Splunk rules: 1c

name: AWS Detect Users creating keys with encrypt policy without MFA
id: c79c164f-4b21-4847-98f9-cf6a9f49179e
version: 11
creation_date: '2020-10-27'
modification_date: '2026-05-13'
author: Rod Soto, Patrick Bareiss Splunk
status: production
type: TTP
description: The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. It leverages AWS CloudTrail logs to identify `CreateKey` or `PutKeyPolicy` events where the `kms:Encrypt` action is granted to all principals. This activity is significant as it may indicate a compromised account, allowing an attacker to misuse the encryption key to target other organizations. If confirmed malicious, this could lead to unauthorized data encryption, potentially disrupting operations and compromising sensitive information across multiple entities.
data_source:
    - AWS CloudTrail CreateKey
    - AWS CloudTrail PutKeyPolicy
search: |-
    `cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy
      | spath input=requestParameters.policy output=key_policy_statements path=Statement{}
      | mvexpand key_policy_statements
      | spath input=key_policy_statements output=key_policy_action_1 path=Action
      | spath input=key_policy_statements output=key_policy_action_2 path=Action{}
      | eval key_policy_action=mvappend(key_policy_action_1,key_policy_action_2)
      | spath input=key_policy_statements output=key_policy_principal path=Principal.AWS
      | search key_policy_action="kms:Encrypt" AND key_policy_principal="*"
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product key_policy_action
           key_policy_principal
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
known_false_positives: No false positives have been identified at this time.
references:
    - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
    - https://github.com/d1vious/git-wild-hunt
    - https://www.youtube.com/watch?v=PgzNib37g0M
finding:
    title: AWS account is potentially compromised and user $user$ is trying to compromise other accounts.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Ransomware Cloud
asset_type: AWS Account
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco Duo Admin Login Unusual Country
id: 1bf631d1-44a0-472b-98c4-2975b8b281df
version: 6
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects instances where a Duo admin login originates from a country outside of the United States, which may indicate suspicious or unauthorized access attempts. Please adjust as needed to your environment. It works by analyzing Duo activity logs for admin login actions and filtering out events where the access device's country is not within the expected region. By correlating user, device, browser, and location details, the analytic highlights anomalies in geographic login patterns. This behavior is critical for a SOC to identify because admin accounts have elevated privileges, and access from unusual countries can be a strong indicator of credential compromise, account takeover, or targeted attacks. Early detection of such activity enables rapid investigation and response, reducing the risk of unauthorized changes, data breaches, or further lateral movement within the environment. The impact of this attack can be severe, potentially allowing attackers to bypass security controls, alter configurations, or exfiltrate sensitive information.
data_source:
    - Cisco Duo Activity
search: |-
    `cisco_duo_activity` "action.name"=admin_login NOT access_device.location.country IN ("United States")
      | rename actor.name as user access_device.ip.address as src_ip
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY access_device.browser access_device.browser_version src_ip
           access_device.location.city access_device.location.country access_device.location.state
           access_device.os access_device.os_version actor.details
           actor.type outcome.result user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `cisco_duo_admin_login_unusual_country_filter`
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A user $user$ has logged in using an unusual country using browser $access_device.browser$ from $src_ip$.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: access_device.browser
      type: http_user_agent
    - field: src_ip
      type: ip_address
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication
id: 7882ec59-0e5b-4899-bd1a-7f9b16078bd4
version: 1
creation_date: '2026-06-09'
modification_date: '2026-06-09'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: |-
    This analytic identifies multiple unique source IP addresses successfully authenticating as `vmanage-admin` via SSH publickey on Cisco Catalyst SD-WAN control components within a short time window.
    This aligns with IoC guidance for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk), which warns that compromised systems may show `Accepted publickey for vmanage-admin` entries from unauthorized IPs.
    Validate flagged source IPs against known System IPs in SD-WAN Manager and investigate unexpected or concurrent sources.
data_source:
    - Cisco SD-WAN Auth Log
search: |-
    `cisco_sd_wan_syslog`
    "Accepted publickey"
    | rex field=_raw "^(?<event_timestamp>\S+)\s+(?<dest>\S+)\s+<auth\.info>\s+sshd\[\d+\]:\s+Accepted publickey for (?<user>\S+) from (?<src>\S+) port (?<src_port>\d+) ssh2:\s+(?<key_type>\S+)\s+(?<ssh_key>\S+)"
    | where user="vmanage-admin"
    | bin event_timestamp span=2m
    | stats dc(src) as unique_src_ips
            values(src) as src_ips
            values(user) as users
      count as auth_count by event_timestamp dest
    | where unique_src_ips >= 2
    | sort 0 - unique_src_ips
    | `cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication_filter`
how_to_implement: |
    This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
analytic_story:
    - Cisco Catalyst SD-WAN Analytics
asset_type: Network
cve:
    - CVE-2026-20127
mitre_attack_id:
    - T1595
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts
id: a4c76d0a-56b6-44be-814b-939746c4d406
version: 8
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. It leverages Cisco Secure Firewall Threat Defense logs and focuses on the IntrusionEvent event type to detect activity that may indicate broad targeting or mass exploitation attempts. This behavior is often associated with opportunistic scanning, worm propagation, or automated exploitation of known vulnerabilities across multiple systems. If confirmed malicious, this could represent the early phase of a coordinated attack aiming to gain a foothold on several hosts or move laterally across the environment.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent
    | bin _time span=1h
    | stats dc(src) as unique_src_ips, values(src) as src
            min(_time) as firstTime max(_time) as lastTime
            Values(dest) as dest
            Values(dest_port) as dest_port
            Values(rule) as rule
            Values(transport) as transport
            Values(app) as app
            by signature_id, signature class_desc MitreAttackGroups InlineResult InlineResultReason
    | where unique_src_ips >= 10
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: False positives should be minimal. Simultaneous vulnerability scanning across multiple internal hosts might trigger this, as well as some snort rules that are noisy. Disable those if necessary or increase the threshold.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The Snort rule $signature$ was triggered by $unique_src_ips$ unique internal hosts within a one-hour window, indicating potential widespread exploitation or coordinated targeting activity.
threat_objects:
    - field: signature
      type: signature
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1105
    - T1027
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Cloud Compute Instance Created In Previously Unused Region
id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
version: 10
creation_date: '2020-11-30'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of a cloud compute instance in a region that has not been previously used within the last hour. It leverages cloud infrastructure logs and compares the regions of newly created instances against a lookup file of historically used regions. This activity is significant because the creation of instances in new regions can indicate unauthorized or suspicious activity, such as an attacker attempting to evade detection or establish a foothold in a less monitored area. If confirmed malicious, this could lead to unauthorized resource usage, data exfiltration, or further compromise of the cloud environment.
data_source:
    - AWS CloudTrail
search: |-
    | tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count FROM datamodel=Change
      WHERE All_Changes.action=created
      BY All_Changes.vendor_region, All_Changes.user
    | `drop_dm_object_name("All_Changes")`
    | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data
    | eventstats max(enough_data) as enough_data
    | where enough_data=1
    | eval firstTimeSeenRegion=min(firstTimeSeen)
    | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h")
    | table firstTime, user, dest, count , vendor_region
    | `security_content_ctime(firstTime)`
    | `cloud_compute_instance_created_in_previously_unused_region_filter`
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro.
known_false_positives: It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: User $user$ is creating an instance $dest$ in a new region for the first time
        - field: user
          type: user
          score: 20
          message: User $user$ is creating an instance $dest$ in a new region for the first time
analytic_story:
    - Cloud Cryptomining
asset_type: Cloud Compute Instance
mitre_attack_id:
    - T1535
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Cloud Regions - Update
    - Previously Seen Cloud Regions - Initial

name: Disable Defender Enhanced Notification
id: dc65678c-301f-11ec-8e30-acde48001122
version: 15
creation_date: '2021-10-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the registry to disable Windows Defender's Enhanced Notification feature. It leverages data from Endpoint Detection and Response (EDR) agents, specifically monitoring changes to the registry path associated with Windows Defender reporting. This activity is significant because disabling Enhanced Notifications can prevent users and administrators from receiving critical security alerts, potentially allowing malicious activities to go unnoticed. If confirmed malicious, this action could enable an attacker to bypass detection mechanisms, maintain persistence, and escalate their activities without triggering alerts.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_enhanced_notification_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: user may choose to disable windows defender AV
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Azorult
    - CISA AA23-347A
    - IcedID
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kubernetes Shell Running on Worker Node with CPU Activity
id: cc1448e3-cc7a-4518-bc9f-2fa48f61a22b
version: 10
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies shell activity within the Kubernetes privilege scope on a worker node, specifically when shell processes are consuming CPU resources. It leverages process metrics from an OTEL collector hostmetrics receiver, pulled from Splunk Observability Cloud via the Splunk Infrastructure Monitoring Add-on, focusing on process.cpu.utilization and process.memory.utilization. This activity is significant as unauthorized shell processes can indicate a security threat, potentially compromising the node and the entire Kubernetes cluster. If confirmed malicious, attackers could gain full control over the host's resources, leading to data theft, service disruption, privilege escalation, and further attacks within the cluster.
data_source: []
search: |-
    | mstats avg(process.cpu.utilization) as process.cpu.utilization avg(process.memory.utilization) as process.memory.utilization where `kubernetes_metrics` AND process.executable.name IN ("sh","bash","csh", "tcsh") by host.name k8s.cluster.name k8s.node.name process.pid process.executable.name span=10s
    | search process.cpu.utilization>0
    | stats avg(process.cpu.utilization) as process.cpu.utilization avg(process.memory.utilization) as process.memory.utilization
      BY host.name k8s.cluster.name k8s.node.name
         process.pid process.executable.name
    | rename host.name as host
    | `kubernetes_shell_running_on_worker_node_with_cpu_activity_filter`
how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart/tree/main
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes shell with cpu activity running on worker node on host $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Auditd Preload Hijack Library Calls
id: 35c50572-a70b-452f-afa9-bebdf3c3ce36
version: 13
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. It leverages data from Linux Auditd, focusing on process execution logs that include command-line details. This activity is significant because adversaries, malware authors, and red teamers commonly use this technique to gain elevated privileges and establish persistence on a compromised machine. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, and maintain long-term access to the system.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command = "*LD_PRELOAD*"
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_preload_hijack_library_calls_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5
finding:
    title: A [$execve_command$] event occurred on host - [$dest$] to hijack or hook library functions using the LD_PRELOAD environment variable.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Persistence Techniques
    - Compromised Linux Host
    - China-Nexus Threat Activity
    - Salt Typhoon
    - Linux Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1574.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Obfuscated Files or Information Base64 Decode
id: 303b38b2-c03f-44e2-8f41-4594606fcfc7
version: 13
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the base64 decode command on Linux systems, which is often used to deobfuscate files. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include "base64 -d" or "base64 --decode". This activity is significant as it may indicate an attempt to hide malicious payloads or scripts. If confirmed malicious, an attacker could use this technique to execute hidden code, potentially leading to unauthorized access, data exfiltration, or further system compromise.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_path="*/base64" Processes.process="*-d*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_obfuscated_files_or_information_base64_decode_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present and will require some tuning based on processes. Filter as needed.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script
    - https://redcanary.com/blog/lateral-movement-with-secure-shell/
    - https://linux.die.net/man/1/base64
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1027
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Service Restarted
id: 084275ba-61b8-11ec-8d64-acde48001122
version: 11
creation_date: '2021-12-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name IN ("systemctl", "service")
            OR
            Processes.process IN ("*systemctl *", "*service *")
        )
        Processes.process IN ("*restart*", "*reload*", "*reenable*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_service_restarted_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1543/003/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A commandline $process$ that may create or start a service on $dest$
analytic_story:
    - AwfulShred
    - Linux Privilege Escalation
    - Linux Living Off The Land
    - Data Destruction
    - Linux Persistence Techniques
    - Scheduled Tasks
    - Gomir
asset_type: Endpoint
mitre_attack_id:
    - T1053.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 Disable MFA
id: c783dd98-c703-4252-9e8a-f19d9f5c949e
version: 11
creation_date: '2020-12-16'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: TTP
description: The following analytic identifies instances where Multi-Factor Authentication (MFA) is disabled for a user within the Office 365 environment. It leverages O365 audit logs, specifically focusing on events related to MFA settings. Disabling MFA removes a critical security layer, making accounts more vulnerable to unauthorized access. If confirmed malicious, this activity could indicate an attacker attempting to maintain persistence or an insider threat, significantly increasing the risk of unauthorized access. Immediate investigation is required to validate the reason for disabling MFA, potentially re-enable it, and assess any other suspicious activities related to the affected account.
data_source:
    - O365 Disable Strong Authentication.
search: |-
    `o365_management_activity` Operation="Disable Strong Authentication."
      | rename UserId as user object as src_user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
           src_user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_disable_mfa_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: Unless it is a special case, it is uncommon to disable MFA or Strong Authentication
references:
    - https://attack.mitre.org/techniques/T1556/
finding:
    title: User $src_user$ has executed an operation $signature$ for user $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
asset_type: O365 Tenant
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: PowerShell Invoke CIMMethod CIMSession
id: 651ee958-a433-471c-b264-39725b788b83
version: 12
creation_date: '2023-03-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of a New-CIMSession cmdlet followed by the use of the Invoke-CIMMethod cmdlet within PowerShell. It leverages PowerShell Script Block Logging to identify these specific cmdlets in the ScriptBlockText field. This activity is significant because it mirrors the behavior of the Invoke-WMIMethod cmdlet, often used for remote code execution via NTLMv2 pass-the-hash authentication. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access and control over targeted systems.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText IN ("*invoke-CIMMethod*", "*New-CimSession*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_invoke_cimmethod_cimsession_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives may be present based on third-party applications or administrators using CIM. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
references:
    - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-7.3
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: PowerShell was identified running a Invoke-CIMMethod Invoke-CIMSession on $dest$.
analytic_story:
    - Scattered Lapsus$ Hunters
    - Malicious PowerShell
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '8155.10007'
title: Radmin execution
description: Adversaries may gain access to and use third-party software suites installed
  within an enterprise network, such as administration, monitoring, and deployment
  systems, to move laterally through the network. Radmin is a remote management software
  that can be used to remotely control workstations. Silence Atomics T1072 Test#1
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "radmin.exe" OR "/connect:*" | table _time, host,
  user process, process_*, signature_id, parent_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process_name, "(?i)radmin") OR match(process,
  "(?i)\/connect\:.*?\:") '
techniques:
- execution:software deployment tools
- lateral-movement:software deployment tools
technique_id: 
- T1072
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

id: '18748.32126'
title: Shell Spawned by Web Server - Windows
description: 'This use case detects web server processes with child processes which
  can be an indication of a web shell attack. - Threat Actor Association: Alloy Taurus/Gallium,
  OilRig, Volt Typhoon (Bronze Silhouette, Vanguard Panda) -- Software Association:
  ALPHV/BlackCat, Clop'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(w3wp) OR TERM(httpd) OR TERM(nginx) OR TERM(php-cgi)
  OR TERM(tomcat) OR TERM(UMWorkerProcess)) (TERM(cmd) OR TERM(powershell) OR TERM(pwsh)
  OR TERM(csc) OR TERM(sh) OR TERM(bash) OR TERM(bitsadmin))| regex Creator_Process_Name="(?i)(w3wp|httpd|nginx|php-cgi|tomcat|UMWorkerProcess)\.exe"|
  regex New_Process_Name="(?i)(cmd|powershell|pwsh|csc|sh|bash|bitsadmin)\.exe" |
  table _time, host, user, signature_id, process, process_*, parent_process_* | bin
  span=1s | stats values(*) as * by _time, host, process_name | eventstats c(process_name)
  as c_process_name by process_name| where c_process_name < 25 '
techniques:
- persistence:server software component:iis components
- persistence:server software component:web shell
- defense-evasion:system binary proxy execution
technique_id:
- T1505.004
- T1505.003
- T1218
data_category:
- Windows event logs
references:
- https://www.microsoft.com/security/blog/2021/02/11/web-shell-attacks-continue-to-rise/
- https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response

id: '35956.74705'
title: Unexpected Network Connection from System Process
description: Threat actors may abuse legitimate system processes that typically lack
  network functionality to perform malicious network activity, helping evade detection
  and blend in with normal system behavior. This technique is often associated with
  process injection or masquerading, where code is executed within trusted processes
  to establish command-and-control (C2) channels or exfiltrate data. This use case
  detects instances where non-networking system processes (e.g., conhost.exe, lsass.exe,
  wininit.exe) are observed initiating network connections, which may indicate process
  injection, covert C2 activity, or execution of malicious payloads under trusted
  process names.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR
  "<EventID>5156<") ("conhost.exe" OR "explorer.exe" OR "services.exe" OR "wininit.exe"
  OR "lsass.exe" OR "dwm.exe" OR "spoolsv.exe" OR "taskhost.exe") | table _time, host,
  user, process, process_*, parent_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:application layer protocol
- defense-evasion:masquerading
- privilege-escalation:process injection
technique_id: 
- T1071
- T1036
- T1055
data_category:
- Windows event logs
- Process use of network
references:
- https://attack.mitre.org/techniques/T1071/
- https://attack.mitre.org/techniques/T1055/
- https://attack.mitre.org/techniques/T1057/
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072
- https://github.com/S1ckB0y1337/Cobalt-Strike-CheatSheet
- https://boschko.ca/cobalt-strike-process-injection/

name: Windows AppX Deployment Package Installation Success
id: 1234abcd-5678-90ef-1234-56789abcdef0
version: 4
creation_date: '2025-08-18'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: This analytic detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log. This event is generated when an MSIX/AppX package has been successfully installed on a system. While most package installations are legitimate, monitoring these events can help identify unauthorized or suspicious package installations, especially when correlated with other events such as unsigned package installations (EventID 603 with Flags=8388608) or full trust package installations (EventID 400 with HasFullTrust=true).
data_source:
    - Windows Event Log AppXDeployment-Server 854
search: |-
    `wineventlog_appxdeploymentserver` EventCode=854
      | stats count min(_time) as firstTime max(_time) as lastTime values(Path) as PackagePath
        BY dvc EventCode user_id
      | rename dvc as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_appx_deployment_package_installation_success_filter`
how_to_implement: To implement this detection, you need to be collecting Windows Event Logs from your endpoints, specifically the Microsoft-Windows-AppXDeploymentServer/Operational log. Ensure that your Splunk deployment is ingesting these logs with the source type "XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational". This detection works best when used in conjunction with other MSIX package abuse detections such as unsigned package installations (EventID 603) and full trust package installations (EventID 400).
known_false_positives: Legitimate MSIX/AppX package installations will trigger this detection. This is expected behavior and not necessarily indicative of malicious activity. This analytic is designed to provide visibility into package installations and should be used as part of a broader detection strategy. Consider correlating these events with other suspicious indicators such as unsigned packages or packages from unusual sources.
references:
    - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
    - https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/
    - https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A MSIX/AppX package $PackagePath$ was successfully installed on $dest$ by user $user_id$.
threat_objects:
    - field: PackagePath
      type: file_path
analytic_story:
    - MSIX Package Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Audit Policy Auditing Option Disabled via Auditpol
id: 663a7a50-b752-4c84-975b-8325ca3f6f9e
version: 9
creation_date: '2025-02-19'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of `auditpol.exe` with the "/set", "/option" and "/value:disable" command-line arguments used to disable specific auditing options of the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_auditpol` Processes.process="*/set*" Processes.process="*/option:*" Processes.process="*/value:disable*" Processes.process IN ("*FullPrivilegeAuditing*", "*AuditBaseObjects*", "*AuditBaseDirectories*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_audit_policy_auditing_option_disabled_via_auditpol_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time. and understood.
references:
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpac/262a2bed-93d4-4c04-abec-cf06e9ec72fd
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable an audit policy auditing option on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable an audit policy auditing option on endpoint $dest$ by user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows Audit Policy Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows MSI Rollback Script Deleted By Non-Msiexec Process
id: 6ec7cbda-9547-4f6b-8a00-d1fb4b52c1e9
version: 3
creation_date: '2026-05-05'
modification_date: '2026-07-20'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects deletion of a Rollback Script (.rbs) file under C:\Config.Msi, the critical filesystem manipulation step in an MSI Rollback privilege escalation attack that converts an arbitrary file delete primitive into full SYSTEM code execution.
    During a legitimate MSI installation, the Windows Installer service (running as SYSTEM) creates C:\Config.Msi and populates it with a Rollback Script (.rbs) and Rollback File (.rbf).
    These files define exactly how to restore the system to its pre-installation state if the install fails.
    The folder is protected with a strong DACL specifically to prevent tampering by low-privileged users — because whatever is in these files will be executed by the SYSTEM-level Installer service during rollback.
data_source:
    - Sysmon EventID 23
    - Sysmon EventID 26
search: |-
    `sysmon`
    EventCode IN (23, 26)
    TargetFilename="*:\\Config.Msi\\*"
    TargetFilename="*.rbs"
    NOT ProcessName="msiexec.exe"
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by Computer ProcessName TargetFilename EventID action dest dvc file_path file_hash
         file_name file_modify_time process_exec process_guid process_id process_name
         process_path signature signature_id user user_id vendor_product

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_msi_rollback_script_deleted_by_non_msiexec_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate system cleanup or MSI uninstallation processes may delete rbs files under c:\Config.Msi. Verify events with approved maintenance activities to reduce false alarms.
references:
    - https://github.com/mbog14/CVE-2024-44193
finding:
    title: MSI rollback script file $TargetFilename$ was deleted on $dest$ by $ProcessName$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: TargetFilename
      type: file_path
analytic_story:
    - Windows Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1218.007
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows PowerView SPN Discovery
id: a7093c28-796c-4ebb-9997-e2c18b870837
version: 12
creation_date: '2022-06-22'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-DomainUser` or `Get-NetUser` PowerShell cmdlets with the `-SPN` parameter, indicating the use of PowerView for SPN discovery. It leverages PowerShell Script Block Logging (EventCode=4104) to identify these specific commands. This activity is significant as it suggests an attempt to enumerate domain accounts associated with Service Principal Names (SPNs), a common precursor to Kerberoasting attacks. If confirmed malicious, this could allow an attacker to identify and target accounts for credential theft, potentially leading to unauthorized access and privilege escalation within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText =*Get-NetUser* OR ScriptBlockText=*Get-DomainUser*) ScriptBlockText= *-SPN*
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_powerview_spn_discovery_filter`
how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: False positive may include Administrators using PowerView for troubleshooting and management.
references:
    - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast
    - https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
    - https://attack.mitre.org/techniques/T1558/003
finding:
    title: PowerView commandlets used for SPN discovery executed on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - CISA AA23-347A
    - Rhysida Ransomware
    - Active Directory Kerberos Attacks
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1558.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6082.6527'
title: Windows Share Multiple File Access
description: 'SMB is a file, printer, and serial port sharing protocol for Windows
  machines on the same network or domain. Adversaries may use SMB to interact with
  file shares, allowing them to move laterally throughout a network. This use case
  looks for share requests to multiple files types within a short period of time.
  -- Threat Actor Association: APT29/Nobelium/Cozy Bear, Memento Team, Wizard Spider
  -- Software Association: Conti, Lockbit, Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5145) OR
  "<EventID>5145<")| regex Relative_Target_Name!="(?i)\.(ini|inf)"| regex Relative_Target_Name="(?i)\.\w{2,5}$"
  | table _time, host, user process, process_*, signature_id, parent_*, Share_Name,
  Relative_Target_Name | bin span=20s | stats values(*) as * by _time, host, Share_Name
  | eventstats dc(Relative_Target_Name) as dc_target by host, _time | where dc_target
  > 1 AND isnotnull(user) '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbclient.py

name: Wmic Group Discovery
id: 83317b08-155b-11ec-8e00-acde48001122
version: 12
creation_date: '2021-09-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of `wmic.exe` to enumerate local groups on an endpoint. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs, including command-line details. Monitoring this activity is significant as it can indicate reconnaissance efforts by an attacker to understand group memberships, which could be a precursor to privilege escalation or lateral movement. If confirmed malicious, this activity could allow an attacker to map out privileged groups, aiding in further exploitation and persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=wmic.exe (Processes.process="*group get name*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `wmic_group_discovery_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Discovery
    - LAMEHUG
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint