Splunk rules: 1i

id: '1074.1119'
title: Abuse EQNEDT32.EXE
description: 'Detects potential malicious Microsoft Office payload (CVE-2017-11882
  or CVE-2018-0798) on host. Equation Editor. -- Threat Actor Association: Bitter
  APT, Lotus Blossom, SideWinder, TA428, Tonto Team - Software Association: Soul'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` "EQNEDT32.EXE" | table _time,
  host, user _time, host, session_id, process, signature_id, parent_process_name,
  process_name, user| bin span=300s | stats values(*) as * by _time, host |where match(parent_process_name,
  "(?i)EQNEDT32.EXE") | table _time, host, user session_id, process, signature_id,
  parent_process_name `hec_collect`'
techniques:
- execution:exploitation for client execution
technique_id: 
- T1203
data_category:
- Windows Sysmon
references:
- https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html

name: Cisco Duo Policy Allow Network Bypass 2FA
id: 2593f641-6192-4f3d-b96c-2bd1c706215f
version: 6
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: |
    The following analytic detects when a Duo policy is created or updated to allow network-based bypass of two-factor authentication (2FA).
    It identifies this behavior by searching Duo administrator logs for policy creation or update actions where the networks_allow field is present,
    indicating that specific networks have been permitted to bypass 2FA requirements. This is achieved by parsing the event description and
    filtering for relevant policy changes, then aggregating the results by user and administrator details. Detecting this behavior is critical
    for a Security Operations Center (SOC) because allowing network-based 2FA bypass can significantly weaken authentication controls, potentially
    enabling unauthorized access if a trusted network is compromised or misconfigured. Attackers or malicious insiders may exploit this policy
    change to circumvent 2FA protections, increasing the risk of account takeover and lateral movement within the environment. Prompt detection
    enables SOC analysts to investigate and respond to potentially risky policy modifications before they can be leveraged for malicious purposes.
data_source:
    - Cisco Duo Administrator
search: |-
    `cisco_duo_administrator` action=policy_update OR action=policy_create
      | spath input=description
      | search networks_allow=*
      | rename object as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action actionlabel description
           user admin_email networks_allow
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `cisco_duo_policy_allow_network_bypass_2fa_filter`
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A policy has been created or updated to allow network bypass 2FA by user $user$ with email $admin_email$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

id: '31349.56235'
title: Command Line Utility Added to Accessibility Features
description: 'Adversaries may establish persistence and/or elevate privileges by executing
  malicious content triggered by accessibility features. Windows contains accessibility
  features that may be launched with a key combination before a user has logged in
  (ex: when the user is on the Windows logon screen). An adversary can modify the
  way these programs are launched to get a command prompt or backdoor without logging
  in to the system. This use case detects registry modification commands or events
  adding cmd.exe or PowerShell/pwsh.exe to Accessibility Features registry keys.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<") "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution"
  "Debugger" ("sethc.exe" OR "utilman.exe" OR "osk.exe" OR "Magnify.exe" OR "Narrator.exe"
  OR "DisplaySwitch.exe" OR "atbroker.exe" OR "HelpPane.exe") ("cmd.exe" OR "powershell.exe"
  OR "pwsh.exe") | regex process="(?i)Debugger.+\x5c(cmd|pwsh|powershell)\.exe" |
  table _time, host, user, process, signature_id | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- execution:command and scripting interpreter
- persistence:event triggered execution:accessibility features
technique_id:
- T1059
- T1546.008
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1546/008/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.008/T1546.008.md#atomic-test-1---attaches-command-prompt-as-a-debugger-to-a-list-of-target-processes
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base

name: Detect Excessive Account Lockouts From Endpoint
id: c026e3dd-7e18-4abb-8f41-929e836efe74
version: 17
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: Anomaly
description: The following analytic detects endpoints causing a high number of account lockouts within a short period. It leverages the Windows security event logs ingested into the `Change` datamodel, specifically under the `Account_Management` node, to identify and count lockout events. This activity is significant as it may indicate a brute-force attack or misconfigured system causing repeated authentication failures. If confirmed malicious, this behavior could lead to account lockouts, disrupting user access and potentially indicating an ongoing attack attempting to compromise user credentials.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user FROM datamodel=Change.All_Changes
      WHERE All_Changes.result="*lock*"
      BY All_Changes.dest All_Changes.result
    | `drop_dm_object_name("All_Changes")`
    | `drop_dm_object_name("Account_Management")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | search count > 5
    | `detect_excessive_account_lockouts_from_endpoint_filter`
how_to_implement: You must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.\n**Splunk>Phantom Playbook Integration** If Splunk>Phantom is also configured in your environment, a Playbook called \"Excessive Account Lockouts Enrichment and Response\" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active.\nPlaybook Link:`https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/`)
known_false_positives: It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Multiple accounts have been locked out. Review $dest$ and results related to $user$.
        - field: dest
          type: system
          score: 20
          message: Multiple accounts have been locked out. Review $dest$ and results related to $user$.
analytic_story:
    - Active Directory Password Spraying
asset_type: Windows
mitre_attack_id:
    - T1078.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: access

name: Detect Remote Access Software Usage Registry
id: 33804986-25dd-43cf-bb6b-dc14956c7cbc
version: 13
creation_date: '2024-12-28'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?<file_name_1>[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?<file_name_2>[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A process for a known remote access software [$signature$] was detected on $dest$
        - field: user
          type: user
          score: 20
          message: A process for a known remote access software [$signature$] was detected on $dest$
threat_objects:
    - field: registry_path
      type: registry_path
    - field: signature
      type: signature
analytic_story:
    - Insider Threat
    - Command And Control
    - Ransomware
    - Gozi Malware
    - CISA AA24-241A
    - Remote Monitoring and Management Software
    - Seashell Blizzard
    - Cactus Ransomware
    - Scattered Spider
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Windows DNS SIGRed via Zeek
id: c5c622e4-d073-11ea-87d0-0242ac130003
version: 11
creation_date: '2020-08-04'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic detects the presence of SIGRed, a critical DNS vulnerability, using Zeek DNS and Zeek Conn data. It identifies specific DNS query types (SIG and KEY) and checks for high data transfer within a flow. This detection is significant because SIGRed allows attackers to execute remote code on Windows DNS servers, potentially leading to unauthorized access and control. If confirmed malicious, this activity could result in data exfiltration, service disruption, or further network compromise. Immediate investigation and mitigation, such as patching or isolating the affected server, are crucial.
data_source: []
search: |
    | tstats `security_content_summariesonly` count from datamodel=Network_Resolution where
      DNS.query_type IN (SIG,KEY) by DNS.flow_id
    | rename DNS.flow_id as flow_id
    | append [
      | tstats  `security_content_summariesonly` count
      from datamodel=Network_Traffic where
      All_Traffic.bytes_in>65000
      by All_Traffic.flow_id
      | rename All_Traffic.flow_id as flow_id
    ]
    | stats count by flow_id
    | where count>1
    | fields - count'
    | `detect_windows_dns_sigred_via_zeek_filter`
how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format.  We are detecting SIG and KEY records via bro:dns:json and TCP payload over 65KB in size via bro:conn:json.  The Network Resolution and Network Traffic datamodels are in use for this search.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: Potential SIGRed activity detected [ $flow_id$ ]
    entity:
        field: flow_id
        type: other
        score: 50
analytic_story:
    - Windows DNS SIGRed CVE-2020-1350
asset_type: Endpoint
cve:
    - CVE-2020-1350
mitre_attack_id:
    - T1203
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Disabling FolderOptions Windows Feature
id: 83776de4-921a-11eb-868a-acde48001122
version: 16
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the Windows registry to disable the Folder Options feature, which prevents users from showing hidden files and file extensions. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" with a value of "0x00000001". This activity is significant as it is commonly used by malware to conceal malicious files and deceive users with fake file extensions. If confirmed malicious, this could allow an attacker to hide their presence and malicious files, making detection and remediation more difficult.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
    - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
finding:
    title: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - CISA AA23-347A
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27341.49803'
title: DLL Execution from Uncommon Process
description: During an attack using Ursnif malware, threat actors were observed executing
  DLLs with a renamed rundll32 binary. This use case detects execution of the DLL
  functions DllRegisterServer, DllMain, DllUnregisterServer, DllInstall, or DllCanUnloadNow
  from processes other than rundll32.exe. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ",DllRegisterServer" OR ",DllMain" OR ",DllUnregisterServer" OR ",DllInstall" OR
  ",DllCanUnloadNow" | rex field=process ",(?<dll_function>\S+)"| where not match(process_name,
  "(?i)rundll32\.exe") | table _time, host, user, process, process_*, parent_process*,
  dll_function | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/

name: Get-ForestTrust with PowerShell Script Block
id: 70fac80e-0bf1-11ec-9ba0-acde48001122
version: 12
creation_date: '2021-09-02'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, providing detailed visibility into potentially suspicious activities. Monitoring this behavior is crucial as it can indicate an attempt to gather domain trust information, which is often a precursor to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to map trust relationships within the domain, facilitating further exploitation and access to sensitive resources.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `get_foresttrust_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives may be present. Tune as needed.
references:
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
finding:
    title: Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user_id$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user_id$.
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1482
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GitHub Enterprise Disable Audit Log Event Stream
id: 7bc111cc-7f1b-4be7-99fa-50cf8d2e7564
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when a user disables audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that disable the audit log streaming functionality, which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent their malicious activities from being logged and detected by disabling the audit trail. For a SOC, identifying the disabling of audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected. The impact could be severe as organizations lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection. This creates a significant blind spot in security monitoring and incident response capabilities.
data_source:
    - GitHub Enterprise Audit Logs
search: |-
    `github_enterprise` action=audit_log_streaming.destroy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_ip,
           actor_is_bot, actor_location.country_code, business,
           business_id, user_agent, action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_enterprise_disable_audit_log_event_stream_filter`
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
    - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Audit log event streaming is disabled by $user$
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1685.002
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Auditd File Permissions Modification Via Chattr
id: f2d1110d-b01c-4a58-9975-90a9edeb083a
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` proctitle = "*chattr *" AND proctitle = "* -i*"
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_file_permissions_modification_via_chattr_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to modify file permissions using the "chattr" command.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1222.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS Network Share Discovery
id: a5f5fe52-8e50-4fb0-ad1b-780be6c0d857
version: 3
creation_date: '2026-04-14'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process IN ("*showmount *", "*smbutil *")

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_network_share_discovery_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Administrators may utilize these tools occasionaly for troubleshooting.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://leopard-adc.pepas.com/documentation/Darwin/Reference/ManPages/man8/showmount.8.html
    - https://www.unix.com/man_page/osx/1/smbutil/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Network share information enumerated on $dest$ by $user$ via $process$
        - field: dest
          type: system
          score: 20
          message: Network share information enumerated on $dest$ by $user$ via $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1135
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 Admin Consent Bypassed by Service Principal
id: 8a1b22eb-50ce-4e26-a691-97ff52349569
version: 9
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where a service principal in Office 365 Azure Active Directory assigns app roles without standard admin consent. It leverages `o365_management_activity` logs, specifically focusing on the 'Add app role assignment to service principal' operation. This activity is significant for SOCs as it may indicate a bypass of critical administrative controls, potentially leading to unauthorized access or privilege escalation. If confirmed malicious, this could allow an attacker to misuse automated processes to assign sensitive permissions, compromising the security of the environment.
data_source:
    - O365 Add app role assignment to service principal.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add app role assignment to service principal.\" | eval len=mvcount('Actor{}.ID') | eval userType = mvindex('Actor{}.ID',len-1) | eval roleId = mvindex('ModifiedProperties{}.NewValue', 0) | eval roleValue = mvindex('ModifiedProperties{}.NewValue', 1) | eval roleDescription = mvindex('ModifiedProperties{}.NewValue', 2) | eval dest_user = mvindex('Target{}.ID', 0) | search userType = \"ServicePrincipal\" | eval src_user = user | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product dest_user roleId roleValue roleDescription | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_admin_consent_bypassed_by_service_principal_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Service Principals are sometimes configured to legitimately bypass the consent process for purposes of automation. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/003/
    - https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
    - https://attack.mitre.org/techniques/T1098/002/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
    - https://winsmarts.com/how-to-grant-admin-consent-to-an-api-programmatically-e32f4a100e9d
finding:
    title: Service principal $user$ bypassed the admin consent process and granted permissions to $dest_user$
    entity:
        field: dest_user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: O365 Application Available To Other Tenants
id: 942548a3-0273-47a4-8dbd-e5202437395c
version: 10
creation_date: '2024-04-13'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies the configuration of Azure Active Directory Applications in a manner that allows authentication from external tenants or personal accounts. This configuration can lead to inappropriate or malicious access of any data or capabilities the application is allowed to access. This detection leverages the O365 Universal Audit Log data source.
data_source:
    - Office 365 Universal Audit Log
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add application.\",\"Update application.\") ModifiedProperties{}.Name=AvailableToOtherTenants | eval result = case(match(mvindex('ModifiedProperties{}.NewValue',mvfind('ModifiedProperties{}.Name',\"AvailableToOtherTenants\")),\"false\"),\"removed\",true(),\"added\"), object_name=mvindex('Target{}.ID', 3), signature=Operation, object_attrs = \"AvailableToOtherTenants\", user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | search result = \"added\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product object_attrs object_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_application_available_to_other_tenants_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Business approved changes by known administrators.
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://msrc.microsoft.com/blog/2023/03/guidance-on-potential-misconfiguration-of-authorization-of-multi-tenant-applications-that-use-azure-ad/
    - https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration
finding:
    title: An Azure Application [$object_name$] was configured by [$user$] as accessible to external tenants.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: object_name
      type: service
analytic_story:
    - Azure Active Directory Persistence
    - Azure Active Directory Account Takeover
    - Data Exfiltration
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 User Consent Blocked for Risky Application
id: 242e4d30-cb59-4051-b0cf-58895e218f40
version: 9
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where Office 365 has blocked a user's attempt to grant consent to an application deemed risky or potentially malicious. This detection leverages O365 audit logs, specifically focusing on failed user consent actions due to system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that O365's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation.
data_source:
    - O365 Consent to application.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Failure | eval permissions =mvindex('ModifiedProperties{}.NewValue', 4) | eval reason =mvindex('ModifiedProperties{}.NewValue', 5) | search reason = \"Risky application detected\" | rex field=permissions \"Scope: (?<Scope>[^,]+)\" | fillnull | stats max(_time) as lastTime by user, reason, object, Scope, dest, src, vendor_account, vendor_product, signature | `security_content_ctime(lastTime)` | `o365_user_consent_blocked_for_risky_application_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Microsofts algorithm to identify risky applications is unknown and may flag legitimate applications.
references:
    - https://attack.mitre.org/techniques/T1528/
    - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
    - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
    - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
    - https://www.alteredsecurity.com/post/introduction-to-365-stealer
    - https://github.com/AlteredSecurity/365-Stealer
finding:
    title: O365 has blocked $user$ attempt to grant to consent to an application deemed risky.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1528
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '15846.23648'
title: PowerShell Downgrade
description: 'Adversaries may downgrade or use a version of system features that may
  be outdated, vulnerable, and/or does not support updated security controls such
  as logging. For example, PowerShell versions 5+ includes Script Block Logging (SBL)
  which can record executed script content. However, adversaries may attempt to execute
  a previous version of PowerShell that does not support SBL with the intent to impair
  defenses while running malicious scripts that may have otherwise been detected.
  This use case detects attempts to execute PowerShell commands using a version earlier
  than 7. -- Threat Actor Association: Earth Estries -- Atomics T1059.001 Test #12'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(-version) | regex
  process="(?i)powershell\.exe\s+-version\s+[123456]" | table _time, host, user process,
  process_*, signature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1059.003
data_category:
- PowerShell logs
references:
- https://kurtroggen.wordpress.com/2017/05/17/powershell-security-powershell-downgrade-attacks/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-12---powershell-downgrade-attack

name: PowerShell PInvoke Process Injection API Chain
id: 3f1a2b4c-d5e6-7890-abcd-ef1234567890
version: 3
creation_date: '2026-04-29'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: |
    The following analytic detects PowerShell Script Block Logging (Event ID 4104) evidence of a complete P/Invoke process-injection API chain at either the compile phase or the execution phase.
    Portions of this search were modified to retain the same functionality while preventing antivirus products from alerting on the detection itself
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText="*add-type*"
    ScriptBlockText="*DllImport*"
    ScriptBlockText IN (
        "*extern IntPtr*",
        "*extern bool*",
        "*extern uint*",
        "*extern int*"
    )
    | where
        (
            match(ScriptBlockText, "(?i)[v][i][r][t][u][a][l][a][l][l][o][c]")
            AND match(ScriptBlockText, "(?i)[v][i][r][t][u][a][l][p][r][o][t][e][c][t]")
            AND match(ScriptBlockText, "(?i)[c][r][e][a][t][e][t][h][r][e][a][d]")
        )
        OR
        (
            match(ScriptBlockText, "(?i)[o][p][e][n][p][r][o][c][e][s][s]")
            AND match(ScriptBlockText, "(?i)[v][i][r][t][u][a][l][a][l][l][o][c]")
            AND match(ScriptBlockText, "(?i)[w][r][i][t][e][p][r][o][c][e][s][s][m][e][m][o][r][y]")
            AND (
                match(ScriptBlockText, "(?i)[c][r][e][a][t][e][r][e][m][o][t][e][t][h][r][e][a][d]")
                OR
                match(ScriptBlockText, "(?i)[q][u][e][u][e][u][s][e][r][a][p][c]")
            )
        )
        OR
        (
            match(ScriptBlockText, "(?i)[o][p][e][n][t][h][r][e][a][d]")
            AND match(ScriptBlockText, "(?i)[s][u][s][p][e][n][d][t][h][r][e][a][d]")
            AND match(ScriptBlockText, "(?i)[g][e][t][t][h][r][e][a][d][c][o][n][t][e][x][t]")
            AND match(ScriptBlockText, "(?i)[w][r][i][t][e][p][r][o][c][e][s][s][m][e][m][o][r][y]")
            AND match(ScriptBlockText, "(?i)[s][e][t][t][h][r][e][a][d][c][o][n][t][e][x][t]")
            AND match(ScriptBlockText, "(?i)[r][e][s][u][m][e][t][h][r][e][a][d]")
        )
        OR
        (
            match(ScriptBlockText, "(?i)[c][r][e][a][t][e][p][r][o][c][e][s][s]")
            AND match(ScriptBlockText, "(?i)[v][i][r][t][u][a][l][a][l][l][o][c]")
            AND match(ScriptBlockText, "(?i)[w][r][i][t][e][p][r][o][c][e][s][s][m][e][m][o][r][y]")
            AND match(ScriptBlockText, "(?i)[s][e][t][t][h][r][e][a][d][c][o][n][t][e][x][t]")
            AND ScriptBlockText = "*ResumeThread*"
        )
        OR
        (
            match(ScriptBlockText, "(?i)[n][t][c][r][e][a][t][e][s][e][c][t][i][o][n]")
            AND match(ScriptBlockText, "(?i)[n][t][m][a][p][v][i][e][w][o][f][s][e][c][t][i][o][n]")
            AND match(ScriptBlockText, "(?i)[c][r][e][a][t][e][r][e][m][o][t][e][t][h][r][e][a][d]")
        )
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
       by dest signature signature_id user_id vendor_product EventID
          Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_pinvoke_process_injection_api_chain_filter`
how_to_implement: |-
    The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: |-
    No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.dllimportattribute
    - https://www.ired.team/offensive-security/code-injection-process-injection
    - https://www.broadcom.com/support/security-center/protection-bulletin/vip-keylogger-spreads-via-multi-org-impersonation-campaign
    - https://attack.mitre.org/techniques/T1055/
    - https://attack.mitre.org/techniques/T1620/
finding:
    title: A PowerShell script Script block ID [$ScriptBlockId$] contains a possible P-Invoke process injection API chain via either inline Add-Type class declaration or direct static method invocation on [$dest$]
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A PowerShell script Script block ID [$ScriptBlockId$] contains a possible P-Invoke process injection API chain via either inline Add-Type class declaration or direct static method invocation on [$dest$]
analytic_story:
    - VIP Keylogger
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1055.001
    - T1055.003
    - T1055.004
    - T1055.012
    - T1055.013
    - T1059.001
    - T1620
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31190.55836'
title: PromptOnSecureDesktop Registry Value Modified
description: 'Adversaries may bypass UAC mechanisms to elevate process privileges
  on system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. The impact to the
  user ranges from denying the operation under high enforcement to allowing the user
  to perform the action if they are in the local administrators group and click through
  the prompt or allowing them to enter an administrator password to complete the action.
  This use case detects registry modification events or process executions with registry
  modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop.
  -- Software Association: 8Base'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR
  "<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)
  "ADD" OR "Set-ItemProperty" OR "sp ")) "PromptOnSecureDesktop" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  | table _time, host, user, process, parent_process_name, signature_id, process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Process command-line parameters
- Windows event logs
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1548/002/
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md

id: '18093.30601'
title: Remote .msi Installation
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). The Msiexec.exe binary may
  also be digitally signed by Microsoft. This use case detects attempts to install
  .msi from remote locations. -- Threat Actor Association: APT-K-47/Mysterious Elephant
  -- Atomics T1218.007 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(/i) OR TERM(install))
  ".msi" | where match(process, "(?i)\w+tps?://\S+\.msi") | table _time, host, user
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md#atomic-test-11---msiexecexe---execute-remote-msi-file

id: '5526.5751'
title: Utility Archive Data
description: 'An adversary may compress or encrypt data that is collected prior to
  exfiltration using 3rd party utilities. Many utilities exist that can archive data,
  including 7-Zip, WinRAR, and WinZip. Most utilities include functionality to encrypt
  and/or compress data. -- Threat Actor Association: APT10/Cicada, APT27/Emissary
  Panda, APT29/Nobelium/Cozy Bear, APT31, DarkSide, BlackMatter, FIN6, FIN7, Harvester,
  Karakurt, Lancyfly, Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), RedEyes, UNC5221, UTA0178. Volt Typhoon - Software Association:
  Akira, AvosLocker, Clop, Conti, GhostShell, Hafnium, LockBit, Play, Quantum, Ransom
  Cartel -- #TrendingThreat #Russia #Ukraine -- Atomics T1560.001 Test#1 Atomics T1560.001
  Test#2 Atomics T1560.001 Test#3 Atomics T1560.001 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("WinRAR.exe" OR "WinRAR" OR "rar.exe" OR "7zG.exe"
  OR "peazip.exe" OR "powerarc.exe" OR "Bandizip.exe" OR "Zipware.exe" OR "7z*.exe"
  OR "winzip*.exe") | regex process_name="(?i)(winrar|rar|7z*|peazip|powerarc|bandizip|zipware|winzip*)\.exe"
  | table _time, host, user signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:archive collected data:archive via utility
technique_id:
- T1560.001
data_category:
- Windows event logs
references:
- https://askleo.com/why-spammers-love-zip-files-and-how-you-need-to-stay-safe/

name: Windows ESX Admins Group Creation Security Event
id: 53b4c927-5ec4-47cd-8aed-d4b303304f87
version: 9
creation_date: '2024-07-30'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic detects creation, deletion, or modification of the "ESX Admins" group in Active Directory. These events may indicate attempts to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085).
data_source:
    - Windows Event Log Security 4727
    - Windows Event Log Security 4730
    - Windows Event Log Security 4737
search: |-
    `wineventlog_security` EventCode IN (4727, 4730, 4737) (TargetUserName="ESX Admins" OR TargetUserName="*ESX Admins*")
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY EventCode TargetUserName TargetDomainName
           SubjectUserName SubjectDomainName Computer
      | rename Computer as dest
      | eval EventCodeDescription=case( EventCode=4727, "Security Enabled Global Group Created", EventCode=4730, "Security Enabled Global Group Deleted", EventCode=4737, "Security Enabled Global Group Modified" )
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_esx_admins_group_creation_security_event_filter`
how_to_implement: To successfully implement this search, ensure that Windows Security Event logging is enabled and being ingested into Splunk, particularly for event codes 4727, 4730, and 4737. Configure Group Policy settings to audit these specific events.
known_false_positives: Legitimate administrators might create, delete, or modify an "ESX Admins" group for valid reasons. Verify that the group changes are authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities.
references:
    - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505
    - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
    - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/
finding:
    title: ESX Admins group $EventCodeDescription$ on $dest$ by user $SubjectUserName$.
    entity:
        field: SubjectUserName
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: ESX Admins group $EventCodeDescription$ on $dest$ by user $SubjectUserName$.
analytic_story:
    - VMware ESXi AD Integration Authentication Bypass CVE-2024-37085
asset_type: Endpoint
cve:
    - CVE-2024-37085
mitre_attack_id:
    - T1136.001
    - T1136.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint