: user
          type: user
          score: 20
          message: An instance of [$process_name$] attempting to remove definitions from the Windows Malware Protection Engine via the Command [$process$] on [$dest$] by user [$user$].
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Office Product Spawned Rundll32 With No DLL
id: f28e787e-69ca-480e-9f98-ab970e6d4bcc
version: 8
creation_date: '2021-04-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process and parent process relationships. This activity is significant as it is a known tactic of the IcedID malware family, which can lead to unauthorized code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to data exfiltration, system compromise, or further malware deployment. Immediate investigation and containment are recommended.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_office_products_parent` `process_rundll32` (Processes.process!=*.dll*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_office_product_spawned_rundll32_with_no_dll_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited, but if any are present, filter as needed.
references:
    - https://www.joesandbox.com/analysis/395471/0/html
    - https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/
    - https://any.run/malware-trends/icedid
finding:
    title: Office process $parent_process_name$ observed executing a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ on host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Spearphishing Attachments
    - CVE-2023-36884 Office and Windows HTML RCE Vulnerability
    - Compromised Windows Host
    - Prestige Ransomware
    - Graceful Wipe Out Attack
    - Crypto Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint