Splunk rules: 1h

name: AWS Bedrock Claude Possible Prompt Injection
id: 9e162548-3e9a-4a74-9eb5-34ee28350f07
version: 1
creation_date: '2026-07-06'
modification_date: '2026-07-06'
author: Rod Soto
status: production
type: Hunting
description: This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. These strings are not inherently malicious on their own - many of them (for example "act as", "you must", or "new persona") appear routinely in legitimate system prompts, few-shot examples, and role-play or creative-writing use cases. This is a hunting search rather than an anomaly detection because the base rate of benign matches is high; use it to pivot into the surrounding conversation and look for corroborating signals such as the phrase appearing mid-conversation rather than in an expected system/few-shot prompt, the user attempting to override guardrails or safety instructions rather than set a benign persona, instructions that follow the injected phrase requesting privilege escalation, data exfiltration, or access to restricted tools/resources, repeated or iterative attempts from the same user/role after being refused, and injected phrases originating from untrusted input (e.g., retrieved documents or tool output) rather than the human user turn.
data_source:
    - AWS Bedrock Claude
search: |-
    `aws_bedrock_claude`
    | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv
    | eval prompt_text = mvjoin(prompt_mv, " || ")
    | where isnotnull(prompt_text) AND isnotnull(user_arn)
    | rex field=user_arn "(?:assumed-role/[^/]+|user)/(?<user>[^\"/]+)$"
    | eval s_override = if(match(prompt_text,"(?i)\b(ignore|disregard|forget)\b.{0,30}\b(previous|above|prior|all|your|the)\s*(instructions?|prompts?|rules?|context)"),1,0)
    | eval s_jailbreak = if(match(prompt_text,"(?i)\b(jailbreak|jailbroken|\bDAN\b mode|do anything now|developer mode|unrestricted mode|no (filters|restrictions|guardrails))\b"),1,0)
    | eval s_probe = if(match(prompt_text,"(?i)(reveal|repeat|print|show|output).{0,20}(system prompt|your instructions|initial (prompt|instructions)|the (text|words) above)"),1,0)
    | eval s_persona = if(match(prompt_text,"(?i)\b(you are now|new persona|pretend (to be|you are)|roleplay as|act as (if you|an unrestricted))\b"),1,0)
    | eval s_weak = if(match(prompt_text,"(?i)\b(you must|from now on|act as|override|new rules|hypothetically)\b"),1,0)
    | eval signal_count = s_override+s_jailbreak+s_probe+s_persona+s_weak
    | where s_override=1 OR s_jailbreak=1 OR s_probe=1 OR signal_count >= 2
    | table _time, user, user_arn, modelId, prompt_text, host
    | sort - _time
    | `aws_bedrock_claude_possible_prompt_injection_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land.
known_false_positives: These phrases have a high benign base rate. Terms like "act as", "you must", "from now on", and "new persona" are commonly found in legitimate system prompts and few-shot examples used to steer model behavior, as well as in role-play or creative writing requests from users. A match on its own is not evidence of an attack; review the surrounding conversation, the message role (system vs. user vs. tool output), and whether the phrase is followed by a request to bypass safety controls or access sensitive data/tools before treating a hit as suspicious.
references:
    - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/
    - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock
    - https://research.splunk.com/stories/aws_bedrock_security/
    - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
analytic_story:
    - Suspicious AWS Bedrock Claude Activities
asset_type: Web Application
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Cisco Isovalent - Non Allowlisted Image Use
id: 9f2b7b1d-6c2f-4f2d-9a8b-8a1d7c5f2e11
version: 5
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects use of container images that fall outside an approved
    allowlist, leveraging Cisco Isovalent/Tetragon runtime telemetry (image name and
    workload identity). Adversaries commonly introduce untrusted or newly published
    images to deploy tooling, establish persistence, or abuse supply‑chain trust. This
    behavior may indicate image pulls from unauthorized registries, execution of
    unvetted software, or a drift from established deployment baselines. Extra scrutiny
    is warranted for namespaces and workloads that normally source images from restricted
    registries, and for pods that suddenly begin running images outside expected
    prefixes.
    Maintain an environment‑specific allowlist via the macro `cisco_isovalent_allowed_images`
    (for example, allow trusted registries/prefixes such as ImageName="gcr.io/org/*",
    "registry.local/*", or "myco/*") and keep it updated as new baseline images are
    introduced. This analytic alerts on images NOT matching the allowlist.
data_source:
    - Cisco Isovalent Process Exec
search: |
    `cisco_isovalent_process_exec` pod_name!=""
    | search NOT `cisco_isovalent_allowed_images`
    | stats count
            min(_time) as firstTime
            max(_time) as lastTime
        by pod_image_name pod_namespace pod_name process_name cluster_name
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_isovalent___non_allowlisted_image_use_filter`
how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior. Create and maintain an environment‑specific macro named`cisco_isovalent_allowed_images` that returns true for approved images, for example:(ImageName="gcr.io/org/app:*" OR ImageName="registry.local/*" OR ImageName="myco/*"). The search alerts on images NOT matching that allowlist. Tune by namespace or team as needed.
known_false_positives: New legitimate images during rollouts or blue/green deployments may appear until the allowlist is updated. Coordinate with platform/DevOps teams to synchronize allowlist changes.
references:
    - https://dev.to/thenjdevopsguy/attacking-a-kubernetes-cluster-enter-red-team-mode-2onj
    - https://www.reddit.com/r/kubernetes/comments/l6e5yr/one_of_our_kubernetes_containers_was_compromised/
intermediate_findings:
    entities:
        - field: pod_name
          type: system
          score: 20
          message: Non Allowlisted image [$pod_image_name$] used by pod [$pod_name$] in the cluster [$cluster_name$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Isovalent Suspicious Activity
asset_type: Kubernetes
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: network

id: '5541.5782'
title: Conhost.exe Kernel call
description: 'conhost. exe ForceV1 asks for information directly from the kernel space,
  conhost connects to the console application. Usecase Identifies potentially suspicious
  Conhost execution paired with additional processes. - Software Association: Trojan.Killdisk/HermeticWiper,
  Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) NOT (TERM(usoclient.exe) OR TERM(devicecensus.exe)
  OR TERM(ProgramData) OR "Program Files" OR "wmiprvse.exe") | regex process="^\S+\s"
  | table _time, host, user, process, process_*, parent_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | regex process="conhost.exe 0xffffffff -ForceV1"|
  where mvcount(process)>1 '
techniques:
- defense-evasion:indirect command execution
- execution:command and scripting interpreter
- defense-evasion:exploitation for defense evasion
technique_id: 
- T1202
- T1059
- T1211
data_category:
- Windows event logs
references:
- https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29

name: Detect RTLO In File Name
id: 468b7e11-d362-43b8-b6ec-7a2d3b246678
version: 13
creation_date: '2023-05-01'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: |
    The following analytic identifies the use of the right-to-left override
    (RTLO) character in file names. It leverages data from the Endpoint.Filesystem datamodel,
    specifically focusing on file creation events and file names containing the RTLO
    character (U+202E). This activity is significant because adversaries use RTLO to
    disguise malicious files as benign by reversing the text that follows the character.
    If confirmed malicious, this technique can deceive users and security tools, leading
    to the execution of harmful files and potential system compromise.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(Filesystem.file_create_time) as file_create_time

    from datamodel=Endpoint.Filesystem where Filesystem.file_name!=unknown

    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
       Filesystem.user Filesystem.vendor_product

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | regex file_name = "\\x{202E}"
    | rex field=file_name "(?<RTLO_file_1>.+)(?<RTLO_exist_file>\\x{202E})(?<RTLO_file_2>.+)"
    | eval file_name_with_RTLO=file_name
    | eval file_name=RTLO_file_1.RTLO_file_2
    | fields - RTLO*
    | `detect_rtlo_in_file_name_filter`
how_to_implement: |
    To successfully implement this search you need to be ingesting information
    on process that includes the full command line of the process being launched on
    your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
    confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
    endpoint product.
known_false_positives: |
    Implementation in regions that use right to left in native language.
references:
    - https://attack.mitre.org/techniques/T1036/002/
    - https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/
    - https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html
finding:
    title: Suspicious RTLO detected in $file_name$ on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious RTLO detected in $file_name$ on endpoint $dest$ by user $user$.
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Spearphishing Attachments
asset_type: Endpoint
mitre_attack_id:
    - T1036.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '33360.59025'
title: Domain Controller Enumeration via nltest
description: Adversaries may attempt to get a listing of other systems by IP address,
  hostname, or other logical identifier on a network that may be used for Lateral
  Movement from the current system. Functionality could exist within remote access
  tools to enable this, but utilities available on the operating system could also
  be used such as Nltest. Adversaries may look for details about the network configuration
  and settings, such as IP and/or MAC addresses, of systems they access or through
  information discovery of remote systems. Several operating system administration
  utilities exist that can be used to gather this information. Examples include Arp,
  ipconfig/ifconfig, nbtstat, and route. This use case detects nltest executions with
  options dclist or dsgetdc.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(nltest) (TERM(dclist) OR TERM(dsgetdc)) |
  table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id: 
- T1016
- T1018
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1016/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md#atomic-test-3---remote-system-discovery---nltest

name: GitHub Enterprise Remove Organization
id: 94cb89aa-aec1-4585-91b1-affcdacf357e
version: 7
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when a user removes an organization from GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for organization deletion events, which could indicate unauthorized removal of critical business resources. For a SOC, identifying organization removals is crucial as it may signal account compromise, insider threats, or malicious attempts to disrupt business operations by deleting entire organizational structures. The impact could be severe, potentially resulting in loss of source code, repositories, team structures, access controls, and other critical organizational assets. This disruption could halt development workflows, cause data loss, and require significant effort to restore from backups if available. Additionally, unauthorized organization removal could be part of a larger attack campaign aimed at destroying or compromising enterprise assets.
data_source:
    - GitHub Enterprise Audit Logs
search: |-
    `github_enterprise` action=business.remove_organization
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_is_bot,
           actor_location.country_code, business, business_id,
           org, org_id, user_agent,
           action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_enterprise_remove_organization_filter`
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
    - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ removed an organization from GitHub Enterprise
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
asset_type: GitHub
mitre_attack_id:
    - T1485
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '12911.18538'
title: IcedID Discovery Commands
description: IcedID may automatically run several initial discovery commands that
  provided environmental information about the host, network, and domain. This use
  case looks for a combination of those commands commonly seen after IcedID is executed.
  - Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("net.exe" OR "net1.exe" OR "ipconfig" OR "ipconfig.exe" OR "nltest" OR "nltest.exe"
  OR "systeminfo" OR "systeminfo.exe") | table _time, host, user process, process_*,
  signature_id, parent_* | bin span=60s | stats values(*) as * by _time, host | where
  match(process_name, "(?i)systeminfo.exe") and match(process_name, "(?i)net1?.exe")
  and match(process_name, "(?i)nltest.exe") and match(process_name, "(?i)ipconfig.exe") '
techniques:
- discovery:permission groups discovery:domain groups
- discovery:network share discovery
- discovery:account discovery
- discovery:system information discovery
- collection:automated collection
technique_id:
- T1069.002
- T1135
- T1087
- T1082
- T1119
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2022/04/25/quantum-ransomware/

name: Kubernetes Anomalous Inbound Network Activity from Process
id: 10442d8b-0701-4c25-911d-d67b906e713c
version: 9
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies anomalous inbound network traffic volumes from processes within containerized workloads. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days. This activity is significant as it may indicate unauthorized data reception, potential breaches, vulnerability exploitation, or malware propagation. If confirmed malicious, it could lead to command and control installation, data integrity damage, container escape, and further environment compromise.
data_source: []
search: "| mstats avg(tcp.*) as tcp.* avg(udp.*) as udp.* where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name dest.workload.name dest.process.name  span=10s | eval key='dest.workload.name' + \":\" + 'dest.process.name' | join type=left key [ mstats avg(tcp.*) as avg_tcp.* avg(udp.*) as avg_udp.* stdev(tcp.*) as stdev_tcp.* avg(udp.*) as stdev_udp.* where `kubernetes_metrics` AND earliest=-30d latest=-1h by dest.workload.name dest.process.name | eval key='dest.workload.name' + \":\" + 'dest.process.name' ] | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 3 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | fillnull | eval anomalies = split(replace(anomalies, \",\\s$$$$\", \"\") ,\", \") | where anomalies!=\"\" | stats count(anomalies) as count values(anomalies) as anomalies by k8s.cluster.name dest.workload.name dest.process.name | where count > 5 | rename k8s.cluster.name as host | `kubernetes_anomalous_inbound_network_activity_from_process_filter`"
how_to_implement: "To gather NPM metrics the Open Telemetry to the Kubernetes Cluster and enable Network Performance Monitoring according to instructions found in Splunk Docs https://help.splunk.com/en/splunk-observability-cloud/monitor-infrastructure/network-explorer/set-up-network-explorer-in-kubernetes#network-explorer-setup In order to access those metrics from within Splunk Enterprise and ES, the Splunk Infrastructure Monitoring add-on must be installed and configured on a Splunk Search Head.  Once installed, first configure the add-on with your O11y Cloud Org ID and Access Token. Lastly set up the add-on to ingest metrics from O11y cloud using the following settings, and any other settings left at default:\n* Name sim_npm_metrics_to_metrics_index\n * Metric Resolution 10000"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes Anomalous Inbound Network Activity from Process in kubernetes cluster $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Auditd Doas Conf File Creation
id: 61059783-574b-40d2-ac2f-69b898afd6b4
version: 11
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    The following analytic detects the creation of the doas.conf file on a Linux host.
    This file is used by the doas utility to allow standard users to perform tasks as root, similar to sudo.
    The detection leverages Linux Auditd data, focusing on the creation of the doas.conf file.
    This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root commands with root privileges, leading to full system compromise.
data_source:
    - Linux Auditd Path
    - Linux Auditd Cwd
search: |
    `linux_auditd`
    (
      (type=PATH nametype="CREATE")
      OR
      type=CWD
    )
    | rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"

    | stats
      values(type) as types
      values(name) as names
      values(nametype) as nametype
      values(cwd) as cwd_list
      values(_time) as event_times
      by audit_id host

    | eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
    | eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
    | eval matched_paths = mvfilter(match(candidate_paths, "/etc/doas.conf.*"))
    | eval match_count = mvcount(matched_paths)
    | eval reconstructed_path = mvindex(matched_paths, 0)
    | eval e_time = mvindex(event_times, 0)
    | where match_count > 0
    | rename host as dest

    | stats count min(e_time) as firstTime max(e_time) as lastTime
      values(nametype) as nametype
      by current_working_directory
         reconstructed_path
         match_count
         dest
         audit_id

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table nametype current_working_directory reconstructed_path dest audit_id match_count firstTime lastTime
    | `linux_auditd_doas_conf_file_creation_filter`
how_to_implement: |
    To implement this detection, the process begins by ingesting auditd
    data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
    executions and process details on Unix/Linux systems. These logs should be ingested
    and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
    which is essential for correctly parsing and categorizing the data. The next step
    involves normalizing the field names  to match the field names set by the Splunk
    Common Information Model (CIM) to ensure consistency across different data sources
    and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
    Administrator or network operator can execute this command.
    Please update the filter macros to remove false positives.
references:
    - https://wiki.gentoo.org/wiki/Doas
    - https://www.makeuseof.com/how-to-install-and-use-doas/
finding:
    title: A $reconstructed_path$ file was created on host - [$dest$]
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Docker Root Directory Mount
id: aa049566-f76a-43b9-908c-3c27e079fd43
version: 4
creation_date: '2026-03-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk, Emil Elsetrønning
status: production
type: TTP
description: |
    This detection identifies Docker containers that mount the host's root directory into the container filesystem.
    Mounting the entire host root directory into a container effectively grants the container visibility and potential write access to all files on the host system.
    If the container is running as root or with elevated capabilities (e.g., --privileged), the risk is significantly increased.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    Processes.process_name=docker*
    Processes.process IN (
      "* -v *",
      "* --volume *"
    )
    Processes.process="* /:/*"
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_docker_root_directory_mount_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://docs.docker.com/engine/storage/volumes/
    - https://gtfobins.github.io/gtfobins/docker/
finding:
    title: An instance of $process_name$ spawned by $user$ on endpoint $dest$, tried to mount the root directory via the command $process$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $process_name$ spawned by $user$ on endpoint $dest$, tried to mount the root directory via the command $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1611
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Okta Multiple Failed MFA Requests For User
id: 826dbaae-a1e6-4c8c-b384-d16898956e73
version: 12
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Okta tenant. It triggers when more than 10 MFA attempts fail within 5 minutes, using Okta event logs to detect this pattern. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests, a technique used by threat actors like Lapsus and APT29. If confirmed malicious, this could lead to unauthorized access, potentially compromising sensitive information and systems.
data_source:
    - Okta
search: |-
    `okta` eventType=user.authentication.auth_via_mfa outcome.result=FAILURE debugContext.debugData.factor!=PASSWORD_AS_FACTOR
      | bucket _time span=5m
      | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) values(src_ip) as src_ip values(debugContext.debugData.factor) values(dest) as dest
        BY _time src_user
      | where count >= 10
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `okta_multiple_failed_mfa_requests_for_user_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed and monitor for any unusual activity.
references:
    - https://attack.mitre.org/techniques/T1621/
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 20
          message: Multiple failed MFA requests for user $src_user$ from IP Address - $src_ip$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Okta Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Okta Tenant
mitre_attack_id:
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Ollama Abnormal Network Connectivity
id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb
version: 5
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity.
data_source:
    - Ollama Server
search: |-
    `ollama_server` level=WARN (msg="*failed*" OR msg="*dial tcp*" OR msg="*lookup*" OR msg="*no such host*" OR msg="*connection*" OR msg="*network*" OR msg="*timeout*" OR msg="*unreachable*" OR msg="*refused*")
      | eval src=coalesce(src, src_ip, "N/A")
      | stats count as incidents, values(src) as src, values(msg) as warning_messages, latest(_time) as last_incident
        BY host
      | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S")
      | eval severity="medium"
      | eval attack_type="Abnormal Network Connectivity"
      | stats count
        BY last_incident, host, incidents,
           src, warning_messages, severity,
           attack_type
      | `ollama_abnormal_network_connectivity_filter`
how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
known_false_positives: Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations.
references:
    - https://github.com/rosplk/ta-ollama
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: 'Abnormal network activity detected on $host$ with $incidents$ incidents from $src$. Investigation needed for network errors: $warning_messages$.'
threat_objects:
    - field: src
      type: system
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1571
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '5343.5759'
title: 'Remote Admin Tools  '
description: 'PsExec, RemCom, PaExec, and CsExec are administrative command-line utilities
  that allow remote command execution Threat Actor Association: Antlion, DarkSide,
  BlackMatter, APT29/Nobelium, APT31, Carbanak, FIN6, FIN7, FIN8, FIN12, Fox Kitten,
  GoldenJackal, Hello Kitty / Five Hands, MalKamak, Muddled Libra, OilRig, Traveling
  Spider, UNC2596, Vice Society, Wizard Spider - Software Association: ALPHV/BlackCat,
  AvosLocker, BianLian, Blackbyte, Blacksuit, Black Basta, Conti, Cuba, GhostShell,
  Lockbit, Play, Prometheus/Spook, Prestige, PYSA/Mespinoza, Quantum, Rhysida, Royal,
  Vice Society - Atomics T1021.002 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` "\\\\" ("EventCode=4104"
  OR "<EventID>4104<")| regex process="(?i)((\.exe(\")?(\s+|\s+\/c)\s+)|(psexec.{1,}))|(\"{1,})?\x5c\x5c.{2,}"|
  table _time, host, user process, parent_process, parent_process_id, parent_process_name,
  process_id, process_name, signature_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:system services:service execution
- lateral-movement:remote services
- execution:command and scripting interpreter:windows command shell
- lateral-movement:lateral tool transfer
technique_id:
- T1569.002
- T1021
- T1059.003
- T1570
data_category:
- PowerShell logs
references:
- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/

id: '25326.46988'
title: Scheduled Task with Potential SSH Tunnel - Windows
description: Threat actors have been observed using scheduled tasks to create reverse
  SSH tunnels to facilitate persistence on a compromised machine as reported by DFIR.
  This use case detects scheduled tasks created with commands indicating potential
  SSH tunnels. The regex filtering matches on the patterns <user>@<IP address> and
  <port number>:<IP Address> :<port number>. Living Off the Land Binary and Scripts
  (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4698) OR
  "<EventID>4698<") OR (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)
  "@" "/create" ("-L" OR "-R" OR "-N" OR "-D" OR "-C" OR "IdentitiesOnly=yes" OR "StrictHostKeyChecking=no"
  OR "ssh") | where ((match(TaskContent, "\w+@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
  and match(TaskContent, "\d{1,5}:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,5}") and
  match(TaskContent, "-L|-R|-N|-D|-C|IdentitiesOnly=yes|StrictHostKeyChecking=no|ssh"))
  OR (match(process, "\w+@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") and match(process,
  "\d{1,5}:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,5}") and match(process, "(?i)\-(L|R|N|D|C)|IdentitiesOnly=yes|StrictHostKeyChecking=no|ssh")))
  | table _time, host, user, process, process_*, parent_process_name, parent_process_*,
  signature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:scheduled task/job
- command-and-control:protocol tunneling
technique_id: 
- T1053
- T1572
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

id: '6148.6668'
title: Shadow Copy Created
description: 'Shadow Copy (also known as Volume Snapshot Service, Volume Shadow Copy
  Service or VSS) is a technology included in Microsoft Windows that can create backup
  copies or snapshots of computer files or volumes, even when they are in use. Adversaries
  have used this service to create copies of locked files such as ntds.dit. -- Threat
  Actor Association: Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon -- Software Association: PYSA/Mespinoza
  -- Atomics T1003.003Test #1 Atomics T1003.003 Test #3 Atomics T1003.003 Test #4
  Atomics T1003.003 Test #5 Atomics T1003.003 Test #6 Atomics T1003.003 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=8222) OR
  "<EventID>8222<") "Shadow copy has been created" | rex field=_raw (?<ioc>"(?i)Shadow
  copy has been created")| eval user=User_name, process_name=Process_image_name |
  table _time, host, user, signature_id, signature, process, process_*, parent_*,
  ioc | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Windows event logs
references:
- https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/

id: '25328.46989'
title: ssh.exe Execution
description: 'ssh.exe is a legitimate SSH client included in Windows systems,providing
  secure shell access to remote servers. Due to its availability and capabilities,
  it can be exploited by attackers for covert communication, remote command execution,
  or tunneling, making it a potential tool for living-off-the-land attacks. This use
  case detects executions of ssh.exe. -- Threat Actor Association: APT28 (aka.Fancy
  Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM) -- Living Off
  the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(ssh) OR "ssh.exe" | where match(process_name,
  "(?i)^ssh\.exe")| table _time, host, user, process, process_*, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indirect command execution
- command-and-control:protocol tunneling
technique_id: 
- T1202
- T1572
data_category:
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ssh/

id: '14942.22051'
title: Stored Credentials from Web Browsers - Windows
description: 'Adversaries may acquire credentials from web browsers by reading files
  specific to the target browser. Web browsers commonly save credentials such as website
  usernames and passwords so that they do not need to be entered manually in the future.
  Web browsers typically store the credentials in an encrypted format within a credential
  store; however, methods exist to extract plaintext credentials from web browsers.
  After acquiring credentials from web browsers, adversaries may attempt to recycle
  the credentials across different systems and/or accounts in order to expand access.
  This can result in significantly furthering an adversary''s objective in cases where
  credentials gained from web browsers overlap with privileged accounts (e.g. domain
  administrator). This use case detects attempts to enumerate or access files containing
  stored credentials from web browsers on Windows endpoints. -- Threat Actor Association:
  Earth Estries, Scattered Spider (aka. Muddled Libra, Scatter Swine, Starfraud, UNC3944)
  -- Atomic T1555.003 Test #4 Atomic T1555.003 Test #5 Atomic T1555.003 Test #6 Atomic
  T1555.003 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(Copy-Item) OR
  TERM(copy) OR TERM(xcopy) OR TERM(cp) OR TERM(cpi) OR TERM(robocopy)) AND ("Chrome"
  OR "Opera" OR "Firefox" OR "Edge") | regex process="(?i)(Copy\-Item|copy|xcopy|[^\-]cp|[^\-]cpi|robocopy)\s+.+?((\x5cGoogle\x5cChrome\x5cUser\sData\x5cDefault\x5cLogin\s)|(\x5cOpera.+Login\s)|(\x5cFirefox\x5cProfiles)|(\x5cEdge\x5cUser\sData\x5c))"
  | table _time, host, user signature_id, process, process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- credential-access:credentials from password stores:credentials from web browsers
technique_id:
- T1555.003
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md

name: Unknown Process Using The Kerberos Protocol
id: c91a0852-9fbb-11ec-af44-acde48001122
version: 12
creation_date: '2022-03-10'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies a non-lsass.exe process making an outbound connection on port 88, which is typically used by the Kerberos authentication protocol. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs. This activity is significant because, under normal circumstances, only the lsass.exe process should interact with the Kerberos Distribution Center. If confirmed malicious, this behavior could indicate an adversary attempting to abuse the Kerberos protocol, potentially leading to unauthorized access or lateral movement within the network.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name!=lsass.exe
      BY _time Processes.action Processes.dest
         Processes.original_file_name Processes.parent_process Processes.parent_process_exec
         Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
         Processes.parent_process_path Processes.process Processes.process_exec
         Processes.process_guid Processes.process_hash Processes.process_id
         Processes.process_integrity_level Processes.process_name Processes.process_path
         Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | join  process_id dest [
    | tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic
      WHERE All_Traffic.dest_port = 88
      BY All_Traffic.action All_Traffic.app All_Traffic.bytes
         All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest
         All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc
         All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
         All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport
         All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
         All_Traffic.process_id
    | `drop_dm_object_name(All_Traffic)`
    | rename src as dest ]
    | table _time dest parent_process_name process_name process_path process process_id dest_port
    | `unknown_process_using_the_kerberos_protocol_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Custom applications may leverage the Kerberos protocol. Filter as needed.
references:
    - https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
    - https://www.thehacker.recipes/ad/movement/kerberos/ptk
finding:
    title: Unknown process $process_name$ using the kerberos protocol detected on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Kerberos Attacks
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1550
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Administrative Shares Accessed On Multiple Hosts
id: d92f2d95-05fb-48a7-910f-4d3d61ab8655
version: 10
creation_date: '2023-03-23'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects a source computer accessing Windows administrative shares (C$, Admin$, IPC$) on 30 or more remote endpoints within a 5-minute window. It leverages Event IDs 5140 and 5145 from file share events. This behavior is significant as it may indicate an adversary enumerating network shares to locate sensitive files, a common tactic used by threat actors. If confirmed malicious, this activity could lead to unauthorized access to critical data, lateral movement, and potential compromise of multiple systems within the network.
data_source:
    - Windows Event Log Security 5140
    - Windows Event Log Security 5145
search: '`wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName) as shares values(dest) as dest by _time, IpAddress, SubjectUserName, EventCode | where unique_targets > 30 | `windows_administrative_shares_accessed_on_multiple_hosts_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting file share events. The Advanced Security Audit policy setting `Audit Detailed File Share` or `Audit File Share` within `Object Access` need to be enabled.
known_false_positives: An single endpoint accessing windows administrative shares across a large number of endpoints is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
references:
    - https://attack.mitre.org/techniques/T1135/
    - https://en.wikipedia.org/wiki/Administrative_share
    - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
finding:
    title: $IpAddress$ accessed the IPC share on more than 30 endpoints in a timespan of 5 minutes.
    entity:
        field: host_targets
        type: system
        score: 50
threat_objects:
    - field: IpAddress
      type: ip_address
analytic_story:
    - Active Directory Privilege Escalation
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1135
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows EventLog Recon Activity Using Log Query Utilities
id: dc167f8b-3f9d-4460-9c98-8b6e703fd628
version: 7
creation_date: '2025-04-24'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects EventLog reconnaissance activity using utilities such as `wevtutil.exe`, `wmic.exe`, PowerShell cmdlets like `Get-WinEvent`, or WMI queries targeting `Win32_NTLogEvent`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. These tools are often used by adversaries to extract usernames, IP addresses, session data, and event information for credential access or situational awareness during lateral movement. While these utilities are legitimate, execution with specific arguments or targeting sensitive logs like `Security`, `PowerShell`, or specific EventIDs (e.g., 4624, 4778) can indicate malicious intent. If confirmed malicious, this behavior could allow an attacker to extract sensitive info and potentially have leveraged access or move laterally.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` values(Processes.process) as process
      min(_time) as firstTime max(_time) as lastTime
      from datamodel=Endpoint.Processes
      where (
        (
          (
            Processes.process_name IN ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
            OR
            Processes.original_file_name IN ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
          )
          Processes.process IN ("*Get-WinEvent*", "*Get-EventLog*", "*EventLogQuery*", "*.ReadEvent(*")
        )
        OR
        (
          (
            Processes.process_name = wevtutil.exe
            OR
            Processes.original_file_name = wevtutil.exe
          )
          Processes.process IN ("* qe *", "* query-events *")
        )
        OR
        (
          (
            Processes.process_name = wmic.exe
            OR
            Processes.original_file_name = wmic.exe
          )
          Processes.process IN ("*ntevent*")
        )
        OR
        (
          Processes.process="*Win32_NTLogEvent*"
          Processes.process="*EventCode*"
        )
        OR
        (
          Processes.process IN ("*PsLogList*", "*Eventquery*")
        )
      )
      by
        Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
        Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
        Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
        Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
        Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_eventlog_recon_activity_using_log_query_utilities_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    System administrators or monitoring tools may legitimately use these utilities to gather logs for troubleshooting or auditing. Filter known admin behavior or monitoring solutions as needed.
references:
    - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
    - https://www.group-ib.com/blog/apt41-world-tour-2021/
    - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious log query $process$ command was run on $dest$ by $user$
        - field: user
          type: user
          score: 20
          message: Suspicious log query $process$ command was run on $dest$ by $user$
analytic_story:
    - Windows Discovery Techniques
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1654
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint