Splunk rules: 1l

id: '13728.20152'
title: AnyDesk Silent Install
description: 'An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. BlackByte ransomware group has been observed performing silent installs
  of AnyDesk after establishing a foothold. This use case detects silent installation
  of AnyDesk. - Threat Actor Association: Alloy Taurus/Gallium, Gamaredon (aka. Armageddon,
  UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944), Scatter Swine,
  UNC2659 - Software Association: Akira, ALPHV/BlackCat, AvosLocker, BianLian, BlackByte,
  BumbleBee, Clop, Conti, Diavol, Royal'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(AnyDesk) "--silent" | regex process="(?i)(anydesk.exe).*(--silent)"
  | table _time, host, user, process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html

name: Cisco ASA - Core Syslog Message Volume Drop
id: 4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4
version: 5
creation_date: '2025-09-25'
modification_date: '2026-05-13'
author: Bhavin Patel, Micheal Haag, Splunk
status: production
type: Hunting
description: |
    Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. This hunting search is recommended to proactively identify suspicious downward shifts or absences in key syslog message IDs, which may indicate tampering or malicious activity. Visualizing this data in Splunk dashboards enables security teams to quickly spot anomalies and investigate potential compromise.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (302013, 302014, 609002, 710005)
    | eval msg_desc=case(
      message_id="302013","Built inbound TCP connection",
      message_id="302014","Teardown TCP connection",
      message_id="609002","Teardown local-host management",
      message_id="710005","TCP request discarded"
    )
    | bin _time span=15m
    | stats count values(msg_desc) as message_description
                  values(dest) as dest
      by _time message_id
    | xyseries _time message_id count
    | `cisco_asa___core_syslog_message_volume_drop_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk.
    This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.
    The search produces a time-series suitable for dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Planned maintenance, network outages, routing changes, or benign configuration updates may reduce log volume temporarily.
    Validate against change management records and corroborate with device health metrics.
references:
    - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
    - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
    - https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices
    - https://www.ncsc.gov.uk/news/persistent-malicious-targeting-cisco-devices
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
    - ArcaneDoor
asset_type: Network
cve:
    - CVE-2025-20333
    - CVE-2025-20362
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Credential Dumping via Symlink to Shadow Copy
id: c5eac648-fae0-4263-91a6-773df1f4c903
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a symlink to a shadow copy, which may indicate credential dumping attempts. It leverages the Endpoint.Processes data model in Splunk to identify processes executing commands containing "mklink" and "HarddiskVolumeShadowCopy". This activity is significant because attackers often use this technique to manipulate or delete shadow copies, hindering system backup and recovery efforts. If confirmed malicious, this could prevent data restoration, complicate incident response, and lead to data loss or compromise. Analysts should review the process details, user, parent process, and any related artifacts to identify the attack source.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_cmd` Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `credential_dumping_via_symlink_to_shadow_copy_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials.
analytic_story:
    - Compromised Windows Host
    - Credential Dumping
asset_type: Endpoint
mitre_attack_id:
    - T1003.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect New Login Attempts to Routers
id: bce3ed7c-9b1f-42a0-abdf-d8b123a34836
version: 9
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: The following analytic identifies new login attempts to routers. It leverages authentication logs from the ES Assets and Identity Framework, focusing on assets categorized as routers. The detection flags connections that have not been observed in the past 30 days. This activity is significant because unauthorized access to routers can lead to network disruptions or data interception. If confirmed malicious, attackers could gain control over network traffic, potentially leading to data breaches or further network compromise.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count earliest(_time) as earliest latest(_time) as latest FROM datamodel=Authentication
      WHERE Authentication.dest_category=router
      BY Authentication.dest Authentication.user
    | eval isOutlier=if(earliest >= relative_time(now(), "-30d@d"), 1, 0)
    | where isOutlier=1
    | `security_content_ctime(earliest)`
    | `security_content_ctime(latest)`
    | `drop_dm_object_name("Authentication")`
    | `detect_new_login_attempts_to_routers_filter`
how_to_implement: To successfully implement this search, you must ensure the network router devices are categorized as "router" in the Assets and identity table. You must also populate the Authentication data model with logs related to users authenticating to routing infrastructure.
known_false_positives: Legitimate router connections may appear as new connections
references: []
finding:
    title: New login on $dest$ from $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: New login on $dest$ from $user$
analytic_story:
    - Router and Infrastructure Security
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Detect New Open S3 Buckets over AWS CLI
id: 39c61d09-8b30-4154-922b-2d0a694ecc22
version: 10
creation_date: '2021-01-12'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the creation of open/public S3 buckets via the AWS CLI. It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
data_source:
    - AWS CloudTrail
search: |-
    `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers")
      | rename requestParameters.bucketName AS bucketName
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY userIdentity.userName userIdentity.principalId userAgent
           bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp
           requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control
      | rename userIdentity.userName as user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_new_open_s3_buckets_over_aws_cli_filter`
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
references: []
finding:
    title: User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Suspicious AWS S3 Activities
asset_type: S3 Bucket
mitre_attack_id:
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Internal Vertical Port Scan
id: 40d2dc41-9bbf-421a-a34b-8611271a6770
version: 13
creation_date: '2020-01-19'
modification_date: '2026-05-13'
author: Dean Luxton, Splunk
status: production
type: TTP
description: This analytic detects instances where an internal host attempts to communicate with over 500 ports on a single destination IP address. It includes filtering criteria to exclude applications performing scans over ephemeral port ranges, focusing on potential reconnaissance or scanning activities. Monitoring network traffic logs allows for timely detection and response to such behavior, enhancing network security by identifying and mitigating potential threats promptly.
data_source:
    - AWS CloudWatchLogs VPCflow
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(All_Traffic.action) as action
            values(All_Traffic.src_category) as src_category
            values(All_Traffic.dest_zone) as dest_zone
            values(All_Traffic.src_zone) as src_zone

    from datamodel=Network_Traffic where

    All_Traffic.src_ip IN (
      "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
      "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
      "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
      "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
      "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4"
    )

    by span=1s _time
       All_Traffic.src_ip All_Traffic.dest_port
       All_Traffic.dest_ip All_Traffic.transport
       All_Traffic.rule

    | `drop_dm_object_name("All_Traffic")`
    | eval gtime=_time
    | bin span=1h gtime

    | stats min(_time) as _time
            values(action) as action
            dc(eval(if(dest_port<1024 AND transport="tcp",dest_port,null))) as privilegedDestTcpPortCount
            dc(eval(if(transport="tcp",dest_port,null))) as totalDestTcpPortCount
            dc(eval(if(dest_port<1024 AND transport="udp",dest_port,null))) as privilegedDestUdpPortCount
            dc(eval(if(transport="udp",dest_port,null))) as totalDestUdpPortCount
            values(src_category) as src_category
            values(dest_zone) as dest_zone
            values(src_zone) as src_zone
      by src_ip dest_ip transport gtime
    | eval totalDestPortCount=totalDestUdpPortCount+totalDestTcpPortCount,
           privilegedDestPortCount=privilegedDestTcpPortCount+privilegedDestUdpPortCount
    | where (totalDestPortCount>=500 AND privilegedDestPortCount>=20)
    | fields - gtime
    | `internal_vertical_port_scan_filter`
how_to_implement: To properly run this search, Splunk needs to ingest data from networking telemetry sources such as firewalls, NetFlow, or host-based networking events. Ensure that the Network_Traffic data model is populated to enable this search effectively.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: $src_ip$ has scanned $totalDestPortCount$ ports on $dest_ip$
    entity:
        field: src_ip
        type: system
        score: 50
threat_objects:
    - field: dest_ip
      type: ip_address
analytic_story:
    - Network Discovery
    - Cisco Secure Firewall Threat Defense Analytics
    - China-Nexus Threat Activity
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1046
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Linux Auditd Auditd Daemon Shutdown
id: 6e2574b3-e24b-4321-ae3c-ba83a75bb714
version: 6
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the unexpected termination of the Linux Audit daemon (auditd) by monitoring for log entries of type DAEMON_END. This event signifies that the audit logging service has stopped, either due to a legitimate system shutdown, manual administrative action, or potentially malicious tampering. Since auditd is responsible for recording critical security events, its sudden stoppage may indicate an attempt to disable security monitoring or evade detection during an attack. This detection should be correlated with system logs to determine whether the shutdown was part of routine maintenance or an anomaly. If confirmed as malicious, this could lead to a compromised system where security events are no longer being logged, allowing attackers to operate undetected. Therefore, monitoring and alerting on auditd shutdown events is crucial for maintaining the integrity of system security monitoring.
data_source:
    - Linux Auditd Daemon End
search: |-
    `linux_auditd` type=DAEMON_END
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY type op res
           auid dest pid
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_auditd_daemon_shutdown_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Auditd service event - [$type$] event occurred on host - [$dest$].
analytic_story:
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1685.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Doas Tool Execution
id: 91b8ca78-f205-4826-a3ef-cd8d6b24e97b
version: 10
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, similar to 'sudo'. The detection leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant as 'doas' can be exploited by adversaries to gain elevated privileges on a compromised host. If confirmed malicious, this could lead to unauthorized administrative access, potentially compromising the entire system.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd` type=SYSCALL comm=doas
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY comm exe syscall
           uid ppid pid
           success dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_doas_tool_execution_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://wiki.gentoo.org/wiki/Doas
    - https://www.makeuseof.com/how-to-install-and-use-doas/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to execute the "doas" tool.
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd File And Directory Discovery
id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1
version: 9
creation_date: '2024-08-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. This behavior often precedes data exfiltration, as adversaries seek to identify valuable or confidential information for theft. By identifying unusual or unauthorized attempts to browse or enumerate files and directories, this analytic helps security teams detect potential reconnaissance or preparatory actions by an attacker, enabling timely intervention to prevent data breaches or unauthorized access.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd`  execve_command IN ("*grep*", "*find*") AND execve_command IN ("*.tif*", "*.tiff*", "*.gif*", "*.jpeg*", "*.jpg*", "*.jif*", "*.jfif*", "*.jp2*", "*.jpx*", "*.j2k*", "*.j2c*", "*.fpx*", "*.pcd*", "*.png*", "*.flv*", "*.pdf*", "*.mp4*", "*.mp3*", "*.gifv*", "*.avi*", "*.mov*", "*.mpeg*", "*.wav*", "*.doc*", "*.docx*", "*.xls*", "*.xlsx*", "*.svg*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_file_and_directory_discovery_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
    - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$execve_command$] event occurred on host - [$dest$] to discover files and directories.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1083
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Deleting Critical Directory Using RM Command
id: 33f89303-cc6f-49ad-921d-2eaea38a6f7a
version: 10
creation_date: '2022-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the deletion of critical directories on a Linux machine using the `rm` command with argument rf. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions targeting directories like /boot, /var/log, /etc, and /dev. This activity is significant because deleting these directories can severely disrupt system operations and is often associated with destructive campaigns like Industroyer2. If confirmed malicious, this action could lead to system instability, data loss, and potential downtime, making it crucial for immediate investigation and response.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name =rm
        AND
        Processes.process= "* -rf *"
        AND
        Processes.process IN ("*/boot/*", "*/var/log/*", "*/etc/*", "*/dev/*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_deleting_critical_directory_using_rm_command_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://cert.gov.ua/article/39518
finding:
    title: A deletion in known critical list of folder using rm command $process$ executed on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - AwfulShred
    - Data Destruction
    - Industroyer2
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Netcat Outbound Connection
id: 50a9de97-d58d-4844-8daf-928d2faceead
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems.
    Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by attackers to establish reverse shells, exfiltrate data, or create persistent backdoor connections to remote systems.
    This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic.
    If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system.
data_source:
    - Sysmon for Linux EventID 3
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Network_Traffic.All_Traffic where

    All_Traffic.app IN (
        "*nc",
        "*ncat",
        "*netcat"
    )
    All_Traffic.direction="outbound"

    by All_Traffic.src All_Traffic.dest All_Traffic.dest_port All_Traffic.transport
       All_Traffic.process_name All_Traffic.app All_Traffic.user All_Traffic.process_id

    | `drop_dm_object_name(All_Traffic)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_netcat_outbound_connection_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain network connection events including the source, destination, port, and process context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Network_Traffic` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators or developers may use netcat for troubleshooting, port scanning, or testing network connectivity. Filter based on known administrative activity or authorized users.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Netcat outbound connection detected on [$dest$]
threat_objects:
    - field: dest
      type: ip_address
analytic_story:
    - Linux Post-Exploitation
    - Command And Control
    - Data Exfiltration
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32266.57398'
title: Potential AutoHotkey .ahk Execution
description: Adversaries may execute commands and perform malicious tasks using AutoIT
  and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages
  that enable users to automate Windows tasks. These automation scripts can be used
  to perform a wide variety of actions, such as clicking on buttons, entering text,
  and opening and closing programs. This use case detects exeuction of .ahk files,
  accounting for renamed AutoHotkey binaries. Due to the broad nature of this rule,
  false positives for .ahk creation are expected. Allowlisting for expected executables
  and command line arguments is recommended.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<") OR (TERM(EventCode=4104) OR "<EventID>4104<") ".ahk" | regex process="(?i)\.exe.+\S+\.ahk(\s|$|\")"
  | table _time, host, user, process | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1059/010/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_renamed_autohotkey/
- https://www.autohotkey.com/

id: '15063.22366'
title: Renamed Process
description: 'Adversaries may attempt to manipulate features of their artifacts to
  make them appear legitimate or benign to users and/or security tools. Masquerading
  occurs when the name or location of an object, legitimate or malicious, is manipulated
  or abused for the sake of evading defenses and observation. This may include manipulating
  file metadata, tricking users into misidentifying the file type, and giving legitimate
  task or service names. This use case compares the process'' original file name to
  the process name at execution. Some legitimate processes may be renamed in normal
  operation and should be allowlisted by file name, process path, and commands where
  applicable to reduce false positives. This detection is based on features unique
  to SysMon and therefore requires SysMon 10.0 or later. -- Threat Actor Association:
  SideWinder -- Atomics T1036.003 Test #1 Atomics T1036.003 Test #3 Atomics T1036.003
  Test #4 Atomics T1036.003 Test #5 Atomics T1036.003 Test #6 Atomics T1036.003 Test
  #7 Atomics T1036.003 Test #8 Atomics T1036.003 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<")
  (cmd.exe OR powershell.exe OR pwsh.exe OR powershell_ise.exe) | eval OriginalFileNameFormatted=lower(OriginalFileName),
  process_exec_formatted=lower(process_exec)| rex field=OriginalFileNameFormatted
  mode=sed s/\.\w{3}$//g| rex field=process_exec_formatted mode=sed s/\.\w{3}$//g|
  where process_exec_formatted != OriginalFileNameFormatted and !match(OriginalFileName,
  "\?|^-$")| table _time, host, user, process, process_*, parent_process_name, OriginalFileName
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading
- defense-evasion:masquerading:rename system utilities
technique_id:
- T1036
- T1036.003
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.md
- https://medium.com/@olafhartong/sysmon-10-0-new-features-and-changes-e82106f2e00
- https://www.group-ib.com/blog/hunting-sidewinder/

id: '14971.22123'
title: Security Software Discovery via WMI
description: 'Adversaries may attempt to get a listing of security software, configurations,
  defensive tools, and sensors that are installed on a system or in a cloud environment.
  This may include things such as firewall rules and anti-virus. Adversaries may use
  the information from Security Software Discovery during automated discovery to shape
  follow-on behaviors, including whether or not the adversary fully infects the target
  and/or attempts specific actions. This use case detects enumeration commands for
  antivirus software using WMI. Atomics Test T1518.001 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  (TERM(wmic) AND TERM(AntiVirusProduct)) | regex process="(?i)\s+AntiVirusProduct\s+"
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:software discovery:security software discovery
technique_id:
- T1518.001
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518.001/T1518.001.md#atomic-test-6---security-software-discovery---av-discovery-via-wmi

id: '39293.71042'
title: Unusual winlogon.exe Child Process
description: Winlogon.exe is a core Windows process that manages secure user authentication
  events, such as logon, logoff, and screen locking. Expected child processes include
  LogonUI.exe for the login screen, FontDrvHost.exe for font rendering in secure sessions,
  Userinit.exe for initializing user settings, Consent.exe for User Account Control
  (UAC) prompts, and Sihost.exe for managing shell experience components like the
  Start menu and taskbar. This use case detects unexpected child processes spawned
  by winlogon.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(winlogon) OR "winlogon.exe" | regex parent_process_name="(?i)winlogon\.exe"|
  regex process_path!="(?i)\x5cWindows\x5cSystem32\x5c(AtBroker|LogonUI|dwm|fontdrvhost|userinit|consent|sihost)\.exe"
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:winlogon helper dll
- privilege-escalation:boot or logon autostart execution:winlogon helper dll
technique_id:
- T1547.004
data_category:
- Windows Sysmon
references:
- https://github.com/tykawaii98/CVE-2024-30088
- https://securityonline.info/poc-exploit-published-for-windows-kernel-elevation-of-privilege-vulnerability-cve-2024-30088/

name: Windows Credentials Access via VaultCli Module
id: c0d89118-3f89-4cd7-8140-1f39e7210681
version: 9
creation_date: '2024-12-02'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects potentially abnormal interactions with VaultCLI.dll, particularly those initiated by processes located in publicly writable Windows folder paths. The VaultCLI.dll module allows processes to extract credentials from the Windows Credential Vault. It was seen being abused by information stealers such as Meduza. The analytic monitors suspicious API calls, unauthorized credential access patterns, and anomalous process behaviors indicative of malicious activity. By leveraging a combination of signature-based detection and behavioral analysis, it effectively flags attempts to misuse the vault for credential theft, enabling swift response to protect sensitive user data and ensure system security.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7  ImageLoaded ="*\\vaultcli.dll" process_path IN("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\appdata\\local\\temp\\*", "*\\PerfLogs\\*", "*:\\temp\\*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_access_via_vaultcli_module_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Third party software might leverage this DLL in order to make use of the Credential Manager feature via the provided exports. Typically the vaultcli.dll module is loaded by the vaultcmd.exe Windows Utility to interact with the Windows Credential Manager for secure storage and retrieval of credentials.
references:
    - https://hijacklibs.net/entries/microsoft/built-in/vaultcli.html
    - https://www.fortinet.com/blog/threat-research/exploiting-cve-2024-21412-stealer-campaign-unleashed
    - https://cert.gov.ua/article/6276652
    - https://cert.gov.ua/article/6281018
    - https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-meduza-f1bbd2efb84f
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of process $process_name$ loading the file $ImageLoaded$ was identified on endpoint $dest$ to potentially capture credentials in memory.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Meduza Stealer
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1555.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Odbcconf Hunting
id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72
version: 9
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of Odbcconf.exe within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the process name is Odbcconf.exe. This activity is significant because Odbcconf.exe can be used by attackers to execute arbitrary commands or load malicious DLLs, potentially leading to code execution or persistence. If confirmed malicious, this behavior could allow an attacker to maintain access to the system, execute further malicious activities, or escalate privileges, posing a significant threat to the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=odbcconf.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_odbcconf_hunting_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will be present as this is meant to assist with filtering and tuning.
references:
    - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
    - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
analytic_story:
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1218.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Registry Entries Exported Via Reg
id: 466379bc-0f47-476c-8202-16ef38112e0d
version: 5
creation_date: '2022-12-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the reg.exe process with either the "save" or "export" parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" or "reg export" command to dump credentials or test registry modification capabilities on compromised hosts. If confirmed malicious, this behavior could allow attackers to escalate privileges, persist in the environment, or access sensitive information stored in the registry.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_reg`
        AND
        Processes.process IN ("* save *", "* export *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_registry_entries_exported_via_reg_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser
    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
analytic_story:
    - Windows Post-Exploitation
    - CISA AA23-347A
    - Prestige Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Schtasks Create Run As System
id: 41a0e58e-884c-11ec-9976-acde48001122
version: 14
creation_date: '2022-02-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new scheduled task using Schtasks.exe to run as the SYSTEM user. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as it often indicates an attempt to gain elevated privileges or maintain persistence within the environment. If confirmed malicious, an attacker could execute code with SYSTEM-level privileges, potentially leading to data theft, ransomware deployment, or further system compromise. Immediate investigation and mitigation are crucial to prevent further damage.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe) Processes.process="*/create *" Processes.process="*/ru *" Processes.process="*system*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
references:
    - https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
    - https://www.ired.team/offensive-security/persistence/t1053-schtask
    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
finding:
    title: An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - Medusa Ransomware
    - Windows Persistence Techniques
    - Qakbot
    - Scheduled Tasks
    - Castle RAT
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Service Create RemComSvc
id: 0be4b5d6-c449-4084-b945-2392b519c33b
version: 10
creation_date: '2023-03-20'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of the RemComSvc service on a Windows endpoint, typically indicating lateral movement using RemCom.exe. It leverages Windows EventCode 7045 from the System event log, specifically looking for the "RemCom Service" name. This activity is significant as it often signifies unauthorized lateral movement within the network, which is a common tactic used by attackers to spread malware or gain further access. If confirmed malicious, this could lead to unauthorized access to sensitive systems, data exfiltration, or further compromise of the network.
data_source:
    - Windows Event Log System 7045
search: |-
    `wineventlog_system` EventCode=7045 ServiceName="RemCom Service"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest ImagePath ServiceName
           ServiceType
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_service_create_remcomsvc_filter`
how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged. The Windows TA for Splunk is also recommended.
known_false_positives: False positives may be present, filter as needed based on administrative activity.
references:
    - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
    - https://github.com/kavika13/RemCom
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A new service was created related to RemCom on $dest$.
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows System Shutdown CommandLine
id: 4fee57b8-d825-4bf3-9ea8-bf405cdb614c
version: 14
creation_date: '2022-07-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the execution of the Windows shutdown command via the command line interface. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because attackers may use the shutdown command to erase tracks, cause disruption, or ensure changes take effect after installing backdoors. If confirmed malicious, this activity could lead to system downtime, denial of service, or evasion of security tools, impacting the overall security posture of the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*") AND Processes.process IN ("* /t*","* -t*","* /f*","* -f*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine.
references:
    - https://attack.mitre.org/techniques/T1529/
    - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Process $process_name$ seen to execute shutdown via commandline on $dest$
analytic_story:
    - XWorm
    - DarkGate Malware
    - NjRAT
    - Quasar RAT
    - Sandworm Tools
    - DarkCrystal RAT
    - MoonPeak
    - Scattered Lapsus$ Hunters
    - ZOVWiper
    - MuddyWater
asset_type: Endpoint
mitre_attack_id:
    - T1529
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint