Splunk rules: 1q

id: '25757.47714'
title: Advanced Port Scanner Execution
description: Advanced Port Scanner is a free network scanner that allows users to
  quickly find open ports on network computers and retrieve versions of programs running
  on the ports it detects. Threat actors using Rhysida ransomware have been reported
  to use Advanced Port Scanner during reconnaissance activities.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "advanced_port_scanner.exe" | where match(process_name,
  "(?i)advanced_port_scanner\.exe") | table _time, host, user, process, process_*,
  parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows event logs
references:
- https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/rhysida-ransomware-intrusion.pdf?utm_source=blog&utm_medium=blog&utm_campaign=rhysida-ransomware
- https://www.advanced-port-scanner.com/

name: ASL AWS Create Policy Version to allow all resources
id: 22cc7a62-3884-48c4-82da-592b8199b72f
version: 9
creation_date: '2021-02-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that grants broad permissions. This behavior is significant because it violates the principle of least privilege, potentially exposing the environment to misuse or abuse. If confirmed malicious, an attacker could gain extensive access to AWS resources, leading to unauthorized actions, data exfiltration, or further compromise of the AWS environment.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=CreatePolicy
      | spath input=api.request.data
      | spath input=policyDocument
      | regex Statement{}.Action="\*"
      | regex Statement{}.Resource="\*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region api.request.data
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_create_policy_version_to_allow_all_resources_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources and you must verify this activity.
references:
    - https://bishopfox.com/blog/privilege-escalation-in-aws
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
finding:
    title: User $user$ created a policy version that allows them to access any resource in their account
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - AWS IAM Privilege Escalation
    - Scattered Lapsus$ Hunters
asset_type: AWS Account
mitre_attack_id:
    - T1078.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '32258.57435'
title: ComputerDefaults UAC Bypass
description: 'computerdefaults.exe is a legitimate Windows executable handling the
  Default Programs feature in Windows. This feature allows users to set default programs
  for specific tasks such as web browsing, email, and media playback. Threat actors
  may modify the registry to have computerdefaults.exe run arbitrary commands when
  executed, potentially leading to UAC bypass. This use case detects modifications
  to the registry key HKCU\Software\Classes\ms-settings\shell\open\command which is
  associated with computerdefaults.exe. Atomics T1548.002 Test #5 Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4657) OR
  "<EventID>4657<") OR ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)
  "ADD" OR "Set-ItemProperty" OR "sp " OR "New-Item" OR "New-ItemProperty" OR "ni")
  "\\software\\classes\\ms-settings\\shell\\open\\command" "DelegateExecute" | table
  _time, host, user ObjectName, process, process_*, parent_process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md

name: ESXi System Information Discovery
id: b4d4217a-6673-4fb6-837d-07a522bdf9f7
version: 4
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. While used for legitimate administration, this behavior may also indicate adversary reconnaissance aimed at profiling the ESXi host's capabilities, build information, or system role in preparation for further compromise.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*system*" AND Message="*esxcli*" AND Message IN ("*get*","*list*") AND Message="*user=*" NOT Message="*filesystem*" | rex field=_raw "user=(?<user>\w+)\]\s+Dispatch\s+(?<command>[^\s]+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_system_information_discovery_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Administrators may use this command when troubleshooting. Tune as needed.
finding:
    title: System information discovery commands executed on ESXi host $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: System information discovery commands executed on ESXi host $dest$ by $user$.
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1082
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '6110.6590'
title: Linux Kernel Module Commands
description: 'Adversaries may modify the kernel to automatically execute programs
  on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded
  and unloaded into the kernel upon demand. Atomics T1014 Test #1 Atomics T1014 Test
  #2 Atomics T1547.006 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=proctitle OR type=execve
  OR sourcetype=bash_history) AND ((TERM(insmod) OR TERM(rmmod) OR TERM(depmod)) OR
  TERM(modprobe) OR TERM(lsmod) OR TERM(modinfo) OR TERM(kmod)) | table _time, host,
  user, process, process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:boot or logon autostart execution:kernel modules and extensions
- persistence:boot or logon autostart execution:kernel modules and extensions
technique_id:
- T1547.006
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/

name: M365 Copilot Agentic Jailbreak Attack
id: e5c7b380-19da-42e9-9e53-0af4cd27aee3
version: 5
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts.
data_source:
    - M365 Exported eDiscovery Prompts
search: >
    `m365_exported_ediscovery_prompt_logs` | eval user = Sender | eval
    rule_injection=if(match(Subject_Title, "(?i)(rules|instructions)\s*="), "YES",
    "NO") | eval universal_trigger=if(match(Subject_Title,
    "(?i)(every|all).*prompt"), "YES", "NO") | eval
    response_automation=if(match(Subject_Title,
    "(?i)(always|automatic).*respond"), "YES", "NO") | eval
    system_override=if(match(Subject_Title,
    "(?i)(override|bypass|ignore).*(system|default)"), "YES", "NO") | eval
    persona_establishment=if(match(Subject_Title, "(?i)(with.*\[.*\]|persona)"),
    "YES", "NO") | where rule_injection="YES" OR universal_trigger="YES" OR
    response_automation="YES" OR system_override="YES" OR
    persona_establishment="YES" | table _time, "Source ID", user, Subject_Title,
    rule_injection, universal_trigger, response_automation, system_override,
    persona_establishment, Workload | sort -_time |
    `m365_copilot_agentic_jailbreak_attack_filter`
how_to_implement: To export M365 Copilot prompt logs, navigate to the Microsoft Purview compliance portal (compliance.microsoft.com) and access eDiscovery. Create a new eDiscovery case, add target user accounts or date ranges as data sources, then create a search query targeting M365 Copilot interactions across relevant workloads. Once the search completes, export the results to generate a package containing prompt logs with fields like Subject_Title (prompt text), Sender, timestamps, and workload metadata. Download the exported files using the eDiscovery Export Tool and ingest them into Splunk for security analysis and detection of jailbreak attempts, data exfiltration requests, and policy violations.
known_false_positives: Legitimate users discussing AI ethics research, security professionals testing system robustness, developers creating training materials for AI safety, or academic discussions about AI limitations and behavioral constraints may trigger false positives.
references:
    - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ attempted to establish persistent agentic control over M365 Copilot through advanced jailbreak techniques including rule injection, universal triggers, and system overrides, potentially compromising AI security across multiple sessions.
analytic_story:
    - Suspicious Microsoft 365 Copilot Activities
asset_type: Web Application
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Modification Of Wallpaper
id: accb0712-c381-11eb-8e5b-acde48001122
version: 11
creation_date: '2021-06-04'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the modification of registry keys related to the desktop wallpaper settings. It leverages Sysmon EventCode 13 to identify changes to the "Control Panel\\Desktop\\Wallpaper" and "Control Panel\\Desktop\\WallpaperStyle" registry keys, especially when the modifying process is not explorer.exe or involves suspicious file paths like temp or public directories. This activity is significant as it can indicate ransomware behavior, such as the REVIL ransomware, which changes the wallpaper to display a ransom note. If confirmed malicious, this could signify a compromised machine and the presence of ransomware, leading to potential data encryption and extortion.
data_source:
    - Sysmon EventID 13
search: '`sysmon` EventCode =13  (TargetObject IN ("*\\Control Panel\\Desktop\\Wallpaper","*\\Control Panel\\Desktop\\WallpaperStyle") AND Image != "*\\explorer.exe") OR (TargetObject IN ("*\\Control Panel\\Desktop\\Wallpaper","*\\Control Panel\\Desktop\\WallpaperStyle") AND Details IN ("*\\temp\\*", "*\\users\\public\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by action dest process_guid process_id registry_hive registry_path registry_key_name registry_value_data registry_value_name status user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: 3rd party tool may used to changed the wallpaper of the machine
references:
    - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
    - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
finding:
    title: Wallpaper modification on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Revil Ransomware
    - Rhysida Ransomware
    - LockBit Ransomware
    - BlackMatter Ransomware
    - Brute Ratel C4
    - Windows Registry Abuse
    - Black Basta Ransomware
    - Ransomware
    - ZOVWiper
asset_type: Endpoint
mitre_attack_id:
    - T1491
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Multiple Archive Files Http Post Traffic
id: 4477f3ea-a28f-11eb-b762-acde48001122
version: 13
creation_date: '2021-04-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the high-frequency exfiltration of archive files via HTTP POST requests. It leverages HTTP stream logs to identify specific archive file headers within the request body. This activity is significant as it often indicates data exfiltration by APTs or trojan spyware after data collection. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive data to an attacker’s command and control server, potentially resulting in severe data breaches and loss of confidential information.
data_source:
    - Splunk Stream HTTP
search: |-
    `stream_http` http_method=POST
      | eval archive_hdr1=substr(form_data,1,2)
      | eval archive_hdr2 = substr(form_data,1,4)
      | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count
        BY src_ip dest_ip http_method
           http_user_agent uri_path url
           bytes_in bytes_out archive_hdr1
           archive_hdr2
      | where count >20 AND (archive_hdr1 = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!")
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `multiple_archive_files_http_post_traffic_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled in stream http configuration.
known_false_positives: Normal archive transfer via HTTP protocol may trip this detection.
references:
    - https://attack.mitre.org/techniques/T1560/001/
    - https://www.mandiant.com/resources/apt39-iranian-cyber-espionage-group-focused-on-personal-information
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
finding:
    title: A http post $http_method$ sending packet with possible archive bytes header in uri path $uri_path$
    entity:
        field: src_ip
        type: system
        score: 50
threat_objects:
    - field: url
      type: url
analytic_story:
    - Data Exfiltration
    - Command And Control
    - APT37 Rustonotto and FadeStealer
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '1042.1065'
title: New AutoRun Registry Key
description: 'Detects when common autorun scripts in the Windows registry are modified.
  -- Threat Actor Association: APT27/Emissary Panda, APT28, APT29/Nobelium/Cozy Bear,
  APT33, APT37, APT40, APT43, Blind Eagle/APT-C-36, Carbanak, FIN6, FIN7, FIN13, Lazarus,
  MuddyWater, Mustang Panda, NewsPenguin, RedEyes, RomCom, SaintBear (aka UAC-0056,
  UNC2589, TA471), Sandworm Team, TA2541, TA505, UAC-0056, UNC4990 - Software Association:
  ALPHV/BlackCat, Bazarloader, Blackbyte, Havex, LockBit, MirrorBlast, NanoCore, Phosphorus/Magic
  Hound/APT35, Prometheus / Spook, Sodinokibi/REvil, Ransom Cartel, Remcos RAT, Trigona,
  Vice Society, Zloader -- Atomics T1547.001 Test#3 Atomics T1547.001 Test#4'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` AND ( EventCode=4103 OR
  EventCode=4104) AND ("Windows\\CurrentVersion\\RunOnce" OR "Windows\\CurrentVersion\\Run"
  OR "Windows\\CurrentVersion\\RunServices" OR "Windows\\CurrentVersion\\RunServicesOnce"
  OR "Windows\\CurrentVersion\\RunOnceEx") | table _time, host, user dvc, dvc_nt_host,
  event_id, eventtype, host, index, parameters, process, process_id, process_name,
  process_path, shell, signature_id, source, sourcetype, src_user, tag, user, user_id
  | bin span=60s | stats values(*) as * by _time, host | rex field=process max_match=0
  (?<registry_path>"[^\"]+Windows\\\CurrentVersion\\\Run[^\"]{0,}") | eventstats values(registry_path)
  as registry_path by _time dvc '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
technique_id:
- T1547.001
data_category:
- Windows Registry
- PowerShell logs
references: null

name: Tomcat Session Deserialization Attempt
id: e28b4fd4-8f5a-41cd-8222-2f1ccca53ef1
version: 6
creation_date: '2025-03-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: This detection identifies potential exploitation of CVE-2025-24813 in Apache Tomcat through the second stage of the attack. This phase occurs when an attacker attempts to trigger deserialization of a previously uploaded malicious session file by sending a GET request with a specially crafted JSESSIONID cookie. These requests typically have specific characteristics, including a JSESSIONID cookie with a leading dot that matches a previously uploaded filename, and typically result in a HTTP 500 error when the exploitation succeeds.
data_source:
    - Nginx Access
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.http_method=GET
        AND
        Web.cookie="*JSESSIONID=.*"
        AND
        Web.status=500
      BY Web.src, Web.dest, Web.http_user_agent,
         Web.uri_path, Web.cookie, Web.status
    | `drop_dm_object_name("Web")`
    | where match(cookie, "^JSESSIONID=\.")
    | rex field=cookie "JSESSIONID=\.(?<cookie_path>[^;]+)"
    | eval severity="High"
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `tomcat_session_deserialization_attempt_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs from your web servers, proxies, or WAFs that process web traffic to Tomcat instances. The data must be mapped to the Web datamodel in the Web node. Ensure your web servers are logging requests that include HTTP methods, status codes, URI paths, and cookie information. Particularly important is capturing the JSESSIONID cookie values. The detection specifically looks for GET requests with a JSESSIONID cookie that starts with a dot (.) and results in a 500 status code, which is characteristic of successful deserialization attempts.
known_false_positives: Limited false positives should occur as this pattern is highly specific to CVE-2025-24813 exploitation. However, legitimate application errors that use similar cookie patterns and result in 500 status codes might trigger false positives. Review the JSESSIONID cookie format and the associated request context to confirm exploitation attempts.
references:
    - https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24813
    - https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2025-24813
    - https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2025-24813/
    - https://gist.github.com/MHaggis/e106367f6649fbb09ab27e7b4a01cf73
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A Tomcat session deserialization attempt has been detected from IP $src$ targeting $dest$ with a suspicious JSESSIONID cookie. This could indicate exploitation of CVE-2025-24813.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Apache Tomcat Session Deserialization Attacks
asset_type: Web Application
cve:
    - CVE-2025-24813
mitre_attack_id:
    - T1190
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '1139.1235'
title: Tunneling Process Created
description: 'Adversaries may tunnel network communications to and from a victim system
  within a separate protocol to avoid detection/network filtering and/or enable access
  to otherwise unreachable systems. Common tools include Iodine, DNSCat, and Plink
  -- Threat Actor Association: Agrius, Alloy Taurus/Gallium, APT34, FIN6, Lazarus,
  Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Magnat,
  Memento Team, OilRig, TRACER KITTEN -- Software Association: BadHatch, Lockbit,
  LV, Royal, Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 | regex process="(?i)(\-\-dns)?((\s+)|(\=))?((server\=)|(host\=))?((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\,port\=\d{1,5}.+)|(\w+\.((com)|(org)|(net)|(info)))$)|(\w+\.((com)|(org)|(net)|(info))\:\d{1,5})|(\w+\@(\d{1,3}\.){3}\d{1,3}.+\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5})|(\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5}.+\w+\@(\d{1,3}\.){3}\d{1,3})|(\d{1,5}\s+?(\d{1,3}\.){3}\d{1,3}\:\d{1,5})"
  | table _time, host, user, signature_id, process_*, parent_process, parent_process_*,
  user | bin span=1s | stats values(*) as * by _time, host, process '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id: 
- T1572
- T1095
data_category:
- Windows Sysmon
references:
- https://github.com/yarrick/iodine
- https://github.com/iagox86/dnscat2
- https://github.com/kdsnice/Invoke-Plink

name: Windows Proxy Execution of .NET Utilities via Scripts
id: eb59cf01-1874-4d16-b7e4-54a6eb9b3118
version: 2
creation_date: '2026-04-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the launch of common .NET-related utilities—aspnet_compiler.exe, msbuild.exe, regasm.exe, InstallUtil.exe, or vbc.exe when the parent appears to be a script (batch, CMD, PowerShell, JScript, VBScript, or HTML) running from an unusual or user-writable Windows location (for example Public, Temp, Fonts, Debug, Recycle Bin, Prefetch, or similar paths), and the child process shows little or no command-line variation from the image path or name.
    That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where

    Processes.process_name IN (
        "aspnet_compiler.exe",
        "InstallUtil.exe",
        "msbuild.exe",
        "regasm.exe",
        "vbc.exe",
    )
    Processes.parent_process IN (
        "*.bat*",
        "*.cmd*",
        "*.html*",
        "*.js*",
        "*.ps1*",
        "*.vbe*",
        "*.vbs*"
    )
    Processes.parent_process IN (
        ":\\Windows\\repair\\*",
        "*:\\Microsoft\\Windows\\Libraries\\*",
        "*:\\Temp\\*",
        "*:\\Users\\Administrator\\Music\\*",
        "*:\\Users\\Public\\*",
        "*:\\Windows\\Cursors\\*",
        "*:\\Windows\\debug\\*",
        "*:\\Windows\\Fonts\\*",
        "*:\\Windows\\INF\\*",
        "*:\\Windows\\Media\\*",
        "*:\\Windows\\Prefetch\\*",
        "*:\\Windows\\Temp\\*",
        "*\\AppData\\Local\\Temp\\*",
        "*\\PerfLogs\\*",
        "*Recycle.bin*"
      )
      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

      | where (isnull(Processes.process) OR Processes.process=Processes.process_path OR Processes.process=Processes.process_name)

      | `drop_dm_object_name(Processes)`
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_proxy_execution_of__net_utilities_via_scripts_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.joesandbox.com/analysis/1817558/0/pdfexecutive
    - https://www.broadcom.com/support/security-center/protection-bulletin/vip-keylogger-spreads-via-multi-org-impersonation-campaign
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.vipkeylogger
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious script [$parent_process$] spawned [$process_name$] with CommandLine [$process$] on [$dest$].
threat_objects:
    - field: parent_process
      type: parent_process
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - VIP Keylogger
asset_type: Endpoint
mitre_attack_id:
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows PuTTY Suite Utility Execution
id: 64d5263e-0f29-4641-81ed-03b39c27ecd4
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    This analytic detects the execution of programs associated with the PuTTY SSH client suite, including putty.exe, pscp.exe, plink.exe, psftp.exe, and puttygen.exe.
    This activity is significant because these tools can be used to establish unauthorized remote connections, transfer files, or execute commands on remote systems.
    If identified in an unusual context, such as non-administrative accounts or unexpected systems, it may indicate attempts to bypass security controls, perform lateral movement, or exfiltrate data, which could lead to further network compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        Processes.process_name IN (
            "putty.exe",
            "pscp.exe",
            "plink.exe",
            "psftp.exe",
            "puttygen.exe"
        )
        OR
        Processes.original_file_name IN (
            "PuTTY",
            "PSCP",
            "Plink",
            "PSFTP",
            "PuTTYgen"
        )
    )

    by Processes.process Processes.vendor_product Processes.user_id
       Processes.process_hash Processes.parent_process_name
       Processes.parent_process_exec Processes.action Processes.dest
       Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name
       Processes.parent_process Processes.parent_process_path
       Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id
       Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_putty_suite_utility_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate users may run PuTTY for remote administration or secure file transfers. Filter alerts to exclude approved administrative activities.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential PuTTY suite activity observed on $dest$ via $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Command And Control
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1021.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows System Binary Proxy Execution Compiled HTML File Decompile
id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d
version: 15
creation_date: '2022-09-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of the decompile parameter with the HTML Help application (HH.exe). This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions involving the decompile parameter. This activity is significant because it is an uncommon command and has been associated with APT41 campaigns, where it was used to unpack HTML help files for further malicious actions. If confirmed malicious, this technique could allow attackers to execute arbitrary commands, potentially leading to further compromise and persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_hh` Processes.process=*-decompile*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited, filter as needed.
references:
    - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
    - https://redcanary.com/blog/introducing-atomictestharnesses/
    - https://attack.mitre.org/techniques/T1218/001/
    - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
finding:
    title: $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Compiled HTML Activity
    - Living Off The Land
    - Compromised Windows Host
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows WSUS Spawning Shell
id: 76ea28ac-6f10-43fd-b5fe-340022ad0fd3
version: 5
creation_date: '2021-03-04'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies instances where a shell (PowerShell.exe or Cmd.exe) is spawned from wsusservice.exe, the Windows Server Update Services process. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is wsusservice.exe. This activity is significant as it may indicate exploitation of CVE-2025-59287, a critical deserialization vulnerability in WSUS that allows unauthenticated remote code execution. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands on WSUS servers, potentially leading to system compromise, data exfiltration, domain enumeration, or further lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=wsusservice.exe
        AND
        `process_cmd`
        OR
        `process_powershell`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_wsus_spawning_shell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate WSUS maintenance scripts or administrative tools may spawn shells in rare cases. However, wsusservice.exe spawning interactive shells is highly abnormal behavior. Review the command line arguments and user context to determine legitimacy. Filter known administrative scripts if needed.
references:
    - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
    - https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
finding:
    title: WSUS service process wsusservice.exe spawned shell process $process_name$ on $dest$ by $user$, indicating possible CVE-2025-59287 exploitation
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: WSUS service process wsusservice.exe spawned shell process $process_name$ on $dest$ by $user$, indicating possible CVE-2025-59287 exploitation
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Microsoft WSUS CVE-2025-59287
asset_type: Endpoint
cve:
    - CVE-2025-59287
mitre_attack_id:
    - T1190
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint