Splunk rules: 1k

name: AWS CreateAccessKey
id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
version: 11
creation_date: '2021-03-02'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Hunting
description: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
data_source:
    - AWS CloudTrail CreateAccessKey
search: |-
    `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success
      | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
      | search match=0
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_createaccesskey_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
references:
    - https://bishopfox.com/blog/privilege-escalation-in-aws
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Cisco ASA - Device File Copy Activity
id: 4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM.
    Adversaries may copy device files including configurations, logs, packet captures, or system files for reconnaissance, credential extraction, or data exfiltration. While legitimate file operations occur during backups and maintenance, unauthorized copies may indicate malicious activity.
    The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands targeting running-config, startup-config, packet capture files, or other system files from disk0:, flash:, system:, or capture: locations.
    Investigate unexpected file copies, especially from non-administrative accounts, during unusual hours, or when combined with other suspicious activities.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111008, 111010)
    command = "copy *"
    command IN (
        "*running-config*",
        "*startup-config*",
        "*/pcap capture:*",
        "* disk0:*",
        "* flash:*",
        "* system:*"
    )
    | fillnull
    | stats earliest(_time) as firstTime
            latest(_time) as lastTime
            values(user) as user
            values(action) as action
            values(message_id) as message_id
            values(command) as command
            values(src_ip) as src_ip
            values(process_name) as process_name
      by host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___device_file_copy_activity_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Legitimate configuration exports may occur during normal administrative activities. These events should be verified and investigated.
references:
    - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: User $user$ executed command $command$ to export device configuration from Cisco ASA host $host$.
threat_objects:
    - field: command
      type: process
    - field: src_ip
      type: ip_address
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
    - ArcaneDoor
asset_type: Network
mitre_attack_id:
    - T1005
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco NVM - Webserver Download From File Sharing Website
id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e
version: 7
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin.
    Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise,
    where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation.
    The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    process_name IN (
        "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe", "tomcat*.exe"
      )
    dest_hostname IN (
        "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*",
        "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*",
        "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*",
        "*paste.ee*", "*pastebin.*", "*pastetext.net*", "*privatlab.*",
        "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*",
        "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*",
        "*ufile.io*", "*w3spaces.com*", "*workers.dev*"
      )
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___webserver_download_from_file_sharing_website_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    In rare cases, a web server may make outbound connections to pull content for legitimate purposes (e.g., downloading templates or updates from a trusted source).
    However, communication to anonymous file-sharing or temporary content domains is strongly suspicious.
    If legitimate use is confirmed, domain- or process-level allowlisting is recommended.
references:
    - https://www.cisa.gov/news-events/alerts/2023/04/13/cisa-adds-3-known-exploited-vulnerabilities-kev-catalog
    - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
    - https://research.splunk.com/endpoint/4e8391eb-527e-4e39-9a17-c5bde2f89158/
finding:
    title: The host $src$ ran web server process $process_path$ which downloaded content from $dest_hostname$ over port $dest_port$
    entity:
        field: src
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - GhostRedirector IIS Module and Rungan Backdoor
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1105
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt
id: 93db24a0-fd21-45d7-9daf-84afd5a8cca2
version: 7
creation_date: '2025-07-17'
modification_date: '2026-05-13'
author: Michael Haag, Nasreddine Bencherchali, Splunk, Talos NTDR
status: production
type: TTP
description: |
    This analytic detects exploitation activity of CVE-2025-5777 using Cisco Secure Firewall Intrusion Events.
    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 65118 (Citrix NetScaler memory overread attempt) is triggered
    If confirmed malicious, this behavior is highly indicative of a potential exploitation of CVE-2025-5777.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall`
    EventType=IntrusionEvent
    signature_id = 65118
    | fillnull
    | stats min(_time) as firstTime
            max(_time) as lastTime
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(src) as src
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            by dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___citrix_netscaler_memory_overread_attempt_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: |
    Security testing or vulnerability scanners might trigger this. Investigate any potential
    matches to determine if they're legitimate.
references:
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
    - https://www.netscaler.com/blog/news/critical-security-updates-for-netscaler-netscaler-gateway-and-netscaler-console/
    - https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-
    - https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
    - https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
    - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml
finding:
    title: Potential exploitation of CVE-2025-5777 from $src$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: system
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777
asset_type: Endpoint
mitre_attack_id:
    - T1203
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Crowdstrike High Identity Risk Severity
id: 0df524ad-6d78-4883-9987-d29418928103
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects CrowdStrike alerts for High Identity Risk Severity with a risk score of 70 or higher. These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity and protection of sensitive information and systems.
data_source: []
search: |-
    `crowdstrike_identities` riskScoreSeverity="HIGH" OR riskScore >= 0.70
      | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY domain dn primaryDisplayName
           risk_type severity riskScore
           riskScoreSeverity user role_type
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_high_identity_risk_severity_filter`
how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
finding:
    title: High Identity Risk Score Severity found on $domain$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Large ICMP Traffic
id: 9cd6d066-94d5-4ccd-a8b9-28c03ca91be8
version: 8
creation_date: '2020-01-19'
modification_date: '2026-05-13'
author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk
status: production
type: TTP
description: |
    The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes.
    It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
    If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
data_source:
    - Palo Alto Network Traffic
    - Cisco Secure Access Firewall
search: |-
    | tstats `security_content_summariesonly`
              count earliest(_time) as firstTime
                    latest(_time) as lastTime
                    values(All_Traffic.action) as action
    from datamodel=Network_Traffic where
    All_Traffic.bytes > 1000
    All_Traffic.action != blocked
    AND
    (
        All_Traffic.protocol=icmp
        OR
        All_Traffic.transport=icmp
    )
    NOT ( All_Traffic.dest_ip IN `non_public_ip_blocks`
    OR All_Traffic.dest IN `non_public_ip_blocks`
    )
    by All_Traffic.src_ip All_Traffic.src All_Traffic.dest_ip All_Traffic.dest All_Traffic.protocol
       All_Traffic.bytes All_Traffic.app All_Traffic.bytes_in
       All_Traffic.bytes_out All_Traffic.dest_port All_Traffic.dvc
       All_Traffic.protocol_version All_Traffic.src_port
       All_Traffic.user All_Traffic.vendor_product
    | `drop_dm_object_name("All_Traffic")`
    | eval dest_ip = dest
    | eval src_ip = src
    | iplocation dest_ip
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_large_icmp_traffic_filter`
how_to_implement: |
    The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with Command And Control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro `detect_large_icmp_traffic_filter` to adjust the byte threshold or add specific IP addresses to an allow list.
references: []
finding:
    title: Large ICMP traffic greater than a 1000 bytes detected from $src_ip$ to $dest_ip$
    entity:
        field: src_ip
        type: system
        score: 50
intermediate_findings:
    entities:
        - field: dest_ip
          type: system
          score: 50
          message: Large ICMP traffic greater than a 1000 bytes detected from $src_ip$ to $dest_ip$
analytic_story:
    - Command And Control
    - China-Nexus Threat Activity
    - Backdoor Pingpong
    - Cisco Secure Access Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1095
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '1001.1056'
title: Encoded Powershell Command
description: 'PowerShell is a powerful interactive command-line interface and scripting
  environment included in the Windows operating system. Adversaries can use PowerShell
  to perform a number of actions, including discovery of information and execution
  of code. Encoded commands could be a way for an attacker to obfuscate malicious
  scripts they are executing on the victim machine. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422,
  STRONTIUM), APT29/Nobelium, APT35/Phosphorus/Magic Hound, BlackByte, DarkSide, BlackMatter,
  FIN7, Memento Team, MuddyWater, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003),
  Vice Society, Volt Typhoon - Software Attribution: ALPHV/BlackCat, Bazarloader,
  Black Basta, Conti, Emotet, LV, MirrorBlast, Prestige, PYSA/Mespinoza, Ransom Cartel,
  TargetCompany, TrickBot, XingLocker, Yellow Cocaktoo/Jupiter Infostealer, WhisperGate
  - #TrendingThreat #Russia #Ukraine - Atomics T1027 Test #2 Atomics T1027 Test #3'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` ("EventCode=4688" OR "EventID>4688<")
  (TERM(-e) OR TERM(-ec) OR TERM(-en) OR TERM(-enc) OR TERM(-enco) OR TERM(-encod)
  OR TERM(-encode) OR TERM(-encoded) OR TERM(-encodedc) OR TERM(-encodedco) OR TERM(-encodedcommand)
  OR "-encodedcom*") | regex process="(?i)powershell.*\s+-(e|en|ec|enco|encod|encode|encoded|encodedc|encodedco|encodedcom\S+)\s+"
  | table _time, host, user dvc, dvc_nt_host, event_id, eventtype, host, index, parameters,
  process, process_id, process_name, process_path, shell, signature_id, source, sourcetype,
  src_user, tag, user, user_id | rex field=process "(?<base64_cmd>\w{20,1000}=?)"
  | where match(process_name, "(?i)powershell")| avlbase64 type=decode field=base64_cmd
  | eval definition=strftime(_time, "%Y-%m-%d %X").": A Base64 Encrypted PowerShell
  command was possibly ran on ".dvc_nt_host `hec_collect`'
techniques:
- defense-evasion:obfuscated files or information
- execution:command and scripting interpreter:powershell
technique_id:
- T1027
- T1059.001
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ

name: GetWmiObject Ds Group with PowerShell
id: df275a44-4527-443b-b884-7600e066e3eb
version: 10
creation_date: '2021-08-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: |-
    The following analytic identifies the execution of `powershell.exe` with command-line arguments used to query domain groups via the `Get-WmiObject` cmdlet and the `-class ds_group` parameter.
    This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
    This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery.
    If confirmed malicious, this could allow attackers to gain insights into the domain structure, aiding in further attacks and privilege escalation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        `process_powershell`
        OR
        `process_cmd`
    )
    AND
    Processes.process = "*Get-WmiObject*"
    Processes.process = "*namespace *"
    Processes.process = "* root\\directory\\ldap*"
    Processes.process = "* ds_group*"
    Processes.process = "*class *"

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getwmiobject_ds_group_with_powershell_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Domain group discovery enumeration via the command $process$ on $dest$ by $user$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: command
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Possible Append Command To At Allow Config File
id: 7bc20606-5f40-11ec-a586-acde48001122
version: 12
creation_date: '2021-12-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious command lines that append user entries to /etc/at.allow or /etc/at.deny files. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving these files. This activity is significant because altering these configuration files can allow attackers to schedule tasks with elevated permissions, facilitating persistence on a compromised Linux host. If confirmed malicious, this could enable attackers to execute arbitrary code at scheduled intervals, potentially leading to further system compromise and unauthorized access to sensitive information.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE Processes.process = "*echo*"
        AND
        Processes.process IN("*/etc/at.allow", "*/etc/at.deny")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_append_command_to_at_allow_config_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://linuxize.com/post/at-command-in-linux/
    - https://attack.mitre.org/techniques/T1053/001/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A commandline $process$ that may modify at allow config file on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Scheduled Tasks
asset_type: Endpoint
mitre_attack_id:
    - T1053.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Ollama Possible Memory Exhaustion Resource Abuse
id: ca96297f-e82e-4749-8cc9-d1ab555abb57
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users.
data_source:
    - Ollama Server
search: '`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") | rex field=_raw "count=(?<runner_count>\d+)" | rex field=_raw "size\s*=\s*(?<memory_mb>[\d\.]+)\s+MiB" | rex field=_raw "started in\s*(?<load_time>[\d\.]+)\s*seconds" | rex field=_raw "source=(?<code_source>[^\s]+)" | bin _time span=5m | stats count as operations, sum(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host | where operations > 5 OR total_runners > 0 OR max_memory > 400 OR total_memory > 500 | eval avg_memory=round(avg_memory, 2) | eval max_memory=round(max_memory, 2) | eval total_memory=round(total_memory, 2) | eval avg_load_time=round(avg_load_time, 2) | eval severity=case( max_memory > 500 OR total_memory > 1000, "critical", max_memory > 400 OR operations > 20, "high", operations > 10, "medium", 1=1, "low" ) | eval attack_type="Resource Exhaustion / Memory Abuse" | sort -_time | table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type | `ollama_possible_memory_exhaustion_resource_abuse_filter`'
how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
known_false_positives: Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations.
references:
    - https://github.com/rosplk/ta-ollama
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Potential resource exhaustion attack detected on $host$ with $operations$ memory operations in 5 minutes, utilizing $max_memory$ MiB peak memory and $total_runners$ runners, indicating possible attempts to exhaust system resources through excessive model loading or memory abuse.
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1499
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '15890.23901'
title: PowerShell XML Retrieval
description: 'This use case detects PowerShell commands attempting to retrieve data
  from XML files via http or https. Atomics T1059.001 Test #7 Atomics T1059.001 Test
  #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("MsXml2.ServerXmlHttp" OR TERM(ComObject) OR
  "xml") | table _time, host, user process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | where match(process, "(?i)http(s?):\/\/")
  and match (process, "(?i)xml") and match(process, "(?i)powershell|cmd\.exe") '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
technique_id:
- T1059.001
- T1059
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt

name: Script Execution via WMI
id: aa73f80d-d728-4077-b226-81ea0c8be589
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of scripts via Windows Management Instrumentation (WMI) by monitoring the process 'scrcons.exe'. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. WMI-based script execution is significant because adversaries often use it to perform malicious activities stealthily, such as system compromise, data exfiltration, or establishing persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain long-term access to the environment. Analysts should differentiate between legitimate administrative use and potential threats.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=scrcons.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `script_execution_via_wmi_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.
references:
    - https://redcanary.com/blog/child-processes/
finding:
    title: A wmic.exe process $process_name$ that execute script in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A wmic.exe process $process_name$ that execute script in host $dest$
analytic_story:
    - Suspicious WMI Use
    - Scattered Spider
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: System Information Discovery Detection
id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
version: 16
creation_date: '2020-10-14'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic identifies system information discovery techniques, such as the execution of commands like `wmic qfe`, `systeminfo`, and `hostname`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often use these commands to gather system configuration details, which can aid in further exploitation. If confirmed malicious, this behavior could allow attackers to tailor their attacks based on the discovered system information, potentially leading to privilege escalation, persistence, or data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest > 2 | stats values(process) as process values(action) as action values(original_file_name) as original_file_name values(parent_process) as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_path) as parent_process_path values(process_exec) as process_exec values(process_guid) as process_guid values(.process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product  min(firstTime) as firstTime max(lastTime) as lastTime by user, dest parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators debugging servers
references:
    - https://web.archive.org/web/20210119205146/https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
finding:
    title: Potential system information discovery behavior on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Potential system information discovery behavior on $dest$ by $user$
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - Windows Discovery Techniques
    - Gozi Malware
    - Medusa Ransomware
    - BlackSuit Ransomware
    - Cleo File Transfer Software
    - Interlock Ransomware
    - LAMEHUG
    - NetSupport RMM Tool Abuse
    - BlankGrabber Stealer
    - Lotus Blossom Chrysalis Backdoor
asset_type: Windows
mitre_attack_id:
    - T1082
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '16272.24664'
title: System Network Connections Discovery - Windows
description: 'Adversaries may attempt to get a listing of network connections to or
  from the compromised system they are currently accessing or from remote systems
  by querying for information over the network. -- Threat Actor Association: Alloy
  Taurus/Gallium, Volt Typhoon -- Atomics T1049 Test #1 Atomics T1049 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "netstat" OR ("net"
  ("use" or "sessions")) OR TERM(Get-NetTCPConnection) | regex process="(?i)netstat(\.exe)?|net(\.exe)?\s+(use|sessions)|Get-TCPConnection"
  | table _time, host, user process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- discovery:system network connections discovery
technique_id: 
- T1049
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell

name: UAC Bypass With Colorui COM Object
id: 2bcccd20-fc2b-11eb-8d22-acde48001122
version: 11
creation_date: '2021-08-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a potential UAC bypass using the colorui.dll COM Object. It leverages Sysmon EventCode 7 to identify instances where colorui.dll is loaded by a process other than colorcpl.exe, excluding common system directories. This activity is significant because UAC bypass techniques are often used by malware, such as LockBit ransomware, to gain elevated privileges without user consent. If confirmed malicious, this could allow an attacker to execute code with higher privileges, leading to further system compromise and persistence within the environment.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: not so common. but 3rd part app may load this dll.
references:
    - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
finding:
    title: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ransomware
    - LockBit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1218.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AD Replication Request Initiated from Unsanctioned Location
id: 50998483-bb15-457b-a870-965080d9e3d3
version: 16
creation_date: '2022-11-16'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: The following analytic identifies unauthorized Active Directory replication requests initiated from non-domain controller locations. It leverages EventCode 4662 to detect when a computer account with replication permissions creates a handle to domainDNS, filtering out known domain controller IP addresses. This activity is significant as it may indicate a DCSync attack, where an attacker with privileged access can request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access to sensitive information and potential full domain compromise.
data_source:
    - Windows Event Log Security 4662
    - Windows Event Log Security 4624
search: |-
    `wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
      "domainDNS") AND Properties IN ("*Replicating Directory Changes All*","*Manage Replication Topology*","*Remove Replica In Domain*","*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
      AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18"
      OR SubjectDomainName="Window Manager" OR SubjectUserName="*$")
    | stats min(_time)
        as attack_time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status
    | rename SubjectDomainName
        as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId
    | appendpipe
        [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
    | stats min(attack_time) as _time, values(TargetUserSid)
        as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user,
        values(Computer) as Computer, values(status) as status, values(src_category) as
        src_category, values(src_ip) as src_ip values(action) as action values(authentication_method) as authentication_method values(dest) as dest values(signature) as signature values(signature_id) as signature_id by TargetLogonId
    | search NOT src_category="domain_controller"
    | `windows_ad_replication_request_initiated_from_unsanctioned_location_filter`
how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services Access` within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root and all descendant objects. The principals `everybody`,  `Domain Computers`, and  `Domain Controllers` auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and `Replicating Directory Changes In Filtered Set` Assets and Identities will also need to be configured, with the category of domain_controller added for domain controllers.
known_false_positives: Genuine DC promotion may trigger this alert.
references:
    - https://adsecurity.org/?p=1729
    - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
    - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml
finding:
    title: Windows Active Directory Replication Request Initiated from Unsanctioned Location $src_ip$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src_ip
          type: system
          score: 50
          message: Windows Active Directory Replication Request Initiated from Unsanctioned Location $src_ip$ by $user$
analytic_story:
    - Compromised Windows Host
    - Sneaky Active Directory Persistence Tricks
    - Credential Dumping
asset_type: Endpoint
mitre_attack_id:
    - T1003.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AD Rogue Domain Controller Network Activity
id: c4aeeeef-da7f-4338-b3ba-553cbcbe2138
version: 9
creation_date: '2023-04-11'
modification_date: '2026-05-13'
author: Dean Luxton
status: experimental
type: TTP
description: The following analytic identifies unauthorized replication RPC calls from non-domain controller devices. It leverages Zeek wire data to detect specific RPC operations like DrsReplicaAdd and DRSGetNCChanges, filtering out legitimate domain controllers. This activity is significant as it may indicate an attempt to introduce a rogue domain controller, which can compromise the integrity of the Active Directory environment. If confirmed malicious, this could allow attackers to manipulate directory data, escalate privileges, and persist within the network, posing a severe security risk.
data_source: []
search: |-
    `zeek_rpc` DrsReplicaAdd OR DRSGetNCChanges
      | where NOT (dest_category="Domain Controller") OR NOT (src_category="Domain Controller")
      | fillnull value="Unknown" src_category, dest_category
      | table _time endpoint operation src src_category dest dest_category
      | `windows_ad_rogue_domain_controller_network_activity_filter`
how_to_implement: Run zeek on domain controllers to capture the DCE RPC calls, ensure the domain controller categories are defined in Assets and Identities.
known_false_positives: No false positives have been identified at this time.
references:
    - https://adsecurity.org/?p=1729
finding:
    title: Rogue DC Activity Detected from $src_category$ device $src$ to $dest$ ($dest_category$)
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1207
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Windows DNS Query Request by Telegram Bot API
id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e
version: 12
creation_date: '2021-08-03'
modification_date: '2026-07-20'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network.
data_source:
    - Sysmon EventID 22
search: |-
    `sysmon` EventCode=22  query = "api.telegram.org" process_name != "telegram.exe"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY answer answer_count dvc
           process_exec process_guid process_name
           query query_count reply_code_id
           signature signature_id src
           user_id vendor_product QueryName
           QueryResults QueryStatus
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_dns_query_request_by_telegram_bot_api_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: a third part automation using telegram API.
references:
    - https://www.splunk.com/en_us/blog/security/threat-advisory-telegram-crypto-botnet-strt-ta01.html
intermediate_findings:
    entities:
        - field: dvc
          type: system
          score: 20
          message: DNS query by a telegram bot [$query$] on [$dvc$].
analytic_story:
    - Crypto Stealer
    - 0bj3ctivity Stealer
    - BlankGrabber Stealer
    - VIP Keylogger
    - Phantom Stealer
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1071.004
    - T1102.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint