Splunk rules: 1m

name: Azure AD Service Principal Created
id: f8ba49e7-ffd3-4b53-8f61-e73974583c5d
version: 11
creation_date: '2022-08-17'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a Service Principal in an Azure AD environment. It leverages Azure Active Directory events ingested through EventHub, specifically monitoring the "Add service principal" operation. This activity is significant because Service Principals can be used by adversaries to establish persistence and bypass multi-factor authentication and conditional access policies. If confirmed malicious, this could allow attackers to maintain single-factor access to the Azure AD environment, potentially leading to unauthorized access to resources and prolonged undetected activity.
data_source:
    - Azure Active Directory Add service principal
search: |-
    `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.user.id=*
      | rename properties.* as *
      | rename targetResources{}.displayName as displayName
      | rename targetResources{}.type as type
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product displayName
           result signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_service_principal_created_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment thorough an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Administrator may legitimately create Service Principal. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
    - https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-8.2.0
    - https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns
    - https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
    - https://attack.mitre.org/techniques/T1136/003/
finding:
    title: Service Principal named $displayName$ created by $user$
    entity:
        field: displayName
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
    - NOBELIUM Group
asset_type: Azure Active Directory
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Change To Safe Mode With Network Config
id: 81f1dce0-0f18-11ec-a5d7-acde48001122
version: 12
creation_date: '2021-09-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a suspicious `bcdedit` command that configures a host to boot in safe mode with network support. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `bcdedit.exe` with specific parameters. This activity is significant because it is a known technique used by BlackMatter ransomware to force a compromised host into safe mode for continued encryption. If confirmed malicious, this could allow attackers to bypass certain security controls, persist in the environment, and continue their malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = bcdedit.exe Processes.process="*/set*" Processes.process="*{current}*"  Processes.process="*safeboot*" Processes.process="*network*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `change_to_safe_mode_with_network_config_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
finding:
    title: bcdedit process with commandline $process$ to force safemode boot the $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: bcdedit process with commandline $process$ to force safemode boot the $dest$
analytic_story:
    - Black Basta Ransomware
    - BlackMatter Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27700.50349'
title: Discovery using CHCP
description: 'CHCP ("Change Code Page" ) is a legitimate Windows command-line utility
  used to display or set the active console''s code page. When run without parameters,
  chcp displays the number of the active console code page, providing information
  about the environment''s locale and language. Threat actors have used been observed
  using chcp during discovery activities during intrusions involving IcedID and Conti
  ransomware. This use case detects chcp executions with no command line parameters
  and a parent process of cmd or PowerShell executed by a non-system account. -- Threat
  Actor Association: APT28 (aka. Fancy Bear, Forest Blizzard, Strontium, Tsar Team)
  -- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("chcp" OR "chcp.com") ("pwsh.exe" OR "powershell.exe"
  OR "cmd.exe") | where match(process_name, "(?i)chcp\.com") and match(process, "(?i)chcp\s+?$")
  and match(parent_process_name, "(?i)(powershell|pwsh|cmd)\.exe") and not match(user,
  "\$$") | table _time, host, user, process, process_*, parent_process_name, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:system location discovery:system language discovery
technique_id:
- T1614.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp

id: '27341.49804'
title: DLL Execution from Uncommon Process
description: During an attack using Ursnif malware, threat actors were observed executing
  DLLs with a renamed rundll32 binary. This use case detects execution of the DLL
  functions DllRegisterServer, DllMain, DllUnregisterServer, DllInstall, or DllCanUnloadNow
  from processes other than rundll32.exe. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ",DllRegisterServer" OR ",DllMain" OR ",DllUnregisterServer" OR
  ",DllInstall" OR ",DllCanUnloadNow" | rex field=process ",(?<dll_function>\S+)"|
  where not match(process, "(?i)rundll32") | table _time, host, user, process, process_*,
  parent_process*, dll_function | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- PowerShell logs
references:
- https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/

name: GetAdGroup with PowerShell Script Block
id: e4c73d68-794b-468d-b4d0-dac1772bbae7
version: 12
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `Get-AdGroup` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet is used to enumerate all domain groups, which adversaries may exploit for situational awareness and Active Directory discovery. Monitoring this activity is crucial as it can indicate reconnaissance efforts within the network. If confirmed malicious, this behavior could lead to further exploitation, such as privilege escalation or lateral movement, by providing attackers with detailed information about the domain's group structure.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*Get-ADGroup*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `getadgroup_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps
analytic_story:
    - Scattered Lapsus$ Hunters
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GetNetTcpconnection with PowerShell
id: e02af35c-1de5-4afe-b4be-f45aba57272b
version: 8
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of `powershell.exe` with the `Get-NetTcpConnection` command, which lists current TCP connections on a system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. Monitoring this activity is significant as it may indicate an adversary or Red Team performing network reconnaissance or situational awareness. If confirmed malicious, this activity could allow attackers to map network connections, aiding in lateral movement or further exploitation within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="powershell.exe"
        )
        (Processes.process=*Get-NetTcpConnection*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getnettcpconnection_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1049/
    - https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1049
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5397.5497'
title: Impacket SMBexec
description: 'Impackets smbexec.py enables users to execute commands or gain an interactive
  shell on a remote host. -- Threat Actor Association: APT28 (aka.Fancy Bear, Fighting
  Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), Cadet Blizzard, Silent Chollima,
  UNC1945, UNC5221, UTA0178 - Software Association: LockBit, Ryuk, Vice Society'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=7045) OR
  "<EventID>7045<") OR (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process))|
  eval service_name=Service_File_Name | where match(process, "\/c.{1,}?\x5c\x5c")
  or match(service_name, "\/c.{1,}?\x5c\x5c") | table _time, host, user signature_id,
  user, dest_host, process_id, process_name, process_path, process, parent_process_id,
  parent_process_name, parent_process_path, event_id, src, service_name | bin span=1s
  | stats values(*) as * by _time, host | where match(signature_id, "4688") and match(signature_id,
  "7045") '
techniques:
- execution:command and scripting interpreter
- execution:system services:service execution
- lateral-movement:remote services:windows remote management
technique_id:
- T1059
- T1569.002
- T1021.006
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py

name: Linux Auditd Hardware Addition Swapoff
id: 5728bb16-1a0b-4b66-bce2-0074ac839770
version: 10
creation_date: '2023-02-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` proctitle = "*swapoff*" AND proctitle = "*-a*"
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_hardware_addition_swapoff_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed.
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to disable the swapping of paging devices on a Linux system.
analytic_story:
    - Data Destruction
    - AwfulShred
    - Compromised Linux Host
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1200
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Hidden Files And Directories Creation
id: 555cc358-bf16-4e05-9b3a-0f89c73b7261
version: 11
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command IN ("*touch *", "*mkdir *", "*vim *", "*vi *", "*nano *") AND execve_command IN ("* ./.*", "* .*", "*/.*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_hidden_files_and_directories_creation_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
    - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$execve_command$] event occurred on host - [$dest$].
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1083
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Private Keys and Certificate Enumeration
id: 892eb674-3344-4143-8e52-4775b1daf3f1
version: 8
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command IN ("*find*", "*grep*") AND execve_command IN ("*.pem*", "*.cer*", "*.crt*", "*.pgp*", "*.key*", "*.gpg*", "*.ppk*", "*.p12*", "*.pfx*", "*.p7b*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_private_keys_and_certificate_enumeration_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
    - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$execve_command$] event occurred on host - [$dest$] to find private keys.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1552.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Deletion Of Cron Jobs
id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8
version: 12
creation_date: '2022-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the deletion of cron jobs on a Linux machine. It leverages filesystem event logs to identify when files within the "/etc/cron.*" directory are deleted. This activity is significant because attackers or malware may delete cron jobs to disable scheduled security tasks or evade detection mechanisms. If confirmed malicious, this action could allow an attacker to disrupt system operations, evade security measures, or facilitate further malicious activities such as data wiping, as seen with the acidrain malware.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=deleted Filesystem.file_path="/etc/cron.*"
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_deletion_of_cron_jobs_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Linux cron jobs are deleted on host $dest$ by process GUID- $process_guid$
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - AcidRain
    - Data Destruction
    - AcidPour
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6589.7619'
title: NTDSUtil.exe execution
description: 'ntdsutil.exe is a native Windows command line utility used to export
  Active Directory. Adversaries can utilize ntdsutil to potential dump credentials
  from files like ntds.dit. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
  Threat Actor Association: APT29/Nobelium/Cozy Bear, CL-STA-0043, FIN6, FIN12, Lapsus$,
  TA428, Trickbot, Vice Society, Volt Typhoon, Wizard Spider Software Association:
  ALPHV/BlackCat, Bazar, BianLian, Conti, Hafnium, Lockbit, Prestige, Vice Society
  -- Atomics T1003.003 Test #3 -- #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") "ntdsutil" | table _time, host, user user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:os credential dumping
technique_id:
- T1003.003
- T1003
data_category:
- Windows event logs
references:
- https://adsecurity.org/?p=2398#CreateIFM
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Ntdsutil/#dump

name: O365 SharePoint Suspicious Search Behavior
id: 6ca919db-52f3-4c95-a4e9-7b189e8a043d
version: 7
creation_date: '2025-01-08'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a SharePoint site within a limited timeframe. This behavior may indicate that a malicious actor has gained control of a user account and is conducting discovery or enumeration activities.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` (Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search*) OR Operation=SearchQueryInitiatedSharepoint
    | eval command = case(Operation=="SearchQueryPerformed",SearchQueryText,true(),QueryText), UserId = lower(UserId), signature_id = CorrelationId, signature=Operation, src = ClientIP, user = lower(UserId), object_name=case(Operation=="SearchQueryPerformed",'EventData',true(),QuerySource), -time = _time, suspect_terms = case(match(command, `o365_suspect_search_terms_regex`),command,true(),null())
    | where command != "*" AND command != "(*)"
    | bin _time span=1hr
    | stats values(ScenarioName) as app, values(object_name) as object_name values(command) as command, values(suspect_terms) as suspect_terms, values(src) as src, dc(suspect_terms) as suspect_terms_count, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time
    | where count > 20 OR suspect_terms_count >= 2
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_sharepoint_suspicious_search_behavior_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds and match terms set within the analytic are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
known_false_positives: Users searching excessively or possible false positives related to matching conditions.
references:
    - https://learn.microsoft.com/en-us/purview/audit-get-started#step-3-enable-searchqueryinitiated-events
    - https://www.cisa.gov/sites/default/files/2025-01/microsoft-expanded-cloud-logs-implementation-playbook-508c.pdf
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
    - https://attack.mitre.org/techniques/T1213/002/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ searched SharePoint suspiciously, $count$ unique terms and $suspect_terms_count$ suspect terms were searched within a limited timeframe.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
    - Office 365 Collection Techniques
    - Compromised User Account
    - CISA AA22-320A
asset_type: O365 Tenant
mitre_attack_id:
    - T1213.002
    - T1552
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Potential System Network Configuration Discovery Activity
id: 3f0b95e3-3195-46ac-bea3-84fb59e7fac5
version: 9
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity can be significant as it may indicate an attacker attempting to map the network, which is a common precursor to lateral movement or further exploitation. If confirmed malicious, this behavior could allow an attacker to gain insights into the network topology, identify critical systems, and plan subsequent attacks, potentially leading to data exfiltration or system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count values(Processes.process) as process
            values(Processes.parent_process) as parent_process
            min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where

    NOT Processes.user IN ("","unknown")

    by Processes.action Processes.dest Processes.original_file_name
    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
    Processes.user Processes.user_id Processes.vendor_product _time

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name(Processes)`
    | search process_name IN (
              "arp.exe",
              "dsquery.exe",
              "hostname.exe",
              "ipconfig.exe",
              "nbstat.exe",
              "net.exe",
              "net1.exe",
              "nltest.exe",
              "netsh.exe",
              "nslookup.exe",
              "ping.exe",
              "quser.exe",
              "qwinsta.exe",
              "telnet.exe",
              "tracert.exe",
            )
    | transaction dest connected=false maxpause=5m
    | where eventcount>=5
    | `potential_system_network_configuration_discovery_activity_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Unusual Processes
asset_type: Endpoint
mitre_attack_id:
    - T1016
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20185.35853'
title: Registry Entry Created - PowerShell
description: 'Adversaries may interact with the Windows Registry to hide configuration
  information within Registry keys, remove information as part of cleaning up, or
  as part of other techniques to aid in persistence and execution. This use case detects
  PowerShell scripts or commands creating new registry entries. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ((EventCode=4104) OR "<EventID>4104<"
  OR (EventCode=4103) OR "<EventID>4103<") (TERM(New-Item) OR TERM(New-ItemProperty)
  OR TERM(Set-ItemProperty) OR TERM(sp) OR TERM(Set-Item) OR TERM(sip)) ("HKCU" OR
  "HKLM" OR "HKU" OR "HKEY_") | regex process="(?i)((New|Set)-Item(Property?)|sp|sip)\s+(-Path\s+?)(\"(HKCU|HKLM|HKU|HKEY_))"|
  table _time, host, user user, process, process_name | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- PowerShell logs
references:
- https://blog.sygnia.co/breaking-down-casbaneiro-infection-chain-part2?_ga=2.66949422.1638613298.1690290265-1923873697.1682517767
- https://gist.github.com/netbiosX/a114f8822eb20b115e33db55deee6692

name: Windows Group Policy Object Created
id: 23add2a8-ea22-4fd4-8bc0-8c0b822373a1
version: 12
creation_date: '2023-03-28'
modification_date: '2026-05-13'
author: Mauricio Velazco
status: production
type: TTP
description: The following analytic detects the creation of a new Group Policy Object (GPO) by leveraging Event IDs 5136 and 5137. This detection uses directory service change events to identify when a new GPO is created. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, leading to widespread compromise and significant operational disruption.
data_source:
    - Windows Event Log Security 5136
    - Windows Event Log Security 5137
search: |-
    `wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath) ) ObjectClass=groupPolicyContainer
      | stats values(AttributeValue) as details values(SubjectUserSid) as User values(ObjectDN) as ObjectDN
        BY ObjectGUID Computer dest
      | eval GPO_Name = mvindex(details, 0)
      | eval GPO_Path = mvindex(details, 1)
      | fields - details
      | `windows_group_policy_object_created_filter`
how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
known_false_positives: Group Policy Objects are created as part of regular administrative operations, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1484/
    - https://attack.mitre.org/techniques/T1484/001
    - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
    - https://adsecurity.org/?p=2716
    - https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/
    - https://www.varonis.com/blog/group-policy-objects
finding:
    title: A new group policy objected was created by $User$
    entity:
        field: User
        type: user
        score: 50
analytic_story:
    - Active Directory Privilege Escalation
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1078.002
    - T1484.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Identify PowerShell Web Access IIS Pool
id: d8419343-f0f8-4d8e-91cc-18bb531df87d
version: 5
creation_date: '2024-09-30'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: This analytic detects and analyzes PowerShell Web Access (PSWA) usage in Windows environments. It tracks both connection attempts (EventID 4648) and successful logons (EventID 4624) associated with PSWA, providing a comprehensive view of access patterns. The analytic identifies PSWA's operational status, host servers, processes, and connection metrics. It highlights unique target accounts, domains accessed, and verifies logon types. This information is crucial for detecting potential misuse, such as lateral movement, brute force attempts, or unusual access patterns. By offering insights into PSWA activity, it enables security teams to quickly assess and investigate potential security incidents involving this powerful administrative tool.
data_source:
    - Windows Event Log Security 4648
search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4625) SubjectUserName="pswa_pool" | fields EventCode, SubjectUserName, TargetUserName, Computer, TargetDomainName, ProcessName, LogonType | rename Computer as dest | stats count(eval(EventCode=4648)) as "Connection Attempts", count(eval(EventCode=4624)) as "Successful Logons", count(eval(EventCode=4625)) as "Unsuccessful Logons", dc(TargetUserName) as "Unique Target Accounts", values(dest) as "PSWA Host", dc(TargetDomainName) as "Unique Target Domains", values(ProcessName) as "PSWA Process", values(TargetUserName) as "Target Users List", values(TargetServerName) as "Target Servers List", values(LogonType) as "Logon Types" | eval PSWA_Running = "Yes", "PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1) | fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types" | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_identify_powershell_web_access_iis_pool_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event logs, specifically Event ID 4648 (A logon was attempted using explicit credentials). Ensure that your Windows systems are configured to audit logon events and that these logs are being forwarded to your SIEM or log management solution. You may need to enable advanced audit policy settings in Windows to capture these events. Additionally, make sure that your environment is set up to capture the necessary fields such as SubjectUserName, TargetUserName, Computer, TargetServerName, and ProcessName from these events. If you're using Splunk, ensure that you have the appropriate Windows TA installed and configured to collect these security logs.
known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
    - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
analytic_story:
    - CISA AA24-241A
asset_type: Endpoint
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry DontShowUI
id: 4ff9767b-fdf2-489c-83a5-c6c34412d72e
version: 11
creation_date: '2022-07-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows Error Reporting registry key "DontShowUI" to suppress error reporting dialogs. It leverages data from the Endpoint datamodel's Registry node to identify changes where the registry value is set to 0x00000001. This activity is significant as it is commonly associated with DarkGate malware, which uses this modification to avoid detection during its installation. If confirmed malicious, this behavior could allow attackers to maintain a low profile, avoiding user alerts and potentially enabling further malicious activities without user intervention.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI"  Registry.registry_value_data = 0x00000001 by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_dontshowui_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
finding:
    title: the registry for WER settings was modified to be disable show UI on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry With MD5 Reg Key Name
id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8
version: 12
creation_date: '2023-09-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects potentially malicious registry modifications characterized by MD5-like registry key names. It leverages the Endpoint data model to identify registry entries under the SOFTWARE path with 32-character hexadecimal names, a technique often used by NjRAT malware for fileless storage of keylogs and .DLL plugins. This activity is significant as it can indicate the presence of NjRAT or similar malware, which can lead to unauthorized data access and persistent threats within the environment. If confirmed malicious, attackers could maintain persistence and exfiltrate sensitive information.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly`  count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where  Registry.registry_path = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | eval dropped_reg_path = split(registry_path, "\\") | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") | where validation_result = "md5" AND dropped_reg_path_split_count <= 5 | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_with_md5_reg_key_name_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: No false positives have been identified at this time.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
finding:
    title: A md5 registry value name $registry_value_name$ is created on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - NjRAT
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows New Service Security Descriptor Set Via Sc.EXE
id: cde00c31-042a-4307-bf70-25e471da56e9
version: 10
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Michael Haag, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects changes in a service security descriptor.
    It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for any process execution involving the "sc.exe" binary with the "sdset" flag targeting any service.
    This behavior can be legitimate, such as when a user or administrator is configuring a service's security settings.
    Investigate appropariate services to determine if the behavior is malicious.
    If confirmed malicious, this could allow an attacker to escalate their privileges, blind defenses and more.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(Processes.process) as process

    FROM datamodel=Endpoint.Processes WHERE
    (
        Processes.process_name=sc.exe
        OR
        Processes.original_file_name=sc.exe
    )
    Processes.process="*sdset *"
    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_new_service_security_descriptor_set_via_sc_exe_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    - False positives are expected from legitimate system administrator scripts or installation utilities. Filter known parent image and commandline combinations.
references:
    - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
    - https://news.sophos.com/wp-content/uploads/2020/06/glupteba_final-1.pdf
    - https://attack.mitre.org/techniques/T1564/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to change the security descriptor of a service on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to change the security descriptor of a service on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Defense Evasion or Unauthorized Access Via SDDL Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1564
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint