Splunk rules: 1p

name: Allow Network Discovery In Firewall
id: ccd6a38c-d40b-11eb-85a5-acde48001122
version: 14
creation_date: '2021-06-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a suspicious modification to the firewall to allow network discovery on a machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving the 'netsh' command to enable network discovery. This activity is significant because it is commonly used by ransomware, such as REvil and RedDot, to discover and compromise additional machines on the network. If confirmed malicious, this could lead to widespread file encryption across multiple hosts, significantly amplifying the impact of the ransomware attack.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_netsh` Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*"  Processes.process="*enable*" Processes.process="*Yes*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `allow_network_discovery_in_firewall_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered.
references:
    - https://community.fortinet.com:443/t5/FortiEDR/How-FortiEDR-detects-and-blocks-Revil-Ransomware-aka-sodinokibi/ta-p/189638?externalID=FD52469
    - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
finding:
    title: Suspicious modification to the firewall to allow network discovery detected on host - $dest$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - BlackByte Ransomware
    - NjRAT
    - Revil Ransomware
    - Ransomware
    - Medusa Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1686.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco Configuration Archive Logging Analysis
id: f52d5c0b-d45d-4304-b300-a4f6a1130dec
version: 5
creation_date: '2025-08-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: Hunting
description: This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. Configuration archive logging captures all changes made to a device's configuration, providing a detailed audit trail that can be used to identify suspicious or malicious activities. This detection is particularly valuable for identifying patterns of malicious configuration changes that might indicate an attacker's presence, such as the creation of backdoor accounts, SNMP community string modifications, and TFTP server configurations for data exfiltration. By analyzing these logs, security teams can gain a holistic view of configuration changes across sessions and users, helping to detect sophisticated attack campaigns like those conducted by threat actors such as Static Tundra.
data_source:
    - Cisco IOS Logs
search: |-
    | tstats `security_content_summariesonly` count values(All_Changes.command) as commands min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
      WHERE (
            (All_Changes.command="*username*privilege 15*")
            OR
            (All_Changes.command="*username*password*")
            OR
            (All_Changes.command="*USER TABLE MODIFIED*")
            OR
            (All_Changes.command="*tftp-server*")
            OR
            (All_Changes.command="*snmp-server community*")
        )
      BY All_Changes.dvc All_Changes.user
    | `drop_dm_object_name("All_Changes")`
    | rename dvc as dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_configuration_archive_logging_analysis_filter`
how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel. Ensure that your Cisco IOS devices are configured to send logs to your Splunk environment, with configuration archive logging enabled. On Cisco devices, enable archive logging with the commands "archive" and "log config" in global configuration mode. Configure command logging with "archive log config logging enable" and ensure that the appropriate logging levels are set with "logging trap informational". The detection looks for patterns of suspicious configuration changes across sessions, focusing on account creation, SNMP modifications, and TFTP server configurations.
known_false_positives: Legitimate configuration changes during routine maintenance or device setup may trigger this detection, especially when multiple related changes are made in a single session. Network administrators often make several configuration changes in sequence during maintenance windows. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames and scheduled maintenance windows. The detection includes a threshold (count > 2) to filter out isolated configuration changes, but this threshold may need to be adjusted based on your environment's normal activity patterns.
references:
    - https://blog.talosintelligence.com/static-tundra/
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
    - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-mt/config-mgmt-15-mt-book/cm-config-logger.html
analytic_story:
    - Cisco Smart Install Remote Code Execution CVE-2018-0171
asset_type: Network
cve:
    - CVE-2018-0171
mitre_attack_id:
    - T1685
    - T1098
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '1035.1045'
title: Common Reconnaissance Commands
description: 'These are reconnaissance commands that are most commonly used by attackers
  in order to collect information after gaining a access to the machine. -- Threat
  Actor Association: AbcBot, Alloy Taurus/Gallium, Andariel, APT27/Emissary Panda,
  APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM),
  APT29/Nobelium/Cozy Bear, APT33, APT35/Phosphorus/Magic Hound, APT36, APT43, Carbanak,
  FamousSparrow, FIN6, FIN7, FIN8, FIN12, FIN13, Gorgon Group, Kimsuky, MuddyWater,
  OilRig, SaintBear (aka UAC-0056, UNC2589, TA471), TA428, TA2541, TRAVELING SPIDER,
  UAC-0056, Volt Typhoon (Bronze Silhouette, Vanguard Panda), Winter Vivern, Wizard
  Spider -- Software Association: AvosLocker, BadHatch, Bazarloader, BianLian, Black
  Basta, Blackcat/ALPHV, Clop, Conti, Cyclops Blink, Emotet, GhostShell, Hancitor,
  Havex, IcedID, Insekt, Lockbit, NanoCore, Nefilim, PowerShortShell, Prometheus /
  Spook, PYSA/Mespinoza, QakBot, Remcos, Ryuk, Snatch, Sodinokibi/REvil, Trickbot,
  Vice Society, XingLocker -- Atomics T1007 Test#1 Atomics T1007 Test#2 Atomics T1016
  Test#1 Atomics T1016 Test#2 Atomics T1016 Test#3 Atomics T1016 Test#4 Atomics T1016
  Test#7 Atomics T1018 Test#1 Atomics T1018 Test#2 Atomics T1018 Test#3 Atomics T1018
  Test#5 Atomics T1018 Test#6 Atomics T1018 Test#8 Atomics T1518.001 Test#1 Atomics
  T1571 Test#1 Atomics T1033 Test #1 Atomics T1087.001 Test #4 Atomics T1087.001 Test
  #5 Atomics T1087.001 Test #6 Atomics T1087.001 Test #7 Atomics T1087.001 Test #8
  Atomics T1087.001 Test #9 Atomics T1087.001 Test #10 Atomics T1201 Test #5 Atomics
  T1201 Test #6'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("whoami.exe" OR "systeminfo.exe" OR "HOSTNAME.EXE"
  OR "ipconfig.exe" OR "route.exe" OR "arp.exe" OR "netstat.exe" OR "netsh.exe" OR
  "tasklist.exe" OR "driverquery.exe" OR "qprocess.exe" OR "query.exe" OR "nslookup.exe"
  OR "tracert.exe" OR "net.exe" OR "nltest.exe" OR "qwinsta.exe" OR "quser" OR "cmdkey.exe")
  | where ((match(process,"(?i)((whoami)|(dir)|(hostname)|(hostname)|(systeminfo)|(ipconfig)|(route)|(arp)|(nltest)|(qwinsta))($|\s)")
  OR match(process,"(?i)((netstat)|(netsh)|(schtasks)|(tasklist)|(driverquery)|(qprocess)|(nslookup)|(quser)|(cmdkey))($|\s)")
  OR match(process,"(?i)((tracert)|(query)|(net\s+((localgroup)|(group)|(config)|(share)|(use)|(user)|(view))))($|\s)"))
  OR (match(process_name,"(?i)((whoami)|(dir)|(hostname)|(hostname)|(systeminfo)|(ipconfig)|(route)|(arp)|(nltest)|(qwinsta))")
  OR match(process_name,"(?i)((netstat)|(netsh)|(schtasks)|(tasklist)|(driverquery)|(qprocess)|(nslookup)|(quser))")
  OR match(process_name,"(?i)((tracert)|(query)|(net\s+((localgroup)|(group)|(config)|(share)|(use)|(user)|(view))))")))
  | table _time, host, user process, process_*, parent_process, parent_process_*,
  src_*, dest_* | bin span=60s | stats values(*) as * by _time, host, user | streamstats
  dc(process_name) as dc_process_name by _time, host | where dc_process_name>2 '
techniques:
- discovery:system owner/user discovery
- execution:command and scripting interpreter
- discovery:account discovery:local account
- discovery:process discovery
- discovery:system information discovery
- discovery:system service discovery
- execution:command and scripting interpreter:unix shell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1033
- T1059
- T1087.001
- T1057
- T1082
- T1007
- T1059.003
- T1059.004
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://capec.mitre.org/data/definitions/577.html
- https://www.programmersought.com/article/71384528057/

name: Disable Windows App Hotkeys
id: 1490f224-ad8b-11eb-8c4f-acde48001122
version: 17
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values indicative of this behavior. This activity is significant as it can impair an analyst's ability to use essential tools like Task Manager and Command Prompt, hindering incident response efforts. If confirmed malicious, this technique can allow an attacker to maintain persistence and evade detection, complicating the remediation process.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
finding:
    title: Disabled 'Windows App Hotkeys' on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - XMRig
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '22209.39127'
title: Domain Trust Discovery Commands - Windows
description: 'Adversaries may attempt to gather information on domain trust relationships
  that may be used to identify lateral movement opportunities in Windows multi-domain/forest
  environments. This use case detects executions of domain trust discovery commands
  used with nltest.exe. nltest.exe is not included in the detection to account for
  instances where nltest.exe has been renamed. -- Software Association: Play -- Atomics
  T1482 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("/domain_trusts" OR "/trusted_domains") | table
  _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:domain trust discovery
technique_id: 
- T1482
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest

name: File Download or Read to Pipe Execution
id: 26f86252-1549-45e1-a212-eb26840e86bc
version: 6
creation_date: '2025-10-24'
modification_date: '2026-09-01'
author: Michael Haag, Nasreddine Bencherchali, Splunk, DipsyTipsy
status: production
type: TTP
description: |
    The following analytic detects the use of download or file reading utilities from Windows, Linux or MacOS to download or read the contents of a file from a remote or local source and pipe it directly to a shell for execution.
    This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions.
    This activity is significant as it is commonly associated with malicious actions like coinminers and exploits such as CVE-2021-44228 in Log4j.
    If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.
data_source:
    - Sysmon EventID 1
    - Sysmon for Linux EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime

    from datamodel=Endpoint.Processes where

    ``` This aims to cover download utilities and file reading ones ```

    Processes.process IN (
      "*.DownloadFile(*",
      "*.DownloadString(*",
      "*ASCII.GetString*",
      "*bitsadmin*",
      "*certutil*",
      "*curl*",
      "*Invoke-RestMethod*",
      "*Invoke-WebRequest*",
      "*irm*",
      "*iwr *",
      "*mshta*",
      "*wget*"
    )

    Processes.process IN ("*|*")

    (
      ``` Linux / MacOS ```
      Processes.process IN (
        "*bash*",
        "*csh*",
        "*dash*",
        "*fish*",
        "*ksh*",
        "*rbash*",
        "*tcsh*",
        "*zsh*"
      )
      OR
      ``` Because the "sh" string can overlap and is a short atom we treat it in a special case ```
      Processes.process IN (
        "*|sh*"
        "* sh*"
      )
      OR
      ``` Windows ```
      Processes.process IN ("*IEX*", "*Invoke-Expression*")
    )

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `file_download_or_read_to_pipe_execution_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    False positives should be limited, however filtering may be required.
references:
    - https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
    - https://github.com/MHaggis/notes/blob/master/utilities/warp_pipe_tester.py
    - https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
    - https://www.lunasec.io/docs/blog/log4j-zero-day/
    - https://securelist.com/bad-magic-apt/109087/
finding:
    title: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$].
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$].
threat_objects:
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
    - Ingress Tool Transfer
    - Linux Living Off The Land
    - Log4Shell CVE-2021-44228
    - NPM Supply Chain Compromise
asset_type: Endpoint
cve:
    - CVE-2021-44228
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5370.5481'
title: Impacket_Empire's WMIExec
description: 'Impackets wmiexec.py enables users to execute commands or gain an interactive
  shell on a remote host. -- Threat Actor Association: APT28 (aka.Fancy Bear, Fighting
  Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT35/Phosphorus/Magic Hound,
  Cadet Blizzard, FIN8, Stonefly, UNC5221, UTA0178, Volt Typhoon - Software Association:
  ALPHV/Blackcat, BadHatch, Play, LockBit, Prestige, PYSA/Mespinoza, Vice Society'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4688) AND
  (TERM(powershell.exe) OR TERM(cmd.exe)) AND "NT AUTHORITY\\NETWORK SERVICE" | table
  _time, host, user parent_process_id, parent_process_name, parent_process_path, process,
  process_id, process_name | bin span=1s | stats values(*) as * by _time, host | where
  match(process,"(?i)powershell\.exe") OR match(process,"(i?)cmd\.exe") '
techniques:
- execution:command and scripting interpreter:powershell
- execution:windows management instrumentation
technique_id:
- T1059.001
- T1047
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py

id: '20231.35922'
title: ISO Image Mounted - Windows
description: 'Threat actors such as APT29 have used ISO files to deliver malicious
  code to target systems. Normally, when a file is downloaded from the internet, Windows
  adds a Zone Identifier to identify the file''s origin (known as mark-of-the-web
  or MOTW). Files stored with an ISO do not contain the Zone Identifier Alternate
  Data Stream, enabling MOTW bypass. This use case detects ISO images mounted on Windows
  systems. -- Threat Actor Association: Lazarus -- Atomics T1553.005 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(Mount-DiskImage
  OR TERM(mdisk)) | table _time, host, user, process, process_*, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:subvert trust controls:mark-of-the-web bypass
- execution:user execution:malicious file
technique_id:
- T1553.005
- T1204.002
data_category:
- PowerShell logs
references:
- https://www.mandiant.com/resources/blog/tracking-apt29-phishing-campaigns
- https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming
- https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image

name: Linux High Frequency Of File Deletion In Boot Folder
id: e27fbc5d-0445-4c4a-bc39-87f060d5c602
version: 12
creation_date: '2022-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a high frequency of file deletions in the /boot/ folder on Linux systems. It leverages filesystem event logs to identify when 200 or more files are deleted within an hour by the same process. This behavior is significant as it may indicate the presence of wiper malware, such as Industroyer2, which targets critical system directories. If confirmed malicious, this activity could lead to system instability or failure, hindering the boot process and potentially causing a complete system compromise.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` values(Filesystem.file_access_time) as file_access_time values(Filesystem.file_create_time) as file_create_time values(Filesystem.file_hash) as file_hash values(Filesystem.file_modify_time) as file_modify_time values(Filesystem.file_name) as file_name values(Filesystem.file_path) as file_path  values(Filesystem.file_acl) as file_acl values(Filesystem.file_size) as file_size values(Filesystem.process_id) as process_id values(Filesystem.user) as user values(Filesystem.vendor_product) as vendor_product dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=deleted Filesystem.file_path = "/boot/*"
      BY _time span=1h Filesystem.dest
         Filesystem.process_guid Filesystem.action
    | `drop_dm_object_name(Filesystem)`
    | where  numOfDelFilePath >= 200
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: linux package installer/uninstaller may cause this event. Please update you filter macro to remove false positives.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://cert.gov.ua/article/39518
finding:
    title: Multiple files detection in /boot/ folder on $dest$ by process GUID -  $process_guid$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Data Destruction
    - Industroyer2
    - AcidPour
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: M365 Copilot Session Origin Anomalies
id: 0caf1c1c-0fba-401e-8ec7-f07cfdeee75b
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: production
type: Anomaly
description: Detects M365 Copilot users accessing from multiple geographic locations to identify potential account compromise, credential sharing, or impossible travel patterns. The detection aggregates M365 Copilot Graph API events per user, calculating distinct cities and countries accessed, unique IP addresses, and the observation timeframe to compute a locations-per-day metric that measures geographic mobility. Users accessing Copilot from more than one city (cities_count > 1) are flagged and sorted by country and city diversity, surfacing accounts exhibiting anomalous geographic patterns that suggest compromised credentials being used from distributed locations or simultaneous access from impossible travel distances.
data_source:
    - M365 Copilot Graph API
search: |-
    `m365_copilot_graph_api` (appDisplayName="*Copilot*" OR appDisplayName="M365ChatClient" OR appDisplayName="OfficeAIAppChatCopilot")
      | eval user = userPrincipalName
      | stats count as events, dc(location.city) as cities_count, values(location.city) as city_list, dc(location.countryOrRegion) as countries_count, values(location.countryOrRegion) as country_list, dc(ipAddress) as ip_count, values(ipAddress) as ip_addresses, min(_time) as first_seen, max(_time) as last_seen
        BY user
      | eval days_active = round((last_seen - first_seen)/86400, 1)
      | eval locations_per_day = if(days_active > 0, round(cities_count/days_active, 2), cities_count)
      | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S")
      | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M:%S")
      | where cities_count > 1
      | sort -countries_count, -cities_count
      | `m365_copilot_session_origin_anomalies_filter`
how_to_implement: This detection requires ingesting M365 Copilot access logs via the Splunk Add-on for Microsoft Office 365. Configure the add-on to collect Azure AD Sign-in logs (AuditLogs.SignIns) through the Graph API data input. Ensure proper authentication and permissions are configured to access sign-in audit logs. The `m365_copilot_graph_api` macro should be defined to filter for sourcetype o365:graph:api data containing Copilot application activity.
known_false_positives: Legitimate business travelers, remote workers using VPNs, users with corporate offices in multiple locations, or employees accessing Copilot during international travel may trigger false positives.
references:
    - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ accessed M365 Copilot from multiple geographic locations, indicating potential account compromise or credential sharing.
analytic_story:
    - Suspicious Microsoft 365 Copilot Activities
asset_type: Web Application
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '6847.8062'
title: Msiexec Abuse
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). This use case looks for
  msiexec launching filetypes other than ".msi" Software Association: Raspberry Robin,
  Zloader Atomics T1218.007 Test #9 Atomics T1218.007 Test #10'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(msiexec) NOT ".msi" | regex process="(?i)msiexec.*?\.\w{2,5}"|
  table _time, host, user parent_*, process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | eventstats dc(process) as dc_process by
  host | where dc_process < 10 '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
- https://lolbas-project.github.io/lolbas/Binaries/Msiexec/

id: '19686.34358'
title: Office Spawns Suspicious Child Process
description: 'This use case attempts to identify suspicious child processes spawned
  from a Microsoft Office application -- Threat Actor Association: RomCom (Storm-0978)
  -- Vulnerability Association: CVE-2023-36884'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 AND (powershell.exe
  OR pwsh.exe OR cmd.exe OR mshta.exe OR wscript.exe OR cscript.exe OR regsvr32.exe
  OR rundll32.exe OR taskkill.exe OR csc.exe OR calc.exe OR control.exe) ((Microsoft
  OR Office) OR WINWORD.EXE OR EXCEL.EXE OR POWERPNT.EXE OR MSACCESS.EXE OR OUTLOOK.EXE
  OR VISIO.EXE OR WINPROJ.EXE OR ONENOTE.EXE OR GRAPH.EXE OR MSPub.EXE OR wordpad.exe)
  | table _time, host, user process, parent_*, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | where match(parent_process_path,"(?i)(Microsoft
  Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(ONENOTE\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(GRAPH\.exe)|(MSPub\.exe)|(wordpad\.exe)") '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows Sysmon
references:
- https://fourcore.io/blogs/cve-2023-36884-ms-office-zero-day-vulnerability

id: '5847.6115'
title: Password Spraying Windows
description: 'Adversaries may use a single or small list of commonly used passwords
  against many different accounts to attempt to acquire valid account credentials.
  -- Threat Actor Association: Volt Typhoon - Software Association: Conti'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM("4625") | search signature_id=4625|
  table _time, host, user signature_id, user, src_ip | bin span=10s | stats values(*)
  as * by _time, host | eventstats dc(user) as users by _time, host | where users
  > 2 '
techniques:
- credential-access:brute force:password spraying
technique_id:
- T1110.003
data_category:
- Windows event logs
references:
- https://www.cyber.gov.au/acsc/view-all-content/advisories/2019-130-password-spray-attacks-detection-and-mitigation-strategies

id: '24625.45523'
title: Permissions Replaced by icacls - Windows
description: 'icacls is a command-line utility in Windows that allows for viewing
  and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat
  actors may abuse this tool to alter file permissions, potentially gaining unauthorized
  access or control over sensitive files and directories, as observed by DFIR report
  (see references). This use case detects icacls executions with switches to replace
  permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "icacls" ("/grant:" OR "/deny:" OR "/remove:"
  OR "/setintegritylevel:" OR "/inheritance:") | rex field=_raw "(?<=icacls\.exe\"\s)(?<file_path>[^\s]+)"|
  rex field=_raw "/(grant|deny|remove|setintegritylevel|inheritance):\S\s(?<permission_user>[^\:]+):F"|
  table _time, host, user, process, process_*, parent_process, parent_process_*, user,
  file_path, permission_user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222
- T1222.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

name: Shim Database File Creation
id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33
version: 13
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: TTP
description: The following analytic detects the creation of shim database files (.sdb) in default directories using the sdbinst.exe application. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify file writes to the Windows\AppPatch\Custom directory. This activity is significant because shims can intercept and alter API calls, potentially allowing attackers to bypass security controls or execute malicious code. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, or persistent access within the environment.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`'
how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
known_false_positives: Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation.
references: []
finding:
    title: A process that possibly write shim database in $file_path$ in host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_path
      type: file_path
analytic_story:
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1546.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '19911.35071'
title: Startup Folder Location Modified - Windows
description: 'Adversaries may achieve persistence by adding a program to a startup
  folder or referencing it with a Registry run key. Adding an entry to the "run keys"
  in the Registry or startup folder will cause the program referenced to be executed
  when a user logs in. Adversaries may modify registry values to point to a new startup
  folder where a payload could be stored to launch at boot. This use case detects
  modifications to registry values that can be used to change the startup folder location.
  Atomics T1546.002 Test #10 Atomics T1546.002 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ((TERM(Set-ItemProperty)
  OR TERM(sp) OR (TERM(reg) TERM(add)))) "Startup" "Windows\\CurrentVersion\\Explorer\\User
  Shell Folders" | table _time, host, user, parent_process*, process, process_*, signature_id,
  user_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
technique_id:
- T1547.001
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md#atomic-test-10---change-startup-folder---hklm-modify-user-shell-folders-common-startup-value
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md#atomic-test-11---change-startup-folder---hkcu-modify-user-shell-folders-startup-value

id: '19911.35065'
title: Startup Folder Location Modified - Windows
description: 'Adversaries may achieve persistence by adding a program to a startup
  folder or referencing it with a Registry run key. Adding an entry to the "run keys"
  in the Registry or startup folder will cause the program referenced to be executed
  when a user logs in. Adversaries may modify registry values to point to a new startup
  folder where a payload could be stored to launch at boot. This use case detects
  modifications to registry values that can be used to change the startup folder location.
  Atomics T1546.002 Test #10 Atomics T1546.002 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=12) OR "<EventID>12<"
  OR TERM(EventCode=13) OR "<EventID>13<") "Startup" "Windows\\CurrentVersion\\Explorer\\User
  Shell Folders" | table _time, host, user, parent_process*, process, process_*, signature_id,
  user_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
technique_id:
- T1547.001
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md#atomic-test-10---change-startup-folder---hklm-modify-user-shell-folders-common-startup-value
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md#atomic-test-11---change-startup-folder---hkcu-modify-user-shell-folders-startup-value

name: Suspicious SearchProtocolHost no Command Line Arguments
id: f52d2db8-31f9-4aa7-a176-25779effe55c
version: 15
creation_date: '2021-02-23'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |-
    The following analytic detects instances of searchprotocolhost.exe running without command line arguments.
    This behavior is unusual and often associated with malicious activities, such as those performed by Cobalt Strike.
    The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process execution data.
    This activity is significant because searchprotocolhost.exe typically runs with specific arguments, and its absence may indicate an attempt to evade detection.
    If confirmed malicious, this could lead to unauthorized code execution, potential credential dumping, or other malicious actions within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    (
        Processes.process_name=searchprotocolhost.exe
        OR
        Processes.original_file_name=searchprotocolhost.exe
    )
    Processes.process IN ("*searchprotocolhost","*searchprotocolhost.exe", "*searchprotocolhost.exe\"")

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_searchprotocolhost_no_command_line_arguments_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    No false positives have been identified at this time.
references:
    - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
finding:
    title: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$
analytic_story:
    - BlackByte Ransomware
    - Cobalt Strike
    - Graceful Wipe Out Attack
    - Cactus Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AD Replication Service Traffic
id: c6e24183-a5f4-4b2a-ad01-2eb456d09b67
version: 9
creation_date: '2023-04-11'
modification_date: '2026-05-13'
author: Steven Dick
status: experimental
type: TTP
description: The following analytic identifies unexpected Active Directory replication traffic from non-domain controller sources. It leverages data from the Network Traffic datamodel, specifically looking for applications related to AD replication. This activity is significant because AD replication traffic should typically only occur between domain controllers. Detection of such traffic from other sources may indicate malicious activities like DCSync or DCShadow, which are used for credential dumping. If confirmed malicious, this could allow attackers to exfiltrate sensitive credentials, leading to unauthorized access and potential domain-wide compromise.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count values(All_Traffic.transport) as transport values(All_Traffic.user) as user values(All_Traffic.src_category) as src_category values(All_Traffic.dest_category) as dest_category min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
      WHERE All_Traffic.app IN ("ms-dc-replication","*drsr*","ad drs")
      BY All_Traffic.src All_Traffic.dest All_Traffic.app
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name("All_Traffic")`
    | `windows_ad_replication_service_traffic_filter`
how_to_implement: To successfully implement this search, you need to be ingesting application aware firewall or proxy logs into the Network Datamodel. Categorize all known domain controller Assets servers with an appropriate category for filtering.
known_false_positives: New domain controllers or certian scripts run by administrators.
references:
    - https://adsecurity.org/?p=1729
    - https://attack.mitre.org/techniques/T1003/006/
    - https://attack.mitre.org/techniques/T1207/
finding:
    title: Active Directory Replication Traffic from Unknown Source - $src$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1003.006
    - T1207
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Windows Archive Collected Data via Powershell
id: 74c5a3b0-27a7-463c-9d00-1a5bb12cb7b5
version: 11
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of PowerShell scripts to archive files into a temporary folder. It leverages PowerShell Script Block Logging, specifically monitoring for the `Compress-Archive` command targeting the `Temp` directory. This activity is significant as it may indicate an adversary's attempt to collect and compress data for exfiltration. If confirmed malicious, this behavior could lead to unauthorized data access and exfiltration, posing a severe risk to sensitive information and overall network security.
data_source:
    - Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*Compress-Archive*"  ScriptBlockText = "*\\Temp\\*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_archive_collected_data_via_powershell_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: powershell may used this function to archive data.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Windows Archive Collected Data via Powershell on $dest$.
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1560
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Cached Domain Credentials Reg Query
id: 40ccb8e0-1785-466e-901e-6a8b75c04ecd
version: 11
creation_date: '2022-12-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies a process command line querying the CachedLogonsCount registry value in the Winlogon registry. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and registry queries. Monitoring this activity is significant as it can indicate the use of post-exploitation tools like Winpeas, which gather information about login caching settings. If confirmed malicious, this activity could help attackers understand login caching configurations, potentially aiding in credential theft or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where  `process_reg` AND Processes.process = "* query *" AND Processes.process = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Processes.process = "*CACHEDLOGONSCOUNT*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cached_domain_credentials_reg_query_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
    - https://learn.microsoft.com/de-de/troubleshoot/windows-server/user-profiles-and-logon/cached-domain-logon-information
    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a process with commandline $process$ tries to retrieve cache domain credential logon count on $dest$
analytic_story:
    - Windows Post-Exploitation
    - Prestige Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1003.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Firewall Rule Deletion
id: ca5327e1-0a91-4e23-bbd4-8901806c00e1
version: 8
creation_date: '2025-03-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This detection identifies instances where a Windows Firewall rule has been deleted, potentially exposing the system to security risks. Unauthorized removal of firewall rules can indicate an attacker attempting to bypass security controls or malware disabling protections for persistence and command-and-control communication. The event logs details such as the deleted rule name, protocol, port, and the user responsible for the action. Security teams should monitor for unexpected deletions, correlate with related events, and investigate anomalies to prevent unauthorized access and maintain network security posture.
data_source:
    - Windows Event Log Security 4948
search: |-
    `wineventlog_security` EventCode=4948
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY RuleName signature subject
           status dest ProcessID
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_firewall_rule_deletion_filter`
how_to_implement: This detection is based on data collected from Endpoint Detection and Response (EDR) agents, which provide security-related telemetry from monitored endpoints. Specifically, it focuses on Windows Security Event Log entries with EventID 4948, which indicates that a Windows Firewall rule has been delted. To implement this detection in Splunk, you must ingest Windows Security Event Logs that capture EventID 4948, ensuring that critical fields such as _time, EventRecordID, ProcessID, ThreadID, Computer, ProfileChanged, RuleName, and RuleId are available for analysis. These logs must be processed using the appropriate Splunk Technology Add-ons (TAs) to ensure compatibility with the EDR product and proper field extraction. Additionally, mapping these logs to the appropriate data model, such as the Endpoint data model, enhances structured analysis. Leveraging the Splunk Common Information Model (CIM) helps normalize field names, ensuring consistency across different data sources. By implementing this approach, you can effectively detect and monitor Windows Firewall rule modifications, providing visibility into potential security risks or unauthorized changes.
known_false_positives: Legitimate admin delete, Group Policy updates, software installs, security tools, and automated scripts can trigger false positives for Event ID 4948.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4948
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a firewall rule $RuleName$ has been modified on $dest$.
analytic_story:
    - ShrinkLocker
    - Medusa Ransomware
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint