Splunk rules: 1f

name: Active Setup Registry Autostart
id: f64579c0-203f-11ec-abcc-acde48001122
version: 14
creation_date: '2021-09-29'
modification_date: '2026-05-13'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious modifications to the Active Setup registry for persistence and privilege escalation. It leverages data from the Endpoint.Registry data model, focusing on changes to the "StubPath" value within the "SOFTWARE\\Microsoft\\Active Setup\\Installed Components" path. This activity is significant as it is commonly used by malware, adware, and APTs to maintain persistence on compromised machines. If confirmed malicious, this could allow attackers to execute code upon system startup, potentially leading to further system compromise and unauthorized access.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Active setup installer may add or modify this registry.
references:
    - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FPoisonivy.E
    - https://attack.mitre.org/techniques/T1547/014/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Data Destruction
    - Windows Privilege Escalation
    - Hermetic Wiper
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1547.014
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Advanced IP or Port Scanner Execution
id: 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
version: 4
creation_date: '2025-10-24'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner.
    These legitimate administrative tools are often leveraged by threat actors and ransomware operators during the discovery phase to enumerate active hosts and open ports within a target environment.
    Detection is based on process creation telemetry referencing known executable names, original file names, or specific command-line parameters such as "/portable" and "/lng" that are characteristic of these tools.
    If confirmed malicious, this activity may indicate internal reconnaissance aimed at identifying reachable systems or services prior to lateral movement or further post-compromise actions.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

      from datamodel=Endpoint.Processes where
        Processes.process_name IN ("advanced_ip_scanner.exe", "advanced_ip_scanner_console.exe", "advanced_port_scanner.exe", "advanced_port_scanner_console.exe")
        OR
        Processes.original_file_name IN ("advanced_ip_scanner.exe", "advanced_ip_scanner_console.exe", "advanced_port_scanner.exe", "advanced_port_scanner_console.exe")
        OR (
        Processes.process = "* /portable *"
        Processes.process = "* /lng *"
        )

      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
         Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
         Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
         Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `advanced_ip_or_port_scanner_execution_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    Legitimate administrators or IT staff may use Advanced IP or Port Scanner for authorized
    network management or inventory purposes. Validate the context of execution and apply any filters as necessary.
references:
    - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
    - https://cloud.google.com/blog/topics/threat-intelligence/tactics-techniques-procedures-associated-with-maze-ransomware-incidents/
    - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
    - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Execution of Advanced IP or Port Scanner detected via $process$ on $dest$
        - field: dest
          type: system
          score: 20
          message: Execution of Advanced IP or Port Scanner detected via $process$ on $dest$
analytic_story:
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1046
    - T1135
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco ASA - AAA Policy Tampering
id: 8f2c4e9a-5d3b-4c7e-9a1f-6e8d5b2c3a9f
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects modifications to authentication and authorization (AAA) security policies on Cisco ASA devices via CLI or ASDM.
    AAA policies control critical security mechanisms including authentication attempts, lockout thresholds, password policies, and access control settings that protect administrative access to network infrastructure.
    Adversaries or malicious insiders may weaken authentication policies to facilitate brute force attacks, disable account lockouts to enable unlimited password attempts, reduce password complexity requirements, or modify authorization settings to elevate privileges and maintain persistent access.
    The detection monitors for command execution events containing AAA-related commands such as `aaa authentication`, `aaa authorization`, or `aaa local authentication`, focusing on changes to authentication attempts, lockout policies, and access control configurations.
    Investigate any unauthorized modifications to AAA policies, especially changes that weaken security posture (increasing max-fail attempts, disabling lockouts, reducing password requirements), and verify these changes against approved change management processes and security policies.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111008, 111010)
    command IN (
        "aaa authentication*",
        "aaa authorization*",
        "aaa local authentication*",
        "aaa-server*",
        "no aaa*"
    )
    | fillnull
    | stats count
            earliest(_time) as firstTime
            latest(_time) as lastTime
            values(user) as user
            values(action) as action
            values(message_id) as message_id
            values(command) as command
            values(src_ip) as src_ip
            values(process_name) as process_name
      by host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___aaa_policy_tampering_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Legitimate AAA configuration modifications may occur during normal administrative activities such as implementing new security policies, adjusting lockout thresholds or troubleshooting authentication issues. These events should be verified and investigated. Consider filtering modifications performed by known administrative accounts where necessary.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/aa-ac-commands.html
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: User $user$ executed command $command$ to modify AAA configuration on Cisco ASA host $host$.
threat_objects:
    - field: command
      type: process
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
asset_type: Network
mitre_attack_id:
    - T1556.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco ASA - Device File Copy to Remote Location
id: 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM.
    Adversaries may exfiltrate device files including configurations, logs, packet captures, or system data to remote servers using protocols like TFTP, FTP, HTTP, HTTPS, SMB, or SCP. While legitimate backups to centralized servers are common, copies to unexpected destinations may indicate data exfiltration to attacker-controlled infrastructure.
    The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands with remote protocol indicators (tftp:, ftp:, http:, https:, smb:, scp:).
    Investigate copies to unexpected destinations, from non-administrative accounts, or outside approved maintenance windows.
    We recommend adapting the detection filters to exclude known legitimate backup activities.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111008, 111010)
    command = "copy *"
    command IN (
        "*running-config*",
        "*startup-config*",
        "*/pcap capture:*",
        "* disk0:*",
        "* flash:*",
        "* system:*"
    )
    command IN (
        "*ftp:*",
        "*http:*",
        "*https:*",
        "*smb:*",
        "*scp:*"
    )

    | eval remote_protocol = mvappend(
      if(match(command, "tftp:"), "TFTP", null()),
      if(match(command, "ftp:"), "FTP", null()),
      if(match(command, "http:"), "HTTP", null()),
      if(match(command, "https:"), "HTTPS", null()),
      if(match(command, "smb:"), "SMB", null()),
      if(match(command, "scp:"), "SCP", null())
      )
    | fillnull
    | stats earliest(_time) as firstTime
            latest(_time) as lastTime
            values(user) as user
            values(action) as action
            values(message_id) as message_id
            values(command) as command
            values(remote_protocol) as remote_protocol
            values(src_ip) as src_ip
            values(dest) as dest
            values(process_name) as process_name
      by host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___device_file_copy_to_remote_location_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message IDs 111008 and 111010.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and add message IDs 111008 and 111010.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Legitimate configuration exports to remote locations may occur during normal administrative activities.
    Investigate these events to verify their legitimacy and apply necessary filters.
references:
    - https://community.cisco.com/t5/security-knowledge-base/asa-how-to-download-images-using-tftp-ftp-http-https-and-scp/ta-p/3109769
    - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: User $user$ executed command $command$ to copy file or config from Cisco ASA host $host$ to remote location $dest$ via $remote_protocol$ protocols.
        - field: user
          type: user
          score: 20
          message: User $user$ executed command $command$ to copy file or config from Cisco ASA host $host$ to remote location $dest$ via $remote_protocol$ protocols.
threat_objects:
    - field: command
      type: process
    - field: dest
      type: ip_address
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
    - ArcaneDoor
asset_type: Network
mitre_attack_id:
    - T1005
    - T1041
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '45491.91376'
title: Data Exfiltration via AWS CLI - Windows
description: Threat actors may abuse the AWS CLI s3 cp command with recursive and
  custom endpoint flags to exfiltrate large volumes of data to an S3-compatible storage
  service outside of the target environment. The use of --recursive, --region, and
  --endpoint-url flags together is indicative of bulk data transfers, potentially
  to unauthorized or attacker-controlled storage. This use case detects such activity
  on Windows systems, helping identify suspicious data movement or staging for exfiltration.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "s3 " " cp " " --recursive" " --region" " --endpoint-url" | table _time, host, user,
  process, parent_process_name, process_name | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- exfiltration:exfiltration over web service
technique_id: 
- T1567
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
- https://x.com/Kostastsale/status/1714343784799223877

name: Detect Excessive User Account Lockouts
id: 95a7f9a5-6096-437e-a19e-86f42ac609bd
version: 15
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: Anomaly
description: The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
      WHERE All_Changes.result="*lock*"
      BY All_Changes.user All_Changes.result
    | `drop_dm_object_name("All_Changes")`
    | `drop_dm_object_name("Account_Management")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | search count > 5
    | `detect_excessive_user_account_lockouts_filter`
how_to_implement: ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.
known_false_positives: It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Excessive user account lockouts for $user$ in a short period of time
analytic_story:
    - Active Directory Password Spraying
    - Scattered Lapsus$ Hunters
asset_type: Windows
mitre_attack_id:
    - T1078.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: access

name: Detect New Open GCP Storage Buckets
id: f6ea3466-d6bb-11ea-87d0-0242ac130003
version: 8
creation_date: '2020-08-19'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic identifies the creation of new open/public GCP Storage buckets. It leverages GCP PubSub events, specifically monitoring for the `storage.setIamPermissions` method and checks if the `allUsers` member is added. This activity is significant because open storage buckets can expose sensitive data to the public, posing a severe security risk. If confirmed malicious, an attacker could access, modify, or delete data within the bucket, leading to data breaches and potential compliance violations.
data_source: []
search: |-
    `google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions
      | spath output=action path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action
      | spath output=user path=data.protoPayload.authenticationInfo.principalEmail
      | spath output=location path=data.protoPayload.resourceLocation.currentLocations{}
      | spath output=src path=data.protoPayload.requestMetadata.callerIp
      | spath output=bucketName path=data.protoPayload.resourceName
      | spath output=role path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role
      | spath output=member path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member
      | search (member=allUsers AND action=ADD)
      | table  _time, bucketName, src, user, location, action, role, member
      | search `detect_new_open_gcp_storage_buckets_filter`
how_to_implement: This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview).
known_false_positives: While this search has no known false positives, it is possible that a GCP admin has legitimately created a public bucket for a specific purpose. That said, GCP strongly advises against granting full control to the "allUsers" group.
references: []
finding:
    title: |
        "allUser" member added to $bucketName$ by $user$ making the bucket available to the public
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Suspicious GCP Storage Activities
asset_type: GCP Storage Bucket
mitre_attack_id:
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Detect Regasm with no Command Line Arguments
id: c3bc1430-04e7-4178-835f-047d8e6e97df
version: 16
creation_date: '2021-02-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects instances of regasm.exe running without command line arguments. This behavior typically indicates process injection, where another process manipulates regasm.exe. The detection leverages Endpoint Detection and Response (EDR) data, focusing on process names and command-line executions. This activity is significant as it may signal an attempt to evade detection or execute malicious code. If confirmed malicious, attackers could achieve code execution, potentially leading to privilege escalation, persistence, or access to sensitive information. Investigate network connections, parallel processes, and suspicious module loads for further context.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where
    (Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)
    Processes.process IN ("*regasm","*regasm.exe", "*regasm.exe\"")
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_regasm_with_no_command_line_arguments_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
references:
    - https://attack.mitre.org/techniques/T1218/009/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
    - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
finding:
    title: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Regsvcs Regasm Activity
    - Living Off The Land
    - Handala Wiper
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1218.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Renamed WinRAR
id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
version: 16
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies instances where `WinRAR.exe` has been renamed and executed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because renaming executables is a common tactic used by attackers to evade detection. If confirmed malicious, this could indicate an attempt to bypass security controls, potentially leading to unauthorized data extraction or further system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.original_file_name=WinRAR.exe (Processes.process_name!=rar.exe
        AND
        Processes.process_name!=winrar.exe)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_renamed_winrar_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time. instances of WinRAR.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
analytic_story:
    - China-Nexus Threat Activity
    - Collection and Staging
    - CISA AA22-277A
    - Salt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1560.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disable Logs Using WevtUtil
id: 236e7c8e-c9d9-11eb-a824-acde48001122
version: 14
creation_date: '2021-06-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of "wevtutil.exe" with parameters to disable event logs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because disabling event logs is a common tactic used by ransomware to evade detection and hinder forensic investigations. If confirmed malicious, this action could allow attackers to operate undetected, making it difficult to trace their activities and respond effectively to the incident.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "wevtutil.exe"
        AND
        (Processes.process = "*sl*"
        OR
        Processes.process = "*set-log*" ) Processes.process IN ("*/e:false*", "*/enabled:false*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `disable_logs_using_wevtutil_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network operator may disable audit event logs for debugging purposes.
references:
    - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
finding:
    title: WevtUtil.exe used to disable Event Logging on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ransomware
    - CISA AA23-347A
    - Rhysida Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1685.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disable Windows Behavior Monitoring
id: 79439cae-9200-11eb-a4d3-acde48001122
version: 24
creation_date: '2021-03-31'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic identifies modifications in the registry to disable Windows Defender's real-time behavior monitoring. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with Windows Defender settings. This activity is significant because disabling real-time protection is a common tactic used by malware such as RATs, bots, or Trojans to evade detection. If confirmed malicious, this action could allow an attacker to execute code, escalate privileges, or persist in the environment without being detected by antivirus software.
data_source:
    - Sysmon EventID 13
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
       WHERE (
               Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR
               Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR
               Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR
               Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR
               Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR
               Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR
               Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND
               Registry.registry_value_data IN (1, "0x00000001")
               )
               by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
         | `drop_dm_object_name(Registry)`
         | where isnotnull(registry_value_data)
         | `security_content_ctime(firstTime)`
         | `security_content_ctime(lastTime)`
         | `disable_windows_behavior_monitoring_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable this windows features.
references:
    - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
finding:
    title: Windows Defender real time behavior monitoring disabled on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - Windows Defense Evasion Tactics
    - CISA AA23-347A
    - Revil Ransomware
    - Azorult
    - Windows Registry Abuse
    - Black Basta Ransomware
    - Ransomware
    - RedLine Stealer
    - Cactus Ransomware
    - Scattered Lapsus$ Hunters
    - NetSupport RMM Tool Abuse
    - Storm-0501 Ransomware
    - BlankGrabber Stealer
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Eventvwr UAC Bypass
id: 9cf8fe08-7ad8-11eb-9819-acde48001122
version: 13
creation_date: '2021-03-01'
modification_date: '2026-05-13'
author: Steven Dick, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects an Eventvwr UAC bypass by identifying suspicious registry modifications in the path that Eventvwr.msc references upon execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry changes and process execution details. This activity is significant because it indicates a potential privilege escalation attempt, allowing an attacker to execute arbitrary commands with elevated privileges. If confirmed malicious, this could lead to unauthorized code execution, persistence, and further compromise of the affected system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*mscfile\\shell\\open\\command\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `eventvwr_uac_bypass_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some false positives may be present and will need to be filtered.
references:
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
    - https://attack.mitre.org/techniques/T1548/002/
    - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
finding:
    title: Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - IcedID
    - Living Off The Land
    - Windows Registry Abuse
    - ValleyRAT
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6935.8202'
title: Reg.exe Process Execution
description: 'Reg is a Windows utility used to interact with the Windows Registry.
  It can be used at the command-line interface to query, add, modify, and remove information.
  -- Threat Actor Association: Kimsuky -- Software Association: BlackByte, Clop, Snatch,
  Trickbot -- Atomics T1037.001 Test#1 Atomics T1137.004 Test#1 Atomics T1137.002
  Test#1 Atomics T1137 Test#1 Atomics T1547.001 Test#1 Atomics T1547.001 Test#2 Atomics
  T1546.002 Test#1 Atomics T1547.010 Test#1 Atomics T1546.010 Test#1 Atomics T1548.002
  Test#1 Atomics T1548.002 Test#8 Atomics T1574.011 Test#2 Atomics T1562.004 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") "reg.exe" | table _time, host, user user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- discovery:query registry
technique_id: 
- T1112
- T1012
data_category:
- Windows event logs
references:
- https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/

name: Samsam Test File Write
id: 493a879d-519d-428f-8f57-a06a0fdc107e
version: 9
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a file named "test.txt" within the Windows system directory, indicative of Samsam ransomware propagation. It leverages file-system activity data from the Endpoint data model, specifically monitoring file paths within the Windows System32 directory. This activity is significant as it aligns with known Samsam ransomware behavior, which uses such files for propagation and execution. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system disruption, and potential data loss. Immediate investigation and remediation are crucial to prevent further damage.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\windows\\system32\\test.txt by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`'
how_to_implement: You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
known_false_positives: No false positives have been identified.
references: []
finding:
    title: A samsam ransomware test file creation in $file_path$ in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A samsam ransomware test file creation in $file_path$ in host $dest$
analytic_story:
    - SamSam Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32674.58080'
title: Suspicious csc.exe Source File Folder
description: 'Adversaries may attempt to make payloads difficult to discover and analyze
  by delivering files to victims as uncompiled code. Text-based source code files
  may subvert analysis and scrutiny from protections targeting executables/binaries.
  These payloads will need to be compiled before execution; typically via native utilities
  such as csc.exe or GCC/MinGW. This use case detects csc.exe executions compiling
  a .cs file from a suspicious folder. Note: Due to its extended logging capabilities
  on parent process information, Sysmon is recommended for best fidelity. -- Threat
  Actor Association: Alpha (STAC1248)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(csc) OR "csc.exe") ("\\AppData" OR "\\Windows\\Temp")
  | regex parent_process_path!="(?i)(^C:\x5cProgram\sFiles)|(sdiagnhost|w3wp|choco)\.exe"|
  regex process="(?i)\x5cAppData\x5c|\x5cWindows\x5cTemp"| regex process!="(?i)\"C:\x5cWindows\x5cMicrosoft\.NET\x5cFramework64\x5cv\d+\.\d+\.\d+\x5ccsc\.exe\"\s\/noconfig\s\/fullpaths\s@\"C:\x5cWINDOWS\x5cTEMP\x5c[a-zA-Z0-9]{8}\x5c[a-zA-Z0-9]{8}\.cmdline\""
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:compile after delivery
technique_id:
- T1027.004
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1027/004/
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_csc_susp_folder.yml
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072

id: '16272.24660'
title: System Network Connections Discovery - Windows
description: 'Adversaries may attempt to get a listing of network connections to or
  from the compromised system they are currently accessing or from remote systems
  by querying for information over the network. -- Threat Actor Association: Alloy
  Taurus/Gallium, Volt Typhoon -- Atomics T1049 Test #1 Atomics T1049 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "netstat" OR ("net" ("use" or "sessions")) OR
  TERM(Get-NetTCPConnection) | regex process="(?i)netstat(\.exe)?|net(\.exe)?\s+(use|sessions)|Get-TCPConnection"
  | table _time, host, user process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- discovery:system network connections discovery
technique_id: 
- T1049
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell

name: Windows Account Access Removal via Logoff Exec
id: 223572ab-8768-4e20-9b39-c38707af80dc
version: 9
creation_date: '2024-12-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: "The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation."
data_source:
    - Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = logoff.exe Processes.parent_process_name IN ("cmd.exe", "powershell.exe", "pwsh.exe")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_account_access_removal_via_logoff_exec_filter`
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command.
references:
    - https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Process having child process [$process_name$] used to logoff user on [$dest$].
        - field: user
          type: user
          score: 20
          message: Process having child process [$process_name$] used to logoff user on [$dest$].
analytic_story:
    - Crypto Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1531
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Account Discovery for Sam Account Name
id: 69934363-e1dd-4c49-8651-9d7663dd4d2f
version: 11
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the PowerView PowerShell cmdlet Get-NetUser, specifically querying for "samaccountname" and "pwdlastset" attributes. It leverages Event ID 4104 from PowerShell Script Block Logging to identify this activity. This behavior is significant as it may indicate an attempt to gather user account information from Active Directory, which is a common reconnaissance step in lateral movement or privilege escalation attacks. If confirmed malicious, this activity could allow an attacker to map out user accounts, potentially leading to further exploitation and unauthorized access within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104  ScriptBlockText = "*Get-NetUser*" ScriptBlockText IN ("*samaccountname*", "*pwdlastset*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_account_discovery_for_sam_account_name_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Windows Account Discovery for Sam Account Name on $dest$.
analytic_story:
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1087
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows LOLBAS Executed As Renamed File
id: fd496996-7d9e-4894-8d40-bb85b6192dc6
version: 10
creation_date: '2024-05-03'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '|  tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: A certain amount of false positives are likely with this detection. MSI based installers often trigger for SETUPAPL.dll and vendors will often copy system exectables to a different path for application usage.
references:
    - https://attack.mitre.org/techniques/T1036/
    - https://attack.mitre.org/techniques/T1036/003/
finding:
    title: The file originally named $original_file_name$ was executed as $process_name$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The file originally named $original_file_name$ was executed as $process_name$ on $dest$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Living Off The Land
    - Masquerading - Rename System Utilities
    - Windows Defense Evasion Tactics
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1036.003
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Do Not Connect To Win Update
id: e09c598e-8dd0-4e73-b740-4b96b689199e
version: 11
creation_date: '2023-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a suspicious modification to the Windows registry that disables automatic updates. It leverages data from the Endpoint datamodel, specifically monitoring changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" with a value of "0x00000001". This activity is significant as it can be used by adversaries, including malware like RedLine Stealer, to evade detection and prevent the system from receiving critical updates. If confirmed malicious, this could allow attackers to exploit vulnerabilities, persist in the environment, and potentially deploy additional payloads.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_do_not_connect_to_win_update_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: administrators may enable or disable this feature that may cause some false positive.
references:
    - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a registry modification in Windows auto update configuration on $dest$
analytic_story:
    - RedLine Stealer
asset_type: Endpoint
atomic_guid:
    - 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Mshta Execution In Registry
id: e13ceade-b673-4d34-adc4-4d9c01729753
version: 13
creation_date: '2022-10-14'
modification_date: '2026-07-20'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of mshta.exe via registry entries to run malicious scripts. It leverages registry activity logs to identify entries containing "mshta," "javascript," "vbscript," or "WScript.Shell." This behavior is significant as it indicates potential fileless malware, such as Kovter, which uses encoded scripts in the registry to persist and execute without files. If confirmed malicious, this activity could allow attackers to maintain persistence, execute arbitrary code, and evade traditional file-based detection methods, posing a significant threat to system integrity and security.
data_source:
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
      WHERE Registry.registry_value_data = "*mshta*"
        OR
        Registry.registry_value_data IN ("*javascript:*", "*vbscript:*","*WScript.Shell*")
      BY Registry.action Registry.dest Registry.process_guid
         Registry.process_id Registry.registry_hive Registry.registry_path
         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
         Registry.registry_value_type Registry.status Registry.user
         Registry.vendor_product
    | `drop_dm_object_name(Registry)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_mshta_execution_in_registry_filter`
how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
known_false_positives: No false positives have been identified at this time.
references:
    - https://redcanary.com/threat-detection-report/techniques/mshta/
    - https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/fileless-threats?view=o365-worldwide
finding:
    title: A registry $registry_path$ contains mshta $registry_value_data$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A registry $registry_path$ contains mshta $registry_value_data$ on $dest$
analytic_story:
    - Suspicious Windows Registry Activities
    - Windows Persistence Techniques
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint