Splunk rules: 1e

name: Azure AD Service Principal Authentication
id: 5a2ec401-60bb-474e-b936-1e66e7aa4060
version: 12
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies authentication events of service principals in Azure Active Directory. It leverages the `azure_monitor_aad` data source, specifically targeting "Sign-in activity" within ServicePrincipalSignInLogs. This detection gathers details such as sign-in frequency, timing, source IPs, and accessed resources. Monitoring these events is significant for SOC teams to distinguish between normal application authentication and potential anomalies, which could indicate compromised credentials or malicious activities. If confirmed malicious, attackers could gain unauthorized access to resources, leading to data breaches or further exploitation within the environment.
data_source:
    - Azure Active Directory Sign-in activity
search: |-
    `azure_monitor_aad` operationName="Sign-in activity" category=ServicePrincipalSignInLogs
      | rename properties.* as *
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product resourceDisplayName
           resourceId signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_service_principal_authentication_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: Service Principals will legitimally authenticate remotely to your tenant. Implementing this detection after establishing a baseline enables a more accurate identification of security threats, ensuring proactive and informed responses to safeguard the Azure AD environment. source ips.
references:
    - https://attack.mitre.org/techniques/T1078/004/
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins#service-principal-sign-ins
finding:
    title: Service Principal $user$ authenticated from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Account Takeover
    - NOBELIUM Group
asset_type: Azure Active Directory
mitre_attack_id:
    - T1078.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '5327.5412'
title: Certutil File Download
description: 'There are attack scenarios in which attackers download different tools
  or scripts in order to take full control over certain machines. For example, an
  attacker gets a reverse shell on the target but is a low privileged shell. In this
  situation, the attacker can download different exploits on the target for privilege
  escalation using tools such as wget. -- Threat Actor Association: APT41, DarkSide,
  BlackMatter, APT31, Flax Typhoon, Wizard Spider - Software Association: ALPHV/BlackCat,
  Babuk, Bazar, Conti -- Atomics T1027 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<" OR Type=Process) (TERM("certutil") OR TERM(-urlcache)) | where match
  (process, "(?i)(\w?\wtps?\:(\/\/|\x5c\x5c))|\:\/\/") OR (match(process_name, "(?i)certutil")
  AND match(process, "(?i)u.*?r.*?l.*?c.*?a.*?c.*?h.*?e")) | table _time, host, user,
  signature_id, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host, process '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:obfuscated files or information
technique_id: 
- T1105
- T1027
data_category:
- Windows event logs
references:
- https://www.ired.team/offensive-security/defense-evasion/downloading-file-with-certutil

name: Cloud Security Groups Modifications by User
id: cfe7cca7-2746-4bdf-b712-b01ed819b9de
version: 9
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies unusual modifications to security groups in your cloud environment by users, focusing on actions such as modifications, deletions, or creations over 30-minute intervals. It leverages cloud infrastructure logs and calculates the standard deviation for each user, using the 3-sigma rule to detect anomalies. This activity is significant as it may indicate a compromised account or insider threat. If confirmed malicious, attackers could alter security group configurations, potentially exposing sensitive resources or disrupting services.
data_source:
    - AWS CloudTrail
search: |-
    | tstats dc(All_Changes.object) as unique_security_groups values(All_Changes.src) as src values(All_Changes.user_type) as user_type values(All_Changes.object_category) as object_category values(All_Changes.object) as objects values(All_Changes.action) as action  values(All_Changes.user_agent) as user_agent values(All_Changes.command) as command FROM datamodel=Change
      WHERE All_Changes.object_category = "security_group" (All_Changes.action = modified
        OR
        All_Changes.action = deleted
        OR
        All_Changes.action = created)
      BY All_Changes.user _time span=30m
    | `drop_dm_object_name("All_Changes")`
    | eventstats avg(unique_security_groups) as avg_changes , stdev(unique_security_groups) as std_changes
      BY user
    | eval upperBound=(avg_changes+std_changes*3)
    | eval isOutlier=if(unique_security_groups > 2 and unique_security_groups >= upperBound, 1, 0)
    | where isOutlier=1
    | `cloud_security_groups_modifications_by_user_filter`
how_to_implement: This search requries the Cloud infrastructure logs such as AWS Cloudtrail, GCP Pubsub Message logs, Azure Audit logs to be ingested into an accelerated Change datamodel. It is also recommended that users can try different combinations of the `bucket` span time and outlier conditions to better suit with their environment.
known_false_positives: It is possible that legitimate user/admin may modify a number of security groups
references:
    - https://attack.mitre.org/techniques/T1578/005/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Unsual number cloud security group modifications detected by user - $user$
analytic_story:
    - Suspicious Cloud User Activities
asset_type: Cloud Instance
mitre_attack_id:
    - T1578.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Detect HTML Help Using InfoTech Storage Handlers
id: 0b2eefa5-5508-450d-b970-3dd2fb761aec
version: 15
creation_date: '2021-02-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of hh.exe (HTML Help) using InfoTech Storage Handlers to load Windows script code from a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because it can be used to execute malicious scripts embedded within CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow an attacker to execute arbitrary code, escalate privileges, or persist within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_hh` Processes.process IN ("*its:*", "*mk:@MSITStore:*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_html_help_using_infotech_storage_handlers_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1218/001/
    - https://www.kb.cert.org/vuls/id/851869
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
    - https://lolbas-project.github.io/lolbas/Binaries/Hh/
    - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
    - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
finding:
    title: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Compiled HTML Activity
    - Living Off The Land
    - Compromised Windows Host
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '17974.30257'
title: hh.exe Execution
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. -- Threat Actor Association: APT-K-47/Mysterious Elephant,
  Gamaredon (aka. Armageddon, UAC-0010), Kimsuky -- LOLBAS Atomics T1218.001 Test
  #1 Atomics T1218.001 Test #2 Atomics T1218.001 Test #3 Atomics T1218.001 Test #4
  Atomics T1218.001 Test #5 Atomics T1218.001 Test #6 Atomics T1218.001 Test #7 Atomics
  T1218.001 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(hh) OR TERM(hh.exe)) | where match(process_name, "(?i)hh\.exe") OR match(process,
  "(?i)hh\.exe") | table _time, host, user process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-8---decompile-local-chm-file
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
- https://asec.ahnlab.com/en/51746/

name: Linux Sudoers Tmp File Creation
id: be254a5c-63e7-11ec-89da-acde48001122
version: 13
creation_date: '2022-01-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of the "sudoers.tmp" file, which occurs when editing the /etc/sudoers file using visudo or another editor on a Linux platform. This detection leverages filesystem data to identify the presence of "sudoers.tmp" files. Monitoring this activity is crucial as adversaries may exploit it to gain elevated privileges on a compromised host. If confirmed malicious, this activity could allow attackers to modify sudoers configurations, potentially granting them unauthorized access to execute commands as other users, including root, thereby compromising the system's security.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_path IN ("*sudoers.tmp*")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `linux_sudoers_tmp_file_creation_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A file $file_name$ is created in $file_path$ on $dest$
analytic_story:
    - Linux Persistence Techniques
    - China-Nexus Threat Activity
    - Salt Typhoon
    - Linux Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '8513.10738'
title: List Open Egress Ports
description: 'Each port allowed outbound from a network creates an additional exit
  point for attackers to utilize. This use case looks for outbound port scans of the
  top 128 ports in use on the Internet as defined by the Nmap project. -- Software
  Association: IcedID, Nokoyawa -- Atomics T1016 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR
  "EventID>5156<") TERM(outbound) Destination_Port IN(80,23,443,21,22,25,3389,110,445,139,143,53,135,3306,8080,1723,111,995,993,5900,1025,587,8888,199,1720,465,548,113,81,6001,10000,514,5060,179,1026,2000,8443,8000,32768,554,26,1433,49152,2001,515,8008,49154,1027,5666,646,5000,5631,631,49153,8081,2049,88,79,5800,106,2121,1110,49155,6000,513,990,5357,427,49156,543,544,5101,144,7,389,8009,3128,444,9999,5009,7070,5190,3000,5432,3986,13,1029,9,6646,49157,1028,873,1755,2717,4899,9100,119,37,1000,3001,5001,82,10010,1030,9090,2107,1024,2103,6004,1801,19,8031,1041,255,3703,17,808,3689,1031,1071,5901,9102,9000,2105,636,1038,2601,7000)
  NOT Destination_Address IN(10.0.0.0/8, 172.16.0.0/12, 192.168.16.0/16, 127.0.0.0/8,
  ::1, FE80::/10, FF00::/8) | table _time, host, user, signature_id, process, process_*,
  parent_process_*, src_ip, dest_ip, dest_port `group_events("host, process_path",
  10)`| eventstats dc(dest_port) as dc_dest_port by host, src_ip, _time| where dc_dest_port
  > 5 and event_count > 5 '
techniques:
- discovery:system network connections discovery
- discovery:network service discovery
technique_id: 
- T1049
- T1046
data_category:
- Windows event logs
references:
- https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/

name: Log4Shell JNDI Payload Injection Attempt
id: c184f12e-5c90-11ec-bf1f-497c9a704a72
version: 9
creation_date: '2021-12-13'
modification_date: '2026-05-13'
author: Jose Hernandez
status: production
type: Anomaly
description: The following analytic identifies attempts to inject Log4Shell JNDI payloads via web calls. It leverages the Web datamodel and uses regex to detect patterns like `${jndi:ldap://` in raw web event data, including HTTP headers. This activity is significant because it targets vulnerabilities in Java web applications using Log4j, such as Apache Struts and Solr. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to full system compromise. Immediate investigation is required to determine if the attempt was successful and to mitigate any potential exploitation.
data_source:
    - Nginx Access
search: |-
    | from datamodel Web.Web
    | regex _raw="[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)\w+(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?"
    | fillnull
    | stats count by action, category, dest, dest_port, http_content_type, http_method, http_referrer, http_user_agent, site, src, url, url_domain, user
    | `log4shell_jndi_payload_injection_attempt_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
known_false_positives: If there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.
references:
    - https://www.lunasec.io/docs/blog/log4j-zero-day/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: CVE-2021-44228 Log4Shell triggered for host $dest$
        - field: dest
          type: system
          score: 20
          message: CVE-2021-44228 Log4Shell triggered for host $dest$
analytic_story:
    - Log4Shell CVE-2021-44228
    - CISA AA22-257A
    - CISA AA22-320A
asset_type: Endpoint
cve:
    - CVE-2021-44228
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: threat

id: '5987.18207'
title: Package installation
description: 'Some programming languages, like Python, come with an easy, more or
  less official method of installing dependencies for your projects. These installers
  are usually tied to public code repositories where anyone can freely upload code
  packages for others to use. The intent of this use case is to identify installation
  of packages, with common repositories using pip, gem and npm. Use case will be used
  to with additional threat identifiers to potentially identify Dependency confusion
  style attacks. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  (TERM(npm) OR TERM(pip) OR TERM(gem)) TERM(install) | regex process="(?i)install\s"
  | rex field=process "(?<reqs>(?i)requirements\.txt") | rex field=process "(?<extra>(?i)(\-{2}extra)?\-index\-url(\s+\S+)")
  | rex field=process "(?<source1>(?i)\-{2}source(\s+\S+)") | eval keywords=mvappend(reqs,
  extra, source1) | table _time, host, user, signature_id, process, process_*, parent_*,
  keyword | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

name: PowerShell Enable PowerShell Remoting
id: 40e3b299-19a5-4460-96e9-e1467f714f8e
version: 12
creation_date: '2023-03-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the Enable-PSRemoting cmdlet, which allows PowerShell remoting on a local or remote computer. This detection leverages PowerShell Script Block Logging (EventCode 4104) to identify when this cmdlet is executed. Monitoring this activity is crucial as it can indicate an attacker enabling remote command execution capabilities on a compromised system. If confirmed malicious, this activity could allow an attacker to take control of the system remotely, execute commands, and potentially pivot to other systems within the network, leading to further compromise and lateral movement.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText="*Enable-PSRemoting*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_enable_powershell_remoting_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Note that false positives may occur due to the use of the Enable-PSRemoting cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
references:
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.3
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: PowerShell was identified running a Invoke-PSremoting on $dest$.
analytic_story:
    - Malicious PowerShell
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '24501.45206'
title: PuTTY Secure Copy Client Execution
description: pscp.exe is a tool in the PuTTY suite used for secure copy and has been
  used by threat actors including BlackCat and Agrius to exfiltrate data. This use
  case detects executions of pscp.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "pscp.exe" | table _time, host, user process, process_*, signature_id,
  parent_* | bin span=60s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over alternative protocol
technique_id: 
- T1048
data_category:
- PowerShell logs
references:
- https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
- https://www.trendmicro.com/en_us/research/23/f/malvertising-used-as-entry-vector-for-blackcat-actors-also-lever.html

name: Windows BitLocker Suspicious Command Usage
id: d0e6ec70-6e40-41a2-8b93-8d9ff077a746
version: 7
creation_date: '2025-02-10'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: This analytic is developed to detect the usage of BitLocker commands used to disable or impact boot settings. The malware ShrinkLocker uses various commands change how BitLocker handles encryption, potentially bypassing TPM requirements, enabling BitLocker without TPM, and enforcing specific startup key and PIN configurations. Such modifications can weaken system security, making it easier for unauthorized access and data breaches. Detecting these changes is crucial for maintaining robust encryption and data protection.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = manage-bde.exe
        AND
        Processes.process IN ("* -protectors -disable *","* -protectors -delete *","* -forcerecovery *","* -lock *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_bitlocker_suspicious_command_usage_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
references:
    - https://attack.mitre.org/techniques/T1486/
    - https://www.nccgroup.com/us/research-blog/nameless-and-shameless-ransomware-encryption-via-bitlocker/
    - https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
    - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
finding:
    title: A suspicious Windows BitLocker command was run by $user$ detected on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious Windows BitLocker command was run by $user$ detected on $dest$
threat_objects:
    - field: parent_process
      type: process
analytic_story:
    - ShrinkLocker
asset_type: Endpoint
mitre_attack_id:
    - T1486
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5995.6370'
title: Windows Firewall Disabled
description: 'Adversaries may disable or windows firewalls in order to bypass controls
  enable adversary C2 communications, lateral movement, and/or data exfiltration that
  would otherwise not be allowed. -- Threat Actor Association: APT41, Muddled Libra
  - Software Association: Agent Tesla, BlackByte, Conti, Insekt, Lockbit, PurpleFox,
  Prometheus / Spook, Ransom Cartel, Trickbot Atomics T1562.004 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(netsh)
  (TERM(firewall) OR TERM(advfirewall)) TERM(set) (("mode=disable") OR (TERM(state)
  TERM(off)))) OR (TERM(NetFirewallProfile) TERM(-Enabled) TERM(false)) OR ((TERM(sc)
  OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service)) TERM(windows)
  TERM(firewall)) OR ((TERM(REG) OR "reg.exe") TERM(ADD) TERM(FirewallPolicy) TERM(EnableFirewall)
  TERM(0)) | table _time, host, user process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | where match(process_name, "(?i)cmd|powershell|netsh|net1?|sc.exe|reg.exe") '
techniques:
- defense-evasion:impair defenses:disable or modify system firewall
technique_id:
- T1562.004
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://us-cert.cisa.gov/sites/default/files/publications/MAR-10135536-G.PDF
- https://blogs.cisco.com/security/talos/opening-zxshell

name: Windows Privilege Escalation Suspicious Process Elevation
id: 6a80300a-9f8a-4f22-bd3e-09ca577cfdfc
version: 12
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: |
    The following analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations.
    This behavior is identified using process execution data from Windows process monitoring.
    This activity is significant as it may indicate a threat actor successfully elevating privileges, which is a common tactic in advanced attacks.
    If confirmed malicious, this could allow the attacker to execute code with higher privileges, potentially leading to full system compromise and persistent access.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime

    from datamodel=Endpoint.Processes where

    Processes.process_integrity_level IN ("low","medium","high")
    NOT Processes.user IN ("*SYSTEM","*LOCAL SERVICE","*NETWORK SERVICE","DWM-*","*$")

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id
       Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | eval join_guid = process_guid,
           integrity_level = CASE(
                match(process_integrity_level,"low"),1,
                match(process_integrity_level,"medium"),2,
                match(process_integrity_level,"high"),3,
                match(process_integrity_level,"system"),4,
                true(),0
            )
    | rename user as src_user,
             parent_process* as orig_parent_process*,
             process* as parent_process*

    | join max=0 dest join_guid [
        | tstats `security_content_summariesonly`
          count max(_time) as lastTime

        from datamodel=Endpoint.Processes where

        (
            Processes.process_integrity_level IN ("system")
            NOT Processes.user IN (
                    "*SYSTEM",
                    "*LOCAL SERVICE",
                    "*NETWORK SERVICE",
                    "DWM-*",
                    "*$"
                )
        )
        OR
        (
            Processes.process_integrity_level IN (
                "high",
                "system"
            )
            (
                Processes.parent_process_path IN (
                    "*\\\\*",
                    "*\\Users\\*",
                    "*\\Temp\\*",
                    "*\\ProgramData\\*"
                )
                OR
                Processes.process_path IN (
                    "*\\\\*",
                    "*\\Users\\*",
                    "*\\Temp\\*",
                    "*\\ProgramData\\*"
                )
            )
        )

        by Processes.dest Processes.user Processes.parent_process_guid
           Processes.process_name Processes.process
           Processes.process_path Processes.process_integrity_level
           Processes.process_current_directory

        | `drop_dm_object_name(Processes)`

        | eval elevated_integrity_level = CASE(
                    match(process_integrity_level,"low"),1,
                    match(process_integrity_level,"medium"),2,
                    match(process_integrity_level,"high"),3,
                    match(process_integrity_level,"system"),4,
                    true(),0
                )
        | rename parent_process_guid as join_guid
    ]

    | where
        elevated_integrity_level > integrity_level
        OR
        user != elevated_user

    | fields dest user src_user parent_process_name parent_process
             parent_process_path parent_process_guid
             parent_process_integrity_level parent_process_current_directory
             process_name process process_path process_guid
             process_integrity_level process_current_directory
             orig_parent_process_name orig_parent_process
             orig_parent_process_guid firstTime lastTime count

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_privilege_escalation_suspicious_process_elevation_filter`
how_to_implement: |-
    Target environment must ingest process execution data sources such as Windows process monitoring and/or Sysmon EID 1.
known_false_positives: |-
    False positives may be generated by administrators installing benign applications using run-as/elevation.
references:
    - https://attack.mitre.org/techniques/T1068/
    - https://vuls.cert.org/confluence/display/Wiki/2021/06/21/Finding+Privilege+Escalation+Vulnerabilities+in+Windows+using+Process+Monitor
    - https://redcanary.com/blog/getsystem-offsec/
    - https://atomicredteam.io/privilege-escalation/T1134.001/
finding:
    title: The user $src_user$ launched a process [$parent_process_name$] which spawned a suspicious elevated integrity process [$process_name$].
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The user $src_user$ launched a process [$parent_process_name$] which spawned a suspicious elevated integrity process [$process_name$].
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows Privilege Escalation
    - BlackSuit Ransomware
    - GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
    - T1068
    - T1548
    - T1134
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows User Disabled Via Net
id: b0359e05-c87b-4354-83d8-aee0d890243f
version: 9
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the `net.exe` utility to disable a user account via the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate an adversary's attempt to disrupt user availability, potentially as a precursor to further malicious actions. If confirmed malicious, this could lead to denial of service for legitimate users, aiding the attacker in maintaining control or covering their tracks.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_net`
        AND
        Processes.process="*user*"
        AND
        Processes.process="*/active:no*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_user_disabled_via_net_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - XMRig
asset_type: Endpoint
mitre_attack_id:
    - T1531
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Vulnerable Driver Loaded
id: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4
version: 10
creation_date: '2022-12-31'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.
data_source:
    - Sysmon EventID 6
search: |-
    `sysmon` EventCode=6
      | stats  min(_time) as firstTime max(_time) as lastTime count
        BY ImageLoaded dest dvc
           process_hash process_path signature
           signature_id user_id vendor_product
      | lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description
      | search is_driver = TRUE
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_vulnerable_driver_loaded_filter`
how_to_implement: Sysmon collects driver loads via EventID 6, however you may modify the query to utilize this lookup to identify potentially persistent drivers that are known to be vulnerable.
known_false_positives: False positives will be present. Drill down into the driver further by version number and cross reference by signer. Review the reference material in the lookup. In addition, modify the query to look within specific paths, which will remove a lot of "normal" drivers.
references:
    - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_vuln_drivers_names.yml
    - https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
    - https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/
    - https://github.com/jbaines-r7/dellicious
    - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
    - https://github.com/namazso/physmem_drivers
    - https://github.com/stong/CVE-2020-15368
    - https://github.com/CaledoniaProject/drivers-binaries
    - https://github.com/Chigusa0w0/AsusDriversPrivEscala
    - https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
    - https://eclypsium.com/2019/11/12/mother-of-all-drivers/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37969
analytic_story:
    - Windows Drivers
    - BlackByte Ransomware
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows WinDBG Spawning AutoIt3
id: 7aec015b-cd69-46c3-85ed-dac152056aa4
version: 12
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies instances of the WinDBG process spawning AutoIt3. This behavior is detected by monitoring endpoint telemetry for processes where 'windbg.exe' is the parent process and 'autoit3.exe' or similar is the child process. This activity is significant because AutoIt3 is frequently used by threat actors for scripting malicious automation, potentially indicating an ongoing attack. If confirmed malicious, this could allow attackers to automate tasks, execute arbitrary code, and further compromise the system, leading to data exfiltration or additional malware deployment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes  where Processes.parent_process_name=windbg.exe  AND (Processes.process_name IN ("autoit3.exe", "autoit*.exe") OR Processes.original_file_name IN ("autoit3.exe", "autoit*.exe")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval matches_extension=if(match(process, "\\.(au3|a3x|exe|aut|aup)$"), "Yes", "No") | search matches_extension="Yes" | `windows_windbg_spawning_autoit3_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will only be present if the WinDBG process legitimately spawns AutoIt3. Filter as needed.
references:
    - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
    - DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint