Splunk rules: 1j

id: '6149.6670'
title: BITSadmin Execution
description: 'BITSAdmin is a command line tool used to create and for managing background
  intelligent transfer. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat
  Actor Association: Andariel, APT31, APT41, BlackMatter, Darkside, FIN12, Flax Typhoon
  Software Association: ALPHV/BlackCat, Astaroth, Clop, MINEBRIDGE, Nefilim, Sodinokibi/REvil,
  Ransom Cartel Atomics T1105 Test#9 Atomics T1197 Test#1 Atomics T1197 Test#2 Atomics
  T1197 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") "bitsadmin" OR "BitsTransfer"
  OR "BitsFile" | table _time, host, user, signature_id, process, process_*, parent_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:bits jobs
- defense-evasion:bits jobs
- lateral-movement:lateral tool transfer
- command-and-control:ingress tool transfer
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1197
- T1048.003
- T1570
- T1105
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
- https://www.trendmicro.com/en_us/research/18/c/tropic-trooper-new-strategy.html
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

id: '31193.55841'
title: ConsentPromptBehaviorAdmin Registry Value Modified
description: 'Adversaries may bypass UAC mechanisms to elevate process privileges
  on system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. The impact to the
  user ranges from denying the operation under high enforcement to allowing the user
  to perform the action if they are in the local administrators group and click through
  the prompt or allowing them to enter an administrator password to complete the action.
  This use case detects registry modification events or process executions with registry
  modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin.
  -- Software Association: 8Base'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR
  "<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)
  "ADD" OR "Set-ItemProperty" OR "sp ")) "ConsentPromptBehaviorAdmin" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  | table _time, host, user, process, parent_process_name, signature_id, process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Process command-line parameters
- Windows event logs
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1548/002/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md#atomic-test-22---disable-uac-admin-consent-prompt-via-consentpromptbehavioradmin-registry-key
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base

id: '1071.1109'
title: Create_Modify Schtasks
description: 'Detects possible persistent backdoor access using schtasks -- Threat
  Group Association: Actinium/Gamaredon/Primitive Bear, Alloy Taurus/Gallium, APT29/Nobelium/Cozy
  Bear, APT31, APT33, APT34/OilRig, APT35/Phosphorus/Magic Hound, APT41, APT43, BlackByte,
  BlackCat, Blind Eagle/APT-C-36, Evilnum, FIN7, FIN12, Gamaredon Group/Shuckworm,
  GoldenJackal, Lazarus, Memento Team, MuddyWater, Redfly, TA428, Turla (akaSecret
  Blizzard, KRYPTON, and UAC-0003), Vice Society, WinterVivern/UAC-0114, WIRTE, Witchetty
  - Software Association: Blackbyte, Black Basta, BianLian, Cactus, Conti, GoMet,
  HermeticWiper/Trojan.Killdisk, Lockbit, Lorenz, LV, NanoCore, Play, Prestige, Prometheus/Spook,
  Rhysida, Trickbot, XingLocker - Atomics T1036.004 Test #1 Atomics T1053.005 Test#1
  Atomics T1053.005 Test#2 Atomics T1053.005 Test#3 Atomics T1053.005 Test#4 - #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  TERM(EventCode=4103)) AND (("schtasks" AND ("/create" OR "/change")) OR (TERM(Schedule.Service)
  "GetFolder") OR "New-ScheduledTask")| rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock
  ID.+)|^(Creating Scriptblock.+)//g"| rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"|
  rex field=process max_match=0 (?<schtask>"(?i)(schtasks\s+\/(create|change)|Schedule.Service.{1,20})")|
  rex field=process max_match=0 (?<user>"(?i)/ru.+")| rex field=user mode=sed max_match=0
  "s/(?i)^(\/ru )//g"| table _time, host, user _time, host, process, user, signature_id,
  schtask| bin span=300s | stats values(*) as * by _time, host `hec_collect`'
techniques:
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
technique_id:
- T1053.005
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://attack.mitre.org/techniques/T1053/005/

name: Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952
id: 2038f5c6-5aba-4221-8ae2-ca76e2ca8b97
version: 11
creation_date: '2023-02-21'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects attempts to exploit the Fortinet FortiNAC CVE-2022-39952 vulnerability. It identifies HTTP POST requests to the URI configWizard/keyUpload.jsp with a payload.zip file.
    The detection leverages the Web datamodel, analyzing fields such as URL, HTTP method, and user agent.
    This activity is significant as it indicates an attempt to exploit a known vulnerability, potentially leading to remote code execution.
    If confirmed malicious, attackers could gain control over the affected system, schedule malicious tasks, and establish persistent access via a remote command and control (C2) server.
data_source:
    - Palo Alto Network Threat
search: |-
    | tstats `security_content_summariesonly`
             count min(_time) as firstTime
                   max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url IN ("*configWizard/keyUpload.jsp*")

    BY Web.http_user_agent Web.status
       Web.http_method Web.url Web.url_length
       Web.src Web.dest
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `exploit_public_facing_fortinet_fortinac_cve_2022_39952_filter`
how_to_implement: |
    This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
known_false_positives: |
    False positives may be present. Modify the query as needed to POST, or add additional filtering (based on log source).
references:
    - https://github.com/horizon3ai/CVE-2022-39952
    - https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/
    - https://viz.greynoise.io/tag/fortinac-rce-attempt?days=30
finding:
    title: Potential CVE-2022-39952 against a Fortinet NAC may be occurring against $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Fortinet FortiNAC CVE-2022-39952
    - Hellcat Ransomware
asset_type: Network
cve:
    - CVE-2022-39952
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '5443.5690'
title: Invoke-WebRequest Command
description: 'Detects when typical download commands are executed -- Threat Actor
  Association: APT28/Fancy Bear, FIN13, Flax Typhoon, Kimsuky, Memento Team, NewsPenguin,
  Prophet Spider, TA2541, TA505, WinterVivern/UAC-0114, Wizard Spider -- Software
  Association: ALPHV/BlackCat, Alchimist, Bazar, Babuk, Clop, Cuba, DarkGate, LV,
  Qakbot/Qbot, TargetCompany, Trickbot, Remcos RAT, XingLocker, Yanluowang, Zloader
  -- Atomics T1041 Test#1 Atomics T1074.001 Test#1 Atomics T1572 Test#1 Atomics T1566.001
  #Test1 Atomics T1087.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 (TERM(IWR) OR TERM(Invoke-WebRequest)
  OR TERM("Invoke-RestMethod") OR TERM(curl) OR TERM(wget)) | rex field=process (?<uri>"(?i)(https?\:|ftp(\:|\.)|(\d{1,3}\.){3}\d{1,3})[A-Za-z0-9\x5c\/\_\+\-\%\.\:]+")|
  rex field=process "(?i)(?<cmd>invoke-webrequest|invoke-restmethod|wget|iwr|curl)"
  | where isnotnull(cmd) | table _time, host, user cmd, signature_id, process, process_*,
  parent_process, parent_process_*, uri | bin span=1s | stats values(*) as * by _time,
  host, process '
techniques:
- execution:command and scripting interpreter:powershell
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1105
data_category:
- Windows Sysmon
references: null

id: '35366.62198'
title: ngen.exe File Download
description: ngen.exe (Native Image Generator) is a legitimate Windows binary that
  compiles .NET assemblies into native machine code to improve application performance.
  Threat actors can abuse ngen.exe to download files. This use case detects ngen.exe
  executions with commands to download a file from a remote location. Living Off the
  Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "ngen.exe" | regex
  process="(?i)ngen(\.exe(\"|\'')?)?\s+(\"|\'')?[A-Za-z0-9]{2,6}:\/\/[^\s]+" | table
  _time, host, user, process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- PowerShell logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ngen/
- https://attack.mitre.org/techniques/T1105/
- https://learn.microsoft.com/en-us/dotnet/framework/tools/ngen-exe-native-image-generator

name: O365 Exfiltration via File Download
id: 06b23921-bfe2-4576-89dd-616f06e129da
version: 6
creation_date: '2025-01-28'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when an excessive number of files are downloaded from o365 by the same user over a short period of time. O365 may bundle these files together as a ZIP file, however each file will have it's own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Operation IN ("filedownloaded")
    | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
    | stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
    | rename SiteUrl as file_path,Workload as app
    | where count > 50
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_exfiltration_via_file_download_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: It is possible that certain file download scenarios may trigger this alert, specifically OneDrive syncing. Adjust threshold and filtering as needed.
references:
    - https://attack.mitre.org/techniques/T1567/exfil
    - https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
    - https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ downloaded an excessive number of files [$count$] from $file_path$ using $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Data Exfiltration
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1567
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Ollama Possible Model Exfiltration Data Leakage
id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure.
data_source:
    - Ollama Server
search: '`ollama_server` | rex field=_raw "\|\s+(?<status_code>\d+)\s+\|\s+(?<response_time>[\d\.]+)s\s+\|\s+(?<src_ip>[\:\da-f\.]+)\s+\|\s+(?<http_method>\w+)\s+\"(?<uri_path>[^\"]+)\"" | eval src=src_ip | eval dest=uri_path | where response_time > 55 | bin _time span=15m | stats count, avg(response_time) as avg_response_time, max(response_time) as max_response_time by _time, src, dest, uri_path | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( avg_response_time > 50, "high", avg_response_time > 40, "medium", 1=1, "low" ) | eval attack_type="Potential Data Exfiltration" | sort -_time | stats count by _time, src, uri_path, avg_response_time, max_response_time, severity, attack_type | `ollama_possible_model_exfiltration_data_leakage_filter`'
how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
known_false_positives: Legitimate administrative activities such as model inventory management, monitoring dashboards polling model status, automated health checks verifying model availability, CI/CD pipelines validating deployments, development tools inspecting model configurations, or users browsing available models through management interfaces may trigger this detection during normal operations. Adjust the threshold based on your environment's baseline activity.
references:
    - https://github.com/rosplk/ta-ollama
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Potential model data exfiltration detected from $src$ with $avg_response_time$ attempts across endpoints, indicating systematic extraction of sensitive model configurations, architecture details, and proprietary customizations that may constitute intellectual property theft.
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1048
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '8154.34953'
title: Potential LSA password filter
description: 'Adversaries may register malicious password filter dynamic link libraries
  (DLLs) into the authentication process to acquire user credentials as they are validated.
  Windows password filters are password policy enforcement mechanisms for both domain
  and local accounts. This use case looks for values added to LSA registry with reg.exe
  - Software Association: Cactus, Vice Society - Atomics T1556.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ((TERM(Set-ItemProperty)
  OR TERM(sp) OR (TERM(reg) TERM(add)))) ("HKLM" OR "HKEY_LOCAL_MACHINE") ("lsa" "control")
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify authentication process:password filter dll
- privilege-escalation:boot or logon autostart execution:authentication package
- persistence:boot or logon autostart execution:authentication package
- persistence:modify authentication process:password filter dll
- credential-access:modify authentication process:password filter dll
technique_id:
- T1556.002
- T1547.002
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf

name: Remote Desktop Network Traffic
id: 272b8407-842d-4b3d-bead-a704584003d3
version: 17
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: Anomaly
description: The following analytic detects unusual Remote Desktop Protocol (RDP) traffic on TCP/3389 by filtering out known RDP sources and destinations, focusing on atypical connections within the network. This detection leverages network traffic data to identify potentially unauthorized RDP access. Monitoring this activity is crucial for a SOC as unauthorized RDP access can indicate an attacker's attempt to control networked systems, leading to data theft, ransomware deployment, or further network compromise. If confirmed malicious, this activity could result in significant data breaches or complete system and network control loss.
data_source:
    - Zeek Conn
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
      WHERE All_Traffic.dest_port=3389
        AND
        All_Traffic.dest_category!=common_rdp_destination
        AND
        All_Traffic.src_category!=common_rdp_source
        AND
        All_Traffic.action="allowed"
      BY All_Traffic.src All_Traffic.dest All_Traffic.dest_port
         All_Traffic.dest_ip All_Traffic.dvc All_Traffic.src_ip
         All_Traffic.src_port All_Traffic.vendor_product
    | `drop_dm_object_name("All_Traffic")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_desktop_network_traffic_filter`
how_to_implement: To successfully implement this search you need to identify systems that commonly originate remote desktop traffic and that commonly receive remote desktop traffic. You can use the included support search "Identify Systems Creating Remote Desktop Traffic" to identify systems that originate the traffic and the search "Identify Systems Receiving Remote Desktop Traffic" to identify systems that receive a lot of remote desktop traffic. After identifying these systems, you will need to add the "common_rdp_source" or "common_rdp_destination" category to that system depending on the usage, using the Enterprise Security Assets and Identities framework.  This can be done by adding an entry in the assets.csv file located in SA-IdentityManagement/lookups.
known_false_positives: Remote Desktop may be used legitimately by users on the network.
references: []
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Remote Desktop Network Traffic Anomaly Detected from $src$ to $dest$
threat_objects:
    - field: dest
      type: ip_address
analytic_story:
    - SamSam Ransomware
    - Ryuk Ransomware
    - Hidden Cobra Malware
    - Active Directory Lateral Movement
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1021.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network
baselines:
    - Identify Systems Receiving Remote Desktop Traffic
    - Identify Systems Using Remote Desktop
    - Identify Systems Creating Remote Desktop Traffic

name: Spring4Shell Payload URL Request
id: 9d44d649-7d67-4559-95c1-8022ff49420b
version: 10
creation_date: '2022-04-05'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit the Spring4Shell vulnerability (CVE-2022-22963) by identifying specific URL patterns associated with web shell payloads. It leverages web traffic data, focusing on HTTP GET requests with URLs containing indicators like "tomcatwar.jsp," "poc.jsp," and "shell.jsp." This activity is significant as it suggests an attacker is trying to deploy a web shell, which can lead to remote code execution. If confirmed malicious, this could allow the attacker to gain persistent access, execute arbitrary commands, and potentially escalate privileges within the compromised environment.
data_source:
    - Nginx Access
search: |-
    | tstats count FROM datamodel=Web
      WHERE Web.http_method IN ("GET") Web.url IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*")
      BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
         Web.src, Web.dest sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `spring4shell_payload_url_request_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
known_false_positives: The jsp file names are static names used in current proof of concept code. =
references:
    - https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
    - https://github.com/TheGejr/SpringShell
    - https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
finding:
    title: A URL was requested related to Spring4Shell POC code on $dest$ by $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Spring4Shell CVE-2022-22965
asset_type: Web Server
cve:
    - CVE-2022-22965
mitre_attack_id:
    - T1133
    - T1190
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '15884.23728'
title: Suspicious PowerShell Clipboard Activity
description: 'Adversaries can use a variety of commands to obfuscate their activity.
  This use case detects PowerShell commands involving combinations of the SendKeys
  cmdlet, clipboard access, and native text editors. -- Software Association: BbyStealer
  -- Atomics T1059.001 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("[Windows.Forms.Clipboard]" TERM(sendkeys)) (TERM(notepad) OR TERM(wordpad)) |
  table _time, host, user, process, process_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- collection:clipboard data
- execution:command and scripting interpreter
technique_id:
- T1059.001
- T1115
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-5---mimikatz---cradlecraft-pssendkeys
- https://cyble.com/blog/bbystealer-malware-resurfaces-sets-sights-on-vpn-users/

name: Windows Firewall Rule Added
id: efc25501-4e75-4075-8cc5-ac80f2847d80
version: 9
creation_date: '2025-03-21'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This detection identifies instances where a Windows Firewall rule is added by monitoring Event ID 4946 in the Windows Security Event Log. Firewall rule modifications can indicate legitimate administrative actions, but they may also signal unauthorized changes, misconfigurations, or malicious activity such as attackers allowing traffic for backdoors or persistence mechanisms. By analyzing fields like RuleName, RuleId, Computer, and ProfileChanged, security teams can determine whether the change aligns with expected behavior. Correlating with user activity and process execution can help distinguish false positives from real threats, ensuring better visibility into potential security risks.
data_source:
    - Windows Event Log Security 4946
search: |-
    `wineventlog_security` EventCode=4946
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY RuleName signature subject
           status dest ProcessID
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_firewall_rule_added_filter`
how_to_implement: This detection is based on data collected from Endpoint Detection and Response (EDR) agents, which provide security-related telemetry from monitored endpoints. Specifically, it focuses on Windows Security Event Log entries with EventID 4946, which indicates that a new Windows Firewall rule has been added. To implement this detection in Splunk, you must ingest Windows Security Event Logs that capture EventID 4946, ensuring that critical fields such as _time, EventRecordID, ProcessID, ThreadID, Computer, ProfileChanged, RuleName, and RuleId are available for analysis. These logs must be processed using the appropriate Splunk Technology Add-ons (TAs) to ensure compatibility with the EDR product and proper field extraction. Additionally, mapping these logs to the appropriate data model, such as the Endpoint data model, enhances structured analysis. Leveraging the Splunk Common Information Model (CIM) helps normalize field names, ensuring consistency across different data sources. By implementing this approach, you can effectively detect and monitor Windows Firewall rule modifications, providing visibility into potential security risks or unauthorized changes.
known_false_positives: Legitimate admin changes, Group Policy updates, software installs, security tools, and automated scripts can trigger false positives for Event ID 4946.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4946
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a new firewall rule $RuleName$ added on $dest$.
analytic_story:
    - ShrinkLocker
    - Medusa Ransomware
    - NetSupport RMM Tool Abuse
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Rundll32 Execution With Log.DLL
id: f9593331-804c-4268-8b4c-2693c5ae786c
version: 3
creation_date: '2026-03-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |
    Identifies the execution of rundll32 with a command line argument of "log.dll", as used in the Lotus Blossom Chrysalis backdoor campaign.
    Attackers placed a malicious "log.dll" in "%AppData%\Bluetooth" and invoked it via rundll32.exe "log.dll,LogInit" to decrypt and execute ShellCode.
    The legitimate Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe) also uses log.dll and is vulnerable to DLL sideloading.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
      from datamodel=Endpoint.Processes where
      `process_rundll32`
      Processes.process="* log.dll*"
      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_rundll32_execution_with_log_dll_filter`
how_to_implement: |
    Ingest process creation logs (Sysmon EventID 1 or equivalent) and map them to the Endpoint.Processes data model. Ensure command-line arguments are captured so that "log.dll" appears in the process field. The Splunk Add-on for Microsoft Sysmon and CIM are required.
known_false_positives: |
    Legitimate use of rundll32 to load log.dll from trusted locations may trigger this.
    Allowlist known paths or parent processes as needed.
references:
    - https://attack.mitre.org/techniques/T1574/002/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
    - https://attack.mitre.org/groups/G0065/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Rundll32 loaded log.dll on $dest$ by user $user$, indicating potential Lotus Blossom-style DLL side loading abuse.
        - field: user
          type: user
          score: 20
          message: Rundll32 loaded log.dll on $dest$ by user $user$, indicating potential Lotus Blossom-style DLL side loading abuse.
threat_objects:
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Lotus Blossom Chrysalis Backdoor
asset_type: Endpoint
mitre_attack_id:
    - T1574
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: WMI Recon Running Process Or Services
id: b5cd5526-cce7-11eb-b3bd-acde48001122
version: 13
creation_date: '2021-06-14'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI performs an event query to list running processes or services. This detection leverages PowerShell Script Block Logging to capture and analyze script block text for specific WMI queries. This activity is significant as it is commonly used by malware and APT actors to map security applications or services on a compromised machine. If confirmed malicious, this could allow attackers to identify and potentially disable security defenses, facilitating further compromise and persistence within the environment.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*" OR ScriptBlockText="*Win32_Service*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `wmi_recon_running_process_or_services_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Network administrator may used this command for checking purposes
references:
    - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
    - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md
    - https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious powerShell script execution by $user_id$ on $dest$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services
        - field: user_id
          type: user
          score: 20
          message: Suspicious powerShell script execution by $user_id$ on $dest$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services
analytic_story:
    - Malicious PowerShell
    - Hermetic Wiper
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1592
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Zscaler Malware Activity Threat Blocked
id: ae874ad8-e353-40a7-87d4-420cdfb27d1a
version: 10
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Rod Soto, Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic identifies potential malware activities within a network that are blocked by Zscaler. It leverages web proxy logs to filter for blocked actions associated with malware, aggregating occurrences by user, URL, and threat category. This detection is significant for SOC as it highlights attempts to access malicious content, indicating potential compromise or targeted attacks. If confirmed malicious, this activity could signify an ongoing attempt to infiltrate the network, necessitating immediate investigation to prevent further threats and ensure network integrity.
data_source: []
search: |-
    `zscaler_proxy` action=blocked threatname=*malware* threatcategory!=None
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action deviceowner user
           urlcategory url src
           dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `zscaler_malware_activity_threat_blocked_filter`
how_to_implement: You must install the latest version of Zscaler Add-on from Splunkbase. You must be ingesting Zscaler events into your Splunk environment through an ingester. This analytic was written to be used with the "zscalernss-web" sourcetype leveraging the Zscaler proxy data. This enables the integration with Splunk Enterprise Security. Security teams are encouraged to adjust the detection parameters, ensuring the detection is tailored to their specific environment.
known_false_positives: False positives are limited to Zscalar configuration.
references:
    - https://help.zscaler.com/zia/nss-feed-output-format-web-logs
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Potential Malware Activity from dest -[$dest$] on $src$ for user-[$user$].
        - field: user
          type: user
          score: 20
          message: Potential Malware Activity from dest -[$dest$] on $src$ for user-[$user$].
threat_objects:
    - field: url
      type: url
analytic_story:
    - Zscaler Browser Proxy Threats
asset_type: Web Server
mitre_attack_id:
    - T1566
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: threat