Splunk rules: 1o

id: '6446.7203'
title: Additional dll added to Spool Driver
description: 'This use case look for an additional dll to the print drivers as seen
  with Print Nightmare CVE-2021-1675. -- Threat Actor Association: Earth Lusca, Vice
  Society - Software Association: Black Basta, Play, Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=316) OR "<EventID>316<")
  TERM(Printer) TERM(driver) TERM(added) TERM(updated) | rex field=_raw max_match=0
  "(?i)(?<driver>\S+.dll)"| eval c_driver=mvcount(driver) | table _time, host, user,
  signature_id, process, process_*, parent_*, signature, c_driver | bin span=1s |
  stats values(*) as * by _time, host | where c_driver > 2 '
techniques:
- persistence:boot or logon autostart execution
technique_id: 
- T1547
data_category:
- Windows event logs
references:
- https://github.com/cube0x0/CVE-2021-1675

id: '21846.38491'
title: CMD execution with _c
description: 'The cmd.exe /c command is used to execute a specific command and then
  terminate the command prompt (CMD) window and is commonly seen in both legitimate
  and malicious scripted processes. Attackers may use /c after commands to avoid detection.
  -- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon - Software Association: DarkGate, Snatch
  -- Atomics T1036 Test #2 Atomics T1059.003 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "cmd.exe" "/c" | regex process="(?i)cmd(\.exe(\"?))?\s+\/c\s+" | table _time, host,
  user, process, process_*, parent_process, parent_process_*, user | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md#atomic-test-2---malware-masquerading-and-execution-from-zip-file
- https://twitter.com/ffforward/status/1481672378639912960

id: '6088.18331'
title: Command Line lsass request
description: 'The memory of lsass.exe is often dumped for credential theft attacks.
  This use case looks for instances of when lsass.exe has been called by powershell.exe
  or cmd.exe -- Threat Actor Association: Alloy Taurus/Gallium, Cadet Blizzard, Flax
  Typhoon, Redfly, Witchetty - Software Association: Blackcat/ALPHV, Clop, Quantum,
  Vice Society -- Atomics T1003.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` TERM(lsass) (TERM(cmd) OR TERM(powershell))
  | table _time, host, user parent_*, process, process_*, signature_id | bin span=5s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping
technique_id: 
- T1003
data_category:
- Windows Sysmon
references:
- https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1

name: Linux File Created In Kernel Driver Directory
id: b85bbeec-6326-11ec-9311-acde48001122
version: 11
creation_date: '2022-01-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of files in the Linux kernel/driver directory. It leverages filesystem data to identify new files in this critical directory. This activity is significant because the kernel/driver directory is typically reserved for kernel modules, and unauthorized file creation here can indicate a rootkit installation. If confirmed malicious, this could allow an attacker to gain high-level privileges, potentially compromising the entire system by executing code at the kernel level.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_path IN ("*/kernel/drivers/*")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `linux_file_created_in_kernel_driver_directory_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can create file in this folders for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
    - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
    - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A file $file_name$ is created in $file_path$ on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Rootkit
asset_type: Endpoint
mitre_attack_id:
    - T1547.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MCP Postgres Suspicious Query
id: 6a168ce8-9a39-4492-9416-a67abdc56c53
version: 3
creation_date: '2026-02-17'
modification_date: '2026-05-13'
author: Rod Soto
status: production
type: Hunting
description: This detection identifies potentially malicious SQL queries executed through MCP PostgreSQL server connections, monitoring for privilege escalation attempts, credential theft, and schema reconnaissance. These patterns are commonly observed in SQL injection attacks, compromised application credentials, and insider threat scenarios targeting database assets.
data_source:
    - MCP Server
search: |
    `mcp_server` method=query direction=inbound
    | eval dest=host
    | eval query_lower=lower('params.query')
    | eval suspicious_query='params.query'
    | eval is_priv_escalation=if(like(query_lower, "%update%users%role%admin%") OR like(query_lower, "%grant%admin%") OR like(query_lower, "%grant%superuser%"), 1, 0)
    | eval is_credential_theft=if(like(query_lower, "%password%") OR like(query_lower, "%credential%") OR like(query_lower, "%api_key%") OR like(query_lower, "%secret%"), 1, 0)
    | eval is_recon=if(like(query_lower, "%information_schema%") OR like(query_lower, "%pg_catalog%") OR like(query_lower, "%pg_tables%") OR like(query_lower, "%pg_user%"), 1, 0)
    | where is_priv_escalation=1 OR is_credential_theft=1 OR is_recon=1
    | eval attack_type=case(
        is_priv_escalation=1, "Privilege Escalation",
        is_credential_theft=1, "Credential Theft",
        is_recon=1, "Schema Reconnaissance",
        1=1, "Unknown")
    | stats count min(_time) as firstTime max(_time) as lastTime values(suspicious_query) as suspicious_queries values(attack_type) as attack_types dc(attack_type) as attack_diversity by dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table dest firstTime lastTime count suspicious_queries attack_types attack_diversity
    | `mcp_postgres_suspicious_query_filter`
how_to_implement: Install the MCP Technology Add-on from https://splunkbase.splunk.com/app/8377 and ensure MCP PostgreSQL server logging is enabled and forwarding to the right index with proper params.query field extraction. Schedule the search to run every 5-15 minutes and configure alerting thresholds based on your environment.
known_false_positives: Legitimate database administrators performing user management tasks, ORM frameworks querying information_schema for schema validation, password reset functionality, and CI/CD pipelines running database migrations.
references:
    - https://splunkbase.splunk.com/app/8377
    - https://www.nodejs-security.com/blog/the-tale-of-the-vulnerable-mcp-database-server
    - https://www.splunk.com/en_us/blog/security/securing-ai-agents-model-context-protocol.html
analytic_story:
    - Suspicious MCP Activities
asset_type: Web Application
mitre_attack_id:
    - T1555
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '8506.10723'
title: Potential Ping Sweep
description: 'Adversaries may attempt to get a listing of other systems by IP address,
  hostname, or other logical identifier on a network that may be used for Lateral
  Movement from the current system. - Threat Actor Association: UNC2596 - Software
  Association: Cuba, Hive - Atomics T1018 Test #4 Atomics T1018 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "ping.exe" | table _time, host, user, signature_id,
  process, process_*, parent_process_* | bin span=60s | stats values(*) as * by _time,
  host | eventstats dc(process) as c_proc by host, _time| where c_proc > 30 AND match(process_name,
  "(?i)ping") '
techniques:
- discovery:remote system discovery
technique_id: 
- T1018
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md#atomic-test-4---remote-system-discovery---ping-sweep

name: Reg exe Manipulating Windows Services Registry Keys
id: 8470d755-0c13-45b3-bd63-387a373c10cf
version: 17
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: TTP
description: The following analytic detects the use of reg.exe to modify registry keys associated with Windows services and their configurations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because unauthorized changes to service registry keys can indicate an attempt to establish persistence or escalate privileges. If confirmed malicious, this could allow an attacker to control service behavior, potentially leading to unauthorized code execution or system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes
      WHERE (Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `reg_exe_manipulating_windows_services_registry_keys_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate.
references: []
finding:
    title: A reg.exe process $process_name$ with commandline $process$ in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A reg.exe process $process_name$ with commandline $process$ in host $dest$
analytic_story:
    - Windows Service Abuse
    - Windows Persistence Techniques
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1574.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: SchCache Change By App Connect And Create ADSI Object
id: 991eb510-0fc6-11ec-82d3-acde48001122
version: 11
creation_date: '2021-09-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects an application attempting to connect and create an ADSI object to perform an LDAP query. It leverages Sysmon EventCode 11 to identify changes in the Active Directory Schema cache files located in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. This activity is significant as it can indicate the presence of suspicious applications, such as ransomware, using ADSI object APIs for LDAP queries. If confirmed malicious, this behavior could allow attackers to gather sensitive directory information, potentially leading to further exploitation or lateral movement within the network.
data_source:
    - Sysmon EventID 11
search: |-
    `sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
        = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe"))
    | stats count min(_time)
        as firstTime max(_time) as lastTime by action dest file_name file_path process_guid
        process_id user_id vendor_product process_name
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `schcache_change_by_app_connect_and_create_adsi_object_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: normal application like mmc.exe and other ldap query tool may trigger this detections.
references:
    - https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac
    - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Process $process_name$ created a file $file_name$ on host $dest$
analytic_story:
    - BlackMatter Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '30388.54742'
title: Suspicious PowerShell Parameter Substring
description: Threat actors may use obfuscated and truncated PowerShell execution arguments
  to evade detection, leveraging PowerShell's parameter binding functionality that
  allows partial matching of command-line arguments. This use case detects process
  executions containing substrings for commonly abused PowerShell parameters.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("cmd.exe" OR "pwsh.exe" OR "powershell.exe") " -windowstyl " OR " -windowsty "
  OR " -windowst " OR " -windows " OR " -windo " OR " -wind " OR " -win " OR " -wi"
  OR ((" -executionpolic " OR " -executionpoli " OR " -executionpol " OR " -executionpo
  " OR " -executionp " OR " -execution " OR " -executio " OR " -executi " OR " -execut
  " OR " -execu " OR " -exec " OR " -exe " OR " -ex") "bypass") OR " -NoPr " OR "
  -NoPro " OR " -NoProf " OR " -NoProfi " OR " -NoProfil " OR " -nonin " OR " -nonint
  " OR " -noninte " OR " -noninter " OR " -nonintera " OR " -noninterac " OR " -noninteract
  " OR " -noninteracti " OR " -noninteractiv " OR " -ec " OR " -encodedComman " OR
  " -encodedComma " OR " -encodedComm " OR " -encodedCom " OR " -encodedCo " OR "
  -encodedC " OR " -encoded " OR " -encode " OR " -encod " OR " -enco " OR " -en "
  OR (" /windowstyle " OR " /windowstyl " OR " /windowsty " OR " /windowst " OR "
  /windows " OR " /windo " OR " /wind " OR " /win " OR " /wi") OR ((" /executionpolic
  " OR " /executionpoli " OR " /executionpol " OR " /executionpo " OR " /executionp
  " OR " /execution " OR " /executio " OR " /executi " OR " /execut " OR " /execu
  " OR " /exec " OR " /exe " OR " /ex") "bypass") OR " /NoPr " OR " /NoPro " OR "
  /NoProf " OR " /NoProfi " OR " /NoProfil " OR " /nonin " OR " /nonint " OR " /noninte
  " OR " /noninter " OR " /nonintera " OR " /noninterac " OR " /noninteract " OR "
  /noninteracti " OR " /noninteractiv " OR " /ec " OR " /encodedComman " OR " /encodedComma
  " OR " /encodedComm " OR " /encodedCom " OR " /encodedCo " OR " /encodedC " OR "
  /encoded " OR " /encode " OR " /encod " OR " /enco " OR " /en" | regex process="(?i)\s(-|\/)(win?d?o?w?s?t?y?l?\s+hi?d?d?e?|windowstyle\s+h\s|NoPro?f?i?l?\s|nonint?e?r?a?c?t?i?v?\s|enc?o?d?e?d?C?o?m?m?a?n?\s|((exe?c?u?t?i?o?n?p?o?l?i?c?)|ep)\s+(bypass)?|ec\s)"
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- Windows Sysmon
references:
- http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
- https://github.com/SigmaHQ/sigma/blob/c0332a9d96f6c7804fcc85dd706caed889446a62/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml

id: '24482.45161'
title: WDigest Forced Credential Caching
description: 'WDigest is a legacy authentication protocol used by Windows, primarily
  for backward compatibility, that stores credentials in memory, potentially allowing
  plaintext password access if enabled. Threat actors may adjust wdigest registry
  values to facilitate credential harvesting. This use case detects commands to modify
  the WDigest registry value. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "add" "\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest"
  "UseLogonCredential" | table _time, host, user signature_id, process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- credential-access:os credential dumping:cached domain credentials
technique_id:
- T1112
- T1003.005
data_category:
- PowerShell logs
references:
- https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- https://blog.talosintelligence.com/lazarus-three-rats/
- https://www.huntress.com/blog/third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack
- https://twitter.com/Purp1eW0lf/status/1735588467092922707/photo/1

id: '38831.69927'
title: WFP Blocked Connection from EDR Agent
description: 'Threat actors may abuse WFP filters to prevent EDR agents from reporting
  security events, as observed with tools like EDRSilencer or EDRNoisemaker. This
  use case detects when the Windows Filtering Platform blocks a connective event involving
  EDR binaries. Windows event 5157 is required for detection. Note: It is highly recommended
  that you specify only the binaries of EDR tools known to be used in your environment.
  This modification will greatly improve rule performance.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5157) OR
  "<EventID>5157<") ("AmSvc.exe" OR "cb.exe" OR "CETASvc.exe" OR "CNTAoSMgr.exe" OR
  "CrAmTray.exe" OR "CrsSvc.exe" OR "CSFalconContainer.exe" OR "CSFalconService.exe"
  OR "CybereasonAV.exe" OR "CylanceSvc.exe" OR "cyserver.exe" OR "CyveraService.exe"
  OR "CyvrFsFlt.exe" OR "EIConnector.exe" OR "elastic-agent.exe" OR "elastic-endpoint.exe"
  OR "EndpointBasecamp.exe" OR "ExecutionPreventionSvc.exe" OR "filebeat.exe" OR "fortiedr.exe"
  OR "hmpalert.exe" OR "hurukai.exe" OR "LogProcessorService.exe" OR "mcsagent.exe"
  OR "mcsclient.exe" OR "MsMpEng.exe" OR "MsSense.exe" OR "Ntrtscan.exe" OR "PccNTMon.exe"
  OR "QualysAgent.exe" OR "RepMgr.exe" OR "RepUtils.exe" OR "RepUx.exe" OR "RepWAV.exe"
  OR "RepWSC.exe" OR "sedservice.exe" OR "SenseCncProxy.exe" OR "SenseIR.exe" OR "SenseNdr.exe"
  OR "SenseSampleUploader.exe" OR "SentinelAgent.exe" OR "SentinelAgentWorker.exe"
  OR "SentinelBrowserNativeHost.exe" OR "SentinelHelperService.exe" OR "SentinelServiceHost.exe"
  OR "SentinelStaticEngine.exe" OR "SentinelStaticEngineScanner.exe" OR "sfc.exe"
  OR "sophosfilescanner.exe" OR "sophosfs.exe" OR "sophoshealth.exe" OR "sophosips.exe"
  OR "sophosLivequeryservice.exe" OR "sophosnetfilter.exe" OR "sophosntpservice.exe"
  OR "sophososquery.exe" OR "sspservice.exe" OR "TaniumClient.exe" OR "TaniumCX.exe"
  OR "TaniumDetectEngine.exe" OR "TMBMSRV.exe" OR "TmCCSF.exe" OR "TmListen.exe" OR
  "TmWSCSvc.exe" OR "Traps.exe" OR "winlogbeat.exe" OR "WSCommunicator.exe" OR "xagt.exe"
  OR "MpCmdRun.exe" OR "MsMpEngCP.exe" OR "CrowdStrikeUI.exe" OR "cbstream.exe" OR
  "cbnetwork.exe" OR "sfcMonitor.exe" OR "sfcService.exe" OR "SophosClean.exe" OR
  "SophosUpdate.exe" OR "SentinelSystemMonitor.exe" OR "SentinelCleanup.exe" OR "mcshield.exe"
  OR "mfemms.exe" OR "updaterui.exe" OR "smc.exe" OR "sepMasterService.exe" OR "avp.exe"
  OR "avpui.exe" OR "cbresponse.exe" OR "cbservices.exe" OR "endpoint-security.exe"
  OR "mbamservice.exe" OR "mbamtray.exe") | regex process_path="(?i)\x5c(AmSvc|cb|CETASvc|CNTAoSMgr|CrAmTray|CrsSvc|CSFalconContainer|CSFalconService|CybereasonAV|CylanceSvc|cyserver|CyveraService|CyvrFsFlt|EIConnector|elastic-agent|elastic-endpoint|EndpointBasecamp|ExecutionPreventionSvc|filebeat|fortiedr|hmpalert|hurukai|LogProcessorService|mcsagent|mcsclient|MsMpEng|MsSense|Ntrtscan|PccNTMon|QualysAgent|RepMgr|RepUtils|RepUx|RepWAV|RepWSC|sedservice|SenseCncProxy|SenseIR|SenseNdr|SenseSampleUploader|SentinelAgent|SentinelAgentWorker|SentinelBrowserNativeHost|SentinelHelperService|SentinelServiceHost|SentinelStaticEngine|SentinelStaticEngineScanner|sfc|sophosfilescanner|sophosfs|sophoshealth|sophosips|sophosLivequeryservice|sophosnetfilter|sophosntpservice|sophososquery|sspservice|TaniumClient|TaniumCX|TaniumDetectEngine|TMBMSRV|TmCCSF|TmListen|TmWSCSvc|Traps|winlogbeat|WSCommunicator|xagt|MpCmdRun|MsMpEngCP|CrowdStrikeUI|cbstream|cbnetwork|sfcMonitor|sfcService|SophosClean|SophosUpdate|SentinelSystemMonitor|SentinelCleanup|mcshield|mfemms|updaterui|smc|sepMasterService|avp|avpui|cbresponse|cbservices|endpoint-security|mbamservice|mbamtray)\.exe"
  | table _time, host, user, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:impair defenses
technique_id: 
- T1562
data_category:
- Windows event logs
references:
- https://github.com/netero1010/EDRSilencer
- https://github.com/amjcyber/EDRNoiseMaker
- https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983
- https://detection.fyi/sigmahq/sigma/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked/
- https://www.huntress.com/blog/silencing-the-edr-silencers

name: Windows Cisco Secure Endpoint Related Service Stopped
id: df74f45f-01c8-4fd6-bcb8-f6a9ea58307a
version: 7
creation_date: '2021-06-04'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
data_source:
    - Windows Event Log System 7036
search: |-
    `wineventlog_system` `normalized_service_binary_field`
      | rename param1 as display_name
      | rename param2 as status
      | search EventCode=7036 display_name IN ("Cisco AMP Orbital", "*Cisco Secure Endpoint*", "*Cisco Security Connector Monitoring*", "CiscoSAM", "CiscoAMPHeurDriver", "CiscoAMPELAMDriver", "CiscoAMPCEFWDriver", "ImmunetNetworkMonitorDriver", "ImmunetProtectDriver", "ImmunetSelfProtectDriver") status IN ("stopped", "arrêté")
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY EventCode display_name normalized_service_name
           status dest
      | `security_content_ctime(lastTime)`
      | `security_content_ctime(firstTime)`
      | `windows_cisco_secure_endpoint_related_service_stopped_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
known_false_positives: Administrator or troubleshooting activities may trigger this alert. Investigate the process performing this action to determine if its a legitimate activity.
references:
    - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
    - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
    - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Cisco Secure Endpoint Service $display_name$ stopped on $dest$
threat_objects:
    - field: display_name
      type: service
analytic_story:
    - Security Solution Tampering
    - Scattered Lapsus$ Hunters
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Credentials from Password Stores Chrome Login Data Access
id: 0d32ba37-80fc-4429-809c-0ba15801aeaf
version: 24
creation_date: '2023-05-02'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data."
    This file is an SQLite database containing sensitive information, including saved passwords.
    The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts.
    This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials.
    If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
data_source:
    - Windows Event Log Security 4663
search: |
    `wineventlog_security`
    EventCode=4663
    object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
    NOT process_path IN (
        "*:\\Windows\\explorer.exe",
        "*:\\Windows\\System32\\dllhost.exe",
        "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe",
        "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe",
        "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe",
        "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe",
        "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe"
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime

      by object_file_name object_file_path
         process_name process_path
         process_id EventCode dest

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_credentials_from_password_stores_chrome_login_data_access_filter`
how_to_implement: |-
    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: |-
    The chrome uninstaller will access these set of files and folders. Filter as needed.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A non-chrome process $process_name$ accessing Chrome "Login Data" file on $dest$
analytic_story:
    - StealC Stealer
    - DarkGate Malware
    - Malicious Inno Setup Loader
    - NjRAT
    - Phemedrone Stealer
    - Salt Typhoon
    - Amadey
    - Earth Alux
    - Warzone RAT
    - Quasar RAT
    - PXA Stealer
    - RedLine Stealer
    - SnappyBee
    - Meduza Stealer
    - Braodo Stealer
    - MoonPeak
    - Snake Keylogger
    - China-Nexus Threat Activity
    - 0bj3ctivity Stealer
    - Lokibot
    - Scattered Lapsus$ Hunters
    - BlankGrabber Stealer
    - VIP Keylogger
    - Salat Stealer
    - Phantom Stealer
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Disable Windows Group Policy Features Through Registry
id: 63a449ae-9f04-11ec-945e-acde48001122
version: 15
creation_date: '2022-03-08'
modification_date: '2026-05-13'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious registry modifications aimed at disabling Windows Group Policy features. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values associated with disabling key Windows functionalities. This activity is significant because it is commonly used by ransomware to hinder mitigation and forensic response efforts. If confirmed malicious, this behavior could severely impair the ability of security teams to analyze and respond to the attack, allowing the attacker to maintain control and persist within the compromised environment.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_windows_group_policy_features_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Disabling these features for legitimate purposes is not a common use case but can still be implemented by the administrators. Filter as needed.
references:
    - https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en
    - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis
    - https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Registry modification to disable windows group policy features on $dest$
analytic_story:
    - Ransomware
    - CISA AA23-347A
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Eventlog Cleared Via Wevtutil
id: fdb829a8-db84-4832-b64b-3e964cd44f01
version: 7
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_eventlog_cleared_via_wevtutil_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$
        - field: user
          type: user
          score: 20
          message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$
analytic_story:
    - Windows Log Manipulation
    - Ransomware
    - Rhysida Ransomware
    - Clop Ransomware
    - CISA AA23-347A
    - ShrinkLocker
asset_type: Endpoint
mitre_attack_id:
    - T1685.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Get-Variable.EXE Execution from WindowsApps Folder
id: 7edb95b6-bccf-4d8c-8ada-d1c5520cf0ed
version: 2
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    An attacker can obtain persistence by hijacking the PowerShell cmdlet 'Get-Variable' by placing Get-Variable.exe in the WindowsApps folder, which is part of the PowerShell path.
    Whenever a PowerShell window is opened via a scheduled task, the malicious Get-Variable.exe will be run.
    This activity was first associated with the Colibri malware.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_path="*\\AppData\\Local\\Microsoft\\WindowsApps\\Get-Variable.exe"

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_get_variable_exe_execution_from_windowsapps_folder_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate administrative tools may use custom executables in the WindowsApps folder for persistence or automation. Verify the executable's origin before flagging to avoid false positives.
references:
    - https://thehackernews.com/2022/04/researchers-uncover-how-colibri-malware.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential Persistence with Get-Variable.exe from WindowsApps Folder activity observed on $dest$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1574.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5708.5980'
title: Windows IPC$ Share Access
description: 'Winndows systems have hidden network shares that are accessible only
  to administrators and provide the ability for remote file copy and other administrative
  functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have
  had an object call. Adversaries may use this technique in conjunction with administrator-level
  Valid Accounts to remotely access a networked system. -- Threat Actor Association:
  TA428, Volt Typhoon -- Atomics T1021.002 Test#1 Atomics T1021.002 Test#2 Atomics
  T1021.002 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5140) OR
  "<EventID>5140<" OR TERM(EventCode=5145) OR "<EventID>5145<") TERM(IPC) | regex
  Share_Name="(?i)ipc\$" | eval share_name=Share_Name, share_path=Share_Path, relative_target_name=Relative_Target_Name
  | table _time, host, user signature_id, share_*, src_ip, relative_target_name |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://support.malwarebytes.com/hc/en-us/articles/360038524714

name: Windows List ENV Variables Via SET Command From Uncommon Parent
id: aec157f4-8783-4584-aca6-754c4dc7fba9
version: 7
creation_date: '2022-10-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies a suspicious process command line fetching environment variables using the cmd.exe "set" command, with a non-shell parent process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and parent process names. This activity could be significant as it is commonly associated with malware like Qakbot, which uses this technique to gather system information. If confirmed malicious, this behavior could indicate that the parent process has been compromised, potentially allowing attackers to execute arbitrary commands, escalate privileges, or persist within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name="cmd.exe" Processes.process IN ("*/c set", "*/c \"set")
        AND
        NOT Processes.parent_process_name IN ("cmd.exe", "explorer.exe", "powershell*" "pwsh.exe")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_list_env_variables_via_set_command_from_uncommon_parent_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: shell process that are not included in this search may cause False positive. Filter as needed.
references:
    - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: non-shell parent process has a child process $process_name$ with a commandline $process$ to fetch env variables on $dest$
analytic_story:
    - Qakbot
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Remote Services Allow Remote Assistance
id: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb
version: 10
creation_date: '2022-06-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications in the Windows registry to enable remote desktop assistance on a targeted machine. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "Control\\Terminal Server\\fAllowToGetHelp" registry path. This activity is significant because enabling remote assistance via registry is uncommon and often associated with adversaries or malware like Azorult. If confirmed malicious, this could allow an attacker to remotely access and control the compromised host, leading to potential data exfiltration or further system compromise.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_remote_assistance_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: administrators may enable or disable this feature that may cause some false positive.
references:
    - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
    - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: the registry for rdp protocol was modified to enable on $dest$
analytic_story:
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1021.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint