Splunk rules: 1n

name: Domain Controller Discovery with Nltest
id: 41243735-89a7-4c83-bcdd-570aa78f00a1
version: 14
creation_date: '2021-09-01'
modification_date: '2026-07-20'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. It leverages Endpoint Detection and Response (EDR) data, focusing on process names and command-line arguments. This activity is significant because both Red Teams and adversaries use `nltest.exe` for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out domain controllers, facilitating further attacks such as privilege escalation or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=nltest.exe
            OR
            Processes.original_file_name=nltestrk.exe
        )
        (Processes.process="*/dclist:*" OR Processes.process="*/dsgetdc:*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `domain_controller_discovery_with_nltest_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
finding:
    title: Domain controller discovery on $dest$ by $user$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
    - CISA AA23-347A
    - Medusa Ransomware
    - BlackSuit Ransomware
    - Rhysida Ransomware
    - NetSupport RMM Tool Abuse
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6003.6382'
title: Dump File Identified
description: 'Adversaries may attempt to dump credentials to obtain account login
  and credential material, normally in the form of a hash or a clear text password,
  from the operating system and software. This use case looks command line arguments
  that include a ".dmp" file, which may indicate a dump has teken place or that a
  dmp file is being analyzed locally. -- Threat Actor Association: Cadet Blizzard,
  Redfly - Software Association: Akira, Black Basta, LockBit, Quantum, Rhysida, Vice
  Society'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") TERM(dmp)| regex Process_Command_Line="(?i)\.dmp" | table _time,
  host, user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- credential-access:os credential dumping
technique_id: 
- T1003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass

id: '17741.29790'
title: Full Control Permissions Granted to Everyone - Windows
description: 'Adversaries may modify file or directory permissions/attributes to evade
  access control lists and access protected files. Windows implements file and directory
  ACLs as Discretionary Access Control Lists (DACLs). Adversaries can interact with
  the DACLs using built-in Windows commands which can grant adversaries higher permissions
  on specific files and folders. This use case detects commands assigning full control
  to Everyone which has been observed with Ryuk ransomware. -- Threat Actor Association:
  UNC5812 -- Atomics T1222.001 Test #2 Atomics T1222.001 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(icacls) OR ("/grant" "Everyone:F") | regex process="(?i)\s+\/grant\s+everyone"
  | table _time, host, user parent_*, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222.001
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.logpoint.com/en/blog/ryuk-ransomware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md

name: GitHub Organizations Delete Branch Ruleset
id: 8e454f64-4bd6-45e6-8a94-1b482593d721
version: 10
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rulesets is critical as it could indicate attempts to bypass code review requirements and security controls. Branch rulesets are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
data_source:
    - GitHub Organizations Audit Logs
search: |-
    `github_organizations` vendor_action=repository_ruleset.destroy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_ip,
           actor_is_bot, actor_location.country_code, business,
           business_id, org, org_id,
           repo, repo_id, user_agent,
           vendor_action, ruleset_name
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_organizations_delete_branch_ruleset_filter`
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ deleted a branch ruleset in repo $repo$
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1685
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: GitHub Organizations Disable Classic Branch Protection Rule
id: 33cffee0-41ee-402e-a238-d37825f2d788
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when classic branch protection rules are disabled in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch protection removal events by tracking actor details, repository information, and associated metadata. For a SOC, identifying disabled branch protection is critical as it could indicate attempts to bypass code review requirements and security controls. Branch protection rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
data_source:
    - GitHub Organizations Audit Logs
search: |-
    `github_organizations` vendor_action=protected_branch.destroy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_ip,
           actor_is_bot, actor_location.country_code, business,
           business_id, org, org_id,
           repo, repo_id, user_agent,
           vendor_action, name
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_organizations_disable_classic_branch_protection_rule_filter`
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ disabled a classic branch protection rule in repo $repo$
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
asset_type: GitHub
mitre_attack_id:
    - T1685
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux APT Privilege Escalation
id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the Advanced Package Tool (APT) or apt-get with elevated privileges via sudo on Linux systems. It leverages Endpoint Detection and Response (EDR) telemetry to identify processes where APT commands are executed with sudo rights. This activity is significant because it indicates a user can run system commands as root, potentially leading to unauthorized root shell access. If confirmed malicious, this could allow an attacker to escalate privileges, execute arbitrary commands, and gain full control over the affected system, posing a severe security risk.
data_source:
    - Sysmon for Linux EventID 1
    - Cisco Isovalent Process Exec
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_apt_privilege_escalation_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/apt/
    - https://www.digitalocean.com/community/tutorials/what-is-apt
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Common Process For Elevation Control
id: 66ab15c0-63d0-11ec-9e70-acde48001122
version: 12
creation_date: '2022-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of common Linux processes used for elevation control, such as `chmod`, `chown`, and `setuid`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because these processes are often abused by adversaries to gain persistence or escalate privileges on compromised hosts. If confirmed malicious, this behavior could allow attackers to modify file attributes, change file ownership, or set user IDs, potentially leading to unauthorized access and control over critical system resources.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("chmod", "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr", "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid", "setregid", "chattr")
        OR
        Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid *", "*setregid *", "*setcap *", "*chattr *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_common_process_for_elevation_control_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1548/001/
    - https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297
    - https://github.com/bfuzzy1/auditd-attack/blob/master/auditd-attack/auditd-attack.rules#L269-L270
    - https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml
analytic_story:
    - Linux Persistence Techniques
    - China-Nexus Threat Activity
    - Linux Living Off The Land
    - Salt Typhoon
    - Linux Privilege Escalation
    - Axios Supply Chain Post Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1548.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Data Destruction Command
id: b11d3979-b2f7-411b-bb1a-bd00e642173b
version: 13
creation_date: '2023-02-08'
modification_date: '2026-09-01'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option.
    This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred.
    If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host.
    Immediate investigation and response are crucial to mitigate potential damage.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name = "rm"
    Processes.process = "* --no-preserve-root*"

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `linux_data_destruction_command_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
    These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
    To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions.
    These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
    The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://cert.gov.ua/article/3718487
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The process [$process_name$] was executed with the command [$process$] that allows for the removal of files from the root directory on [$dest$].
analytic_story:
    - AwfulShred
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Find Privilege Escalation
id: 2ff4e0c2-8256-4143-9c07-1e39c7231111
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the 'find' command with 'sudo' and '-exec' options, which can indicate an attempt to escalate privileges on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line arguments. This activity is significant because it can allow a user to execute system commands as root, potentially leading to a root shell. If confirmed malicious, this could enable an attacker to gain full control over the system, leading to severe security breaches and unauthorized access to sensitive data.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*find*"
        AND
        Processes.process="*-exec*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_find_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/find/
    - https://en.wikipedia.org/wiki/Find_(Unix)
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Magic SysRq Key Abuse
id: 22c03600-f84a-47fa-abaa-ffbe3e72c782
version: 5
creation_date: '2025-08-28'
modification_date: '2026-05-13'
author: Milad Cheraghi
status: production
type: TTP
description: |
    Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system.
    Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging.
    Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
    Correlate with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
data_source:
    - Linux Auditd Path
    - Linux Auditd Cwd
search: |
    `linux_auditd`
    (type=PATH OR type=CWD)
    | rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"

    | stats
      values(type) as types
      values(name) as names
      values(nametype) as nametype
      values(cwd) as cwd_list
      values(_time) as event_times
      by audit_id, host

    | eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
    | eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
    | eval matched_paths = mvfilter(match(candidate_paths, ".*/proc/sysrq-trigger|.*/proc/sys/kernel/sysrq|.*/etc/sysctl.conf"))
    | eval match_count = mvcount(matched_paths)
    | eval reconstructed_path = mvindex(matched_paths, 0)
    | eval e_time = mvindex(event_times, 0)
    | where match_count > 0
    | rename host as dest

    | stats count min(e_time) as firstTime max(e_time) as lastTime
      values(nametype) as nametype
      by current_working_directory
         reconstructed_path
         match_count
         dest
         audit_id

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_magic_sysrq_key_abuse_filter`
how_to_implement: |
    To implement this detection, ensure auditd is configured to watch:
      - /proc/sysrq-trigger
      - /proc/sys/kernel/sysrq
      - /etc/sysctl.conf
    with write and attribute changes (`-p wa`) and key `sysrq`. Make sure the type=CWD record type is activate in your auditd configuration and
    Use the Splunk Add-on for Unix and Linux for proper ingestion and CIM normalization.
    This enables effective monitoring of Linux endpoints for SysRq abuse.
known_false_positives: |
    Legitimate administrative activity modifying SysRq for debugging or recovery.
    Please update the filter macros to remove false positives.
references:
    - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel
    - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html
finding:
    title: Abuse of the Linux Magic System Request key detected on host - [$dest$]
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1059.004
    - T1529
    - T1489
    - T1499
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS LoginHook Persistence
id: a04832e7-9d1d-49b1-a684-e31bcd775c77
version: 3
creation_date: '2026-04-14'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Identifies attempts to configure a macOS LoginHook via the defaults utility. LoginHooks enable automatic execution of a script or program upon user login and have historically been abused for persistence.
    Creation or modification of this setting may indicate an attempt to establish startup execution outside standard LaunchAgent mechanisms.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process = "*defaults *"
    Processes.process = "*write*"
    Processes.process = "*loginwindow*"
    Processes.process = "*loginhook*"

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_loginhook_persistence_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://www.loobins.io/binaries/defaults/
finding:
    title: Loginhook created on $dest$ by $user$ via $process$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Loginhook created on $dest$ by $user$ via $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1037.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1010.1013'
title: Meterpreter Reverse Shell
description: 'Detects the Metasploit Meterpreter establishing a reverse shell on a
  target system. This exploit was most commonly used in threats such as the EternalBlue
  exploit and the WannaCry outbreak - Threat Actor Association: APT43, FIN10, Earth
  Estries, Flax Typhoon, Hydrochasma, Kimsuky, Volt Typhoon - Software Association:
  BumbleBee, Clop, Conti, Cuba, Dridex, Entropy, Play, TargetCompany, WannaCry'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` AND ((TERM(EventCode=5156)
  OR "<EventID>5156<") AND TERM(4) AND (TERM("%%14592") OR TERM(inbound)) AND TERM(6)
  AND (TERM("%%14610") OR TERM("Receive/Accept")) AND TERM(44)) OR(TERM(EventCode=5140)
  OR "<EventID>5140<") OR((TERM(EventCode=4625) OR "<EventID>4625<") AND (TERM("%%2313")
  OR TERM("Unknown user name or bad password.")) AND TERM(3) AND TERM(NtLmSsp) AND
  TERM(NTLM))|regex "(?i)(Process ID:(\s+)?4[^\d])|share|ntlm" | table _time, host,
  user dest_ip, dest_port, direction, dvc, dvc_nt_host, event_id, host, index, parent_process_id,
  process, process_id, process_name, process_path, signature_id, source, sourcetype,
  src_ip, src_port, tag, user | transaction dvc startswith="signature_id=5156" maxspan=30s
  | where like(signature_id,"5156") AND like(signature_id,"4625") AND like(signature_id,"5140") '
techniques:
- execution:command and scripting interpreter
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
- lateral-movement:lateral tool transfer
- command-and-control:non-application layer protocol
technique_id:
- T1059
- T1059.001
- T1059.003
- T1570
- T1095
data_category:
- Windows event logs
references:
- https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue

name: Microsoft Defender ATP Alerts
id: 38f034ed-1598-46c8-95e8-14edf05fdf5d
version: 8
creation_date: '2024-10-30'
modification_date: '2026-05-13'
author: Bryan Pluta, Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic is to leverage alerts from Microsoft Defender ATP Alerts. This query aggregates and summarizes all alerts from Microsoft Defender ATP Alerts, providing details such as the source, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk object, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a dynamic mapping to set the risk score in Enterprise Security based on the severity of the alert.
data_source:
    - MS Defender ATP Alerts
search: "`ms_defender_atp_alerts` (dest=* OR user=*)\n  | eval tmp_evidence=json_extract(_raw, \"evidence\"), tmp_evidencemv=json_array_to_mv(tmp_evidence), entityType = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"entityType\")), filePath = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"filePath\")), processCommandLine = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"processCommandLine\")), ipAddress = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"ipAddress\")), registryKey = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"registryKey\")), url = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"url\")), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"fileName\"))\n  | eval tmp_evidencemv=mvfilter(json_extract(tmp_evidencemv, \"entityType\") = \"File\"), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"fileName\"))\n  | eval risk_score=case(severity=\"informational\", 5, severity=\"low\", 15, severity=\"medium\", 25, severity=\"high\", 50 , true(), 2)\n  | eval processCommandLine=if(processCommandLine=\"null\", \"\", processCommandLine), ipAddress=if(ipAddress=\"null\", \"\", ipAddress), registryKey=if(registryKey=\"null\", \"\", registryKey), url=if(url=\"null\", \"\", url)\n  | stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score\n    BY id description src\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `microsoft_defender_atp_alerts_filter`"
how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype.
known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment.
references:
    - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide
    - https://learn.microsoft.com/en-us/graph/api/resources/security-alert?view=graph-rest-1.0
    - https://splunkbase.splunk.com/app/6207
    - https://jasonconger.com/splunk-azure-gdi/
finding:
    title: $severity$ alert for $src$ - $signature$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 50
          message: $severity$ alert for $src$ - $signature$
threat_objects:
    - field: file_name
      type: file_name
    - field: ip_address
      type: ip_address
    - field: process
      type: process_name
    - field: registry_key
      type: registry_path
    - field: url
      type: url
analytic_story:
    - Critical Alerts
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 Compliance Content Search Exported
id: 2ce9f31d-ab4f-4179-b2b7-c77a9652e1d8
version: 12
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies when the results of a content search within the Office 365 Security and Compliance Center are exported. It uses the SearchExported operation from the SecurityComplianceCenter workload in the o365_management_activity data source. This activity is significant because exporting search results can involve sensitive or critical organizational data, potentially leading to data exfiltration. If confirmed malicious, an attacker could gain access to and exfiltrate sensitive information, posing a severe risk to the organization's data security and compliance posture.
data_source: []
search: |-
    `o365_management_activity` Workload=SecurityComplianceCenter Operation="SearchExported"
      | rename user_id as user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
           ExchangeLocations Query
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_compliance_content_search_exported_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Compliance content searche exports may be executed for legitimate purposes, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1114/002/
    - https://learn.microsoft.com/en-us/purview/ediscovery-content-search-overview
    - https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions
    - https://learn.microsoft.com/en-us/purview/ediscovery-search-for-activities-in-the-audit-log
finding:
    title: A new compliance content search export was started by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: O365 Threat Intelligence Suspicious Email Delivered
id: 605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2
version: 12
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies when a suspicious email is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine and delivered to an end user. Attackers may execute several attacks through email, any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData DeliveryAction!=Blocked Directionality=InBound
      | rename P2Sender as src_user, P1Sender as sender, Recipients{} as user, DeliveryAction as action
      | stats values(SenderIp) as src, values(Subject) as subject, values(user) as user, values(action) as action, values(SystemOverrides{}.Details) as reason, values(LatestDeliveryLocation) as result, values(ThreatsAndDetectionTech{}) as category, values(AttachmentData{}.FileName) as file_name, values(AttachmentData{}.FileType) as file_type, values(AttachmentData{}.SHA256) as file_hash values(DetectionMethod) as signature, min(_time) as firstTime max(_time) as lastTime, count
        BY src_user,sender,dest,vendor_account,vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_threat_intelligence_suspicious_email_delivered_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/office-365-ti?view=o365-worldwide
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A suspicious email was delivered to $user$ by $src_user$ matching the $signature$ signature
        - field: src_user
          type: user
          score: 20
          message: A suspicious email was delivered to $user$ by $src_user$ matching the $signature$ signature
threat_objects:
    - field: subject
      type: email_subject
analytic_story:
    - Spearphishing Attachments
    - Suspicious Emails
asset_type: O365 Tenant
mitre_attack_id:
    - T1566.001
    - T1566.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Okta Non-Standard VPN Usage
id: 58eb9f80-896c-42f8-86c6-27ab59026c9c
version: 4
creation_date: '2025-06-12'
modification_date: '2026-05-13'
author: Marissa Bower, Raven Tait
status: experimental
type: TTP
description: Remote Employment Fraud (REF) actors will often use virtual private networks (VPNs) to conceal their true physical location. Threat actors mask their originating IP address and instead appear to be situated in any location where the VPN service has a node.
data_source:
    - Okta
search: '`okta` debugContext.debugData.tunnels IN (*Astrill*,*Azire*,*CyberGhost*,*Express*VPN,*HideMe*, *IPVanish*,*Mullvad*,*Nord*VPN*,*OVPN*,*PIA*VPN*,*Proton*VPN*,*Pure*VPN*,*Slick*VPN*,*Surf*Easy*, *SurfShark*,*Star*VPN*,*TorGuard*,*TorProxy*,*Tiger*VPN*,*TunnelBear*,*Unblock*VPN*,*Warp*VPN*,*WarpSpeed*, *VPNReactor*,*VPN*Shield*,*VPN*Super*VPN*,*ZenMate*) ```listing of commonly used known VPN providers. Add or remove whatever is appropriate for your environment``` | eval user=coalesce(''actor.alternateId'',user), user=mvindex(split(user, "@"), 0) | rename targetUserAlternateId as user client.* as * request.* as * ipChain{}.* as * geographicalContext.* as * debugContext.* as * debugData.* as * | eval status=case(match(_raw, "FAILURE"), "failure", !match(_raw, "FAILURE"), "success") | stats count values(status) as status max(published) as UTC min(_time) as firsttime max(_time) as lasttime values(target_data) as target_data values(displayMessage) as displayMessage values(eventType) as eventType values(city) as city values(country) as country values(action) as action values(src_ip) as src_ip values(outcome.*) as * values(user) as user by tunnels,_time,host sourcetype index | fillnull value="N/A" | convert ctime(*ttime) | `okta_non_standard_vpn_usage_filter`'
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: Limited to no expected false positives once a baseline of common VPN software has been completed.
finding:
    title: Uncommon VPN software used by $user$ to connect to Okta.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Remote Employment Fraud
    - Suspicious Okta Activity
asset_type: Identity
mitre_attack_id:
    - T1078
    - T1572
    - T1090
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Okta ThreatInsight Threat Detected
id: 140504ae-5fe2-4d65-b2bc-a211813fbca6
version: 12
creation_date: '2022-12-19'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies threats detected by Okta ThreatInsight, such as password spraying, login failures, and high counts of unknown user login attempts. It leverages Okta Identity Management logs, specifically focusing on security.threat.detected events. This activity is significant for a SOC as it highlights potential unauthorized access attempts and credential-based attacks. If confirmed malicious, these activities could lead to unauthorized access, data breaches, and further exploitation of compromised accounts, posing a significant risk to the organization's security posture.
data_source:
    - Okta
search: |-
    `okta` eventType = security.threat.detected
      | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY app src_ip dest
           signature eventType displayMessage
           client.device city state
           country user_agent outcome.reason
           outcome.result severity
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `okta_threatinsight_threat_detected_filter`
how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: False positives may occur. It is recommended to fine-tune Okta settings and the analytic to ensure high fidelity. Adjust the risk score as necessary.
references:
    - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
intermediate_findings:
    entities:
        - field: app
          type: system
          score: 20
          message: The following $src_ip$ has been identified as a threat by Okta ThreatInsight. Investigate further to determine if this was authorized.
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Okta Account Takeover
asset_type: Infrastructure
mitre_attack_id:
    - T1078.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '28360.51640'
title: 'Potential CVE-2024-21413: Outbound SMB from Outlook'
description: A critical vulnerability CVE-2024-21413 in Microsoft Outlook, discovered
  by Check Point, enables remote code execution from merely opening an email containing
  malicious links, bypassing Outlook's Protected View. This flaw, exploitable without
  user interaction, allows attackers to perform high-privilege actions and steal NTLM
  credentials via crafted Office documents. This use case detects outbound SMB connections
  from Outlook which may indicate successful CVE-2024-21413 execution.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=5156 OR "<EventID>5156<")
  (TERM(445) OR TERM(SMB)) "outlook.exe" | where match(dest_port, "^445$") and match(process_name,
  "(?i)outlook\.exe") and not match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|fc00:|fd00:|fe80:)")
  | table _time, host, user, dest_ip, dest_port, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:user execution:malicious link
technique_id:
- T1204.001
data_category:
- Windows event logs
- Process use of network
references:
- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/