Splunk rules: 1r

name: AWS Network Access Control List Deleted
id: ada0f478-84a8-4641-a3f1-d82362d6fd75
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
data_source:
    - AWS CloudTrail DeleteNetworkAclEntry
search: |-
    `cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
      | fillnull
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_network_access_control_list_deleted_filter`
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
known_false_positives: It's possible that a user has legitimately deleted a network ACL.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ from $src$ has sucessfully deleted network ACLs entry, such that the instance is accessible from anywhere
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Network ACL Activity
asset_type: AWS Instance
mitre_attack_id:
    - T1686.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '1067.1101'
title: BitsAdmin NetCat PowerCat File Transfer
description: 'This use case is searching for specific keywords that are generated
  when a file transfer using Bitsadmin, Netcat or PowerCat is made to send data to/from
  an external source. -- Threat Actor Association: Cadet Blizzard - Software Association:
  Black Basta -- Atomics T1105 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (signature_id=4103 OR signature_id=4104)
  AND (" */transfer * * *" OR "-l *>" OR TERM(Start-BitsTransfer)) | rex field=_raw
  "(?i)user(\s+)?=(\s+)?(?<user>.+)" | rex field=process "(?i)(?<process>(.+/transfer.+)|(.+-l
  [^>]+>.+))" | rex field=process "(?i)(?<process_name>\S+)\s+(?<transfer>\/transfer)\s+(?<job_name>\S+)\s+(?<options>((\S+\s+)|(\/\S+\s+\S+\s+))+)?((?<remote_file>\S+)\s+(?<file_path>\S+))$(\s+)?"
  | rex field=process "([\.\\\]+)?"(?<process_name>"(?i)\S+")"\s+\-l\s+(-p\s+)?"(?<src_port>"\d+")"\s+(.+)?\>"(?<file_path>"\S+")
  | rex field=remote_file "(?<dest_ip>((25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9]))"
  | rex field=file_path mode=sed "s/''(.+)''/\1/"| eval options=mvappend(transfer."
  ".job_name,options) | fillnull value="false" transfer dest_ip | table _time, host,
  user dest_ip file_path job_name options process process_name process_path remote_file
  signature_id src_port user user_id transfer| bin span=1s | stats values(*) as *
  by _time, host | where isnotnull(process_name) | iplocation prefix=dest_ dest_ip|
  lookup dnslookup clientip as dest_ip OUTPUT clienthost as dest_dns '
techniques:
- command-and-control:application layer protocol:file transfer protocols
- persistence:bits jobs
- defense-evasion:bits jobs
technique_id:
- T1071.002
- T1197
data_category:
- PowerShell logs
- Process command-line parameters
references: null

name: Cisco Network Interface Modifications
id: 61ae09c2-079e-44b1-8be0-74e35c5a679e
version: 5
creation_date: '2025-08-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: Anomaly
description: This analytic detects the creation or modification of network interfaces on Cisco devices, which could indicate an attacker establishing persistence or preparing for lateral movement. After gaining initial access to network devices, threat actors like Static Tundra often create new interfaces (particularly loopback interfaces) to establish covert communication channels or maintain persistence. This detection specifically looks for the configuration of new interfaces, interface state changes, and the assignment of IP addresses to interfaces. These activities are particularly concerning when they involve unusual interface names or descriptions containing suspicious terms.
data_source:
    - Cisco IOS Logs
search: |-
    | tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
      WHERE (
            (All_Changes.command="*interface*")
            OR
            (All_Changes.command="*LINEPROTO-5-UPDOWN*")
            OR
            (All_Changes.command="*ip address*")
        )
      BY All_Changes.dvc All_Changes.user
    | `drop_dm_object_name("All_Changes")`
    | rename dvc as dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_network_interface_modifications_filter`
how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel. Ensure that your Cisco IOS devices are configured to send logs to your Splunk environment, with appropriate logging levels enabled to capture interface configuration changes and line protocol state changes. Configure command logging on Cisco IOS devices using the "archive log config logging enable" command and ensure that syslog is properly configured to capture LINEPROTO-5-UPDOWN messages.
known_false_positives: Legitimate network interface configuration changes may trigger this detection during routine network maintenance or initial device setup. Network administrators often need to create or modify interfaces as part of normal operations. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames, typical times for interface configuration changes, and scheduled maintenance windows. You may also want to create a lookup table of approved interface naming conventions and filter out alerts for standard interface configurations.
references:
    - https://blog.talosintelligence.com/static-tundra/
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
    - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-i1.html#wp1389942834
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious network interface modifications detected on Cisco device $dest$ by user $user$, which may indicate persistence establishment
        - field: user
          type: user
          score: 20
          message: Suspicious network interface modifications detected on Cisco device $dest$ by user $user$, which may indicate persistence establishment
threat_objects:
    - field: command
      type: command
analytic_story:
    - Cisco Smart Install Remote Code Execution CVE-2018-0171
asset_type: Network
cve:
    - CVE-2018-0171
mitre_attack_id:
    - T1556
    - T1021
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Cloud Compute Instance Created By Previously Unseen User
id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
version: 12
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: Anomaly
description: The following analytic identifies the creation of cloud compute instances by users who have not previously created them. It leverages data from the Change data model, focusing on 'create' actions by users, and cross-references with a baseline of known user activities. This activity is significant as it may indicate unauthorized access or misuse of cloud resources by new or compromised accounts. If confirmed malicious, attackers could deploy unauthorized compute instances, leading to potential data exfiltration, increased costs, or further exploitation within the cloud environment.
data_source:
    - AWS CloudTrail
search: |-
    | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest FROM datamodel=Change
      WHERE All_Changes.action=created
      BY All_Changes.user All_Changes.vendor_region
    | `drop_dm_object_name("All_Changes")`
    | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
    | eventstats max(enough_data) as enough_data
    | where enough_data=1
    | eval firstTimeSeenUser=min(firstTimeSeen)
    | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
    | table firstTime, user, dest, count vendor_region
    | `security_content_ctime(firstTime)`
    | `cloud_compute_instance_created_by_previously_unseen_user_filter`
how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
known_false_positives: It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: User $user$ is creating a new instance $dest$ for the first time
        - field: user
          type: user
          score: 20
          message: User $user$ is creating a new instance $dest$ for the first time
analytic_story:
    - Cloud Cryptomining
asset_type: Cloud Compute Instance
mitre_attack_id:
    - T1078.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Cloud Compute Creations By User - Initial
    - Previously Seen Cloud Compute Creations By User - Update

id: '7831.9438'
title: Compressed File Execution
description: 'This use case looks for the execution of compressed executable. Threat
  Actor Association: APT-K-47/Mysterious Elephant, APT10/menuPass, APT36, APT37, Gamaredon
  Group/Shuckworm, Magnat, MuddyWater, InvisiMole, SideWinder, TA402, TA416, TA551,
  TA576, UAC-0057 (GhostWriter), UNC2589 - Software Association: Agent Tesla, ALPHV/Blackcat,
  Bazarloader, Black Basta, Bumblebee Loader, Clop, Conti, DatopLoader, DarkCrystal
  RAT, Emotet, Lockbit, NimbleMamba, PureCrypter, Qakbot/Qbot, Quantum, Remcos RAT,
  Ursnif, Vidar Stealer - Atomics T1027 Test #4 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (".zip" ".exe") | table _time, host, user process,
  process_*, signature_id, parent_* | bin span=1s | stats values(*) as * by _time,
  host | where match(process_path,"(?i)\.zip\x5c.*?\.exe") OR match(parent_process_path,"(?i)\.zip\x5c.*?\.exe") '
techniques:
- defense-evasion:obfuscated files or information
technique_id: 
- T1027
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md

name: Creation of lsass Dump with Taskmgr
id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
version: 14
creation_date: '2019-12-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp. This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords. If confirmed malicious, an attacker could use the lsass dump to extract credentials and escalate privileges, potentially compromising the entire network.
data_source:
    - Sysmon EventID 11
search: |-
    `sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action dest file_name
           file_path process_guid process_id
           user_id vendor_product process_name
           TargetFilename
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `creation_of_lsass_dump_with_taskmgr_filter`
how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager
    - https://attack.mitre.org/techniques/T1003/001/
    - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
finding:
    title: $process_name$ was identified on endpoint $dest$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Credential Dumping
    - CISA AA22-257A
    - Cactus Ransomware
    - Seashell Blizzard
    - Scattered Lapsus$ Hunters
asset_type: Windows
mitre_attack_id:
    - T1003.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Gsuite Email With Known Abuse Web Service Link
id: 8630aa22-042b-11ec-af39-acde48001122
version: 10
creation_date: '2021-08-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects emails in Gsuite containing links to known abuse web services such as Pastebin, Telegram, and Discord. It leverages Gsuite Gmail logs to identify emails with these specific domains in their links. This activity is significant because these services are commonly used by attackers to deliver malicious payloads. If confirmed malicious, this could lead to the delivery of malware, phishing attacks, or other harmful activities, potentially compromising sensitive information or systems within the organization.
data_source:
    - G Suite Gmail
search: |-
    `gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me")
      | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"
      | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
      | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com"
      | eval phase="plan"
      | eval severity="low"
      | stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count
        BY is_spam source.address source.from_header_address
           subject destination{}.address phase
           severity
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gsuite_email_with_known_abuse_web_service_link_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
references:
    - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
intermediate_findings:
    entities:
        - field: destination{}.address
          type: user
          score: 20
          message: Suspicious email from $source.address$ to $destination{}.address$
threat_objects:
    - field: source.address
      type: email_address
analytic_story:
    - Dev Sec Ops
asset_type: GSuite
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint

name: Kubernetes Abuse of Secret by Unusual Location
id: 40a064c1-4ec1-4381-9e35-61192ba8ef82
version: 10
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects unauthorized access or misuse of Kubernetes Secrets from unusual locations. It leverages Kubernetes Audit logs to identify anomalies in access patterns by analyzing the source of requests by country. This activity is significant for a SOC as Kubernetes Secrets store sensitive information like passwords, OAuth tokens, and SSH keys, making them critical assets. If confirmed malicious, this behavior could indicate an attacker attempting to exfiltrate or misuse these secrets, potentially leading to unauthorized access to sensitive systems or data.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` objectRef.resource=secrets verb=get
      | iplocation sourceIPs{}
      | fillnull
      | search NOT `kube_allowed_locations`
      | stats count
        BY objectRef.name objectRef.namespace objectRef.resource
           requestReceivedTimestamp requestURI responseStatus.code
           sourceIPs{} stage user.groups{}
           user.uid user.username userAgent
           verb City Country
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_abuse_of_secret_by_unusual_location_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Access of Kubernetes secret $objectRef.name$ from unusual location $Country$ by $user$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1552.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Auditd Insert Kernel Module Using Insmod Utility
id: bc0ca53f-dea6-4906-9b12-09c396fdf1d3
version: 11
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the insertion of a Linux kernel module using the insmod utility. It leverages data from Linux Auditd, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this could lead to unauthorized code execution, persistent access, and severe compromise of the affected system.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd` type=SYSCALL comm=insmod
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY comm exe syscall
           uid ppid pid
           success dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_insert_kernel_module_using_insmod_utility_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
    - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
    - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to insert a Linux kernel module using the insmod utility.
analytic_story:
    - XorDDos
    - Linux Rootkit
    - Compromised Linux Host
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1547.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux PF_ALG Registration Outside of Boot Window
id: 8a9684ae-52e6-4a57-aea4-8a9f72942564
version: 2
creation_date: '2026-05-11'
modification_date: '2026-07-17'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects when the AF_ALG kernel crypto socket interface being loaded more than 300 seconds after system boot, which is a primary kernel-level indicator of Copy Fail (CVE-2026-31431) exploitation activity on Debian and Ubuntu family systems.
    The AF_ALG interface is required by the exploit to access the vulnerable authencesn crypto code path, and on systems where it is not auto-loaded at boot, its on-demand registration by an unprivileged process is a strong indicator of exploitation in progress.
data_source:
    - Linux Messages Syslog
search: |
    `linux_syslog` "NET: Registered PF_ALG protocol family"
    | rex field=_raw "kernel: \[\s*(?<uptime_seconds>[\d\.]+)\]"
    | eval uptime_seconds=tonumber(uptime_seconds)
    | where uptime_seconds > 300
    | eval uptime_readable=tostring(round(uptime_seconds/60,1)) . " minutes after boot"
    | rename host as dest
    | table _time dest uptime_seconds uptime_readable _raw
    | sort -uptime_seconds
    | `linux_pf_alg_registration_outside_of_boot_window_filter`
how_to_implement: To successfully implement this search, you need to have relevant kernel logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).
known_false_positives: AF_ALG can be legitimately loaded after boot by on-demand LUKS volume mounts, IPsec VPN clients establishing tunnels, or OpenSSL deployments with the afalg engine enabled, making this signal most reliable on dedicated server infrastructure where these operations are handled at boot time.
references:
    - https://xint.io/blog/copy-fail-linux-distributions
    - https://github.com/theori-io/copy-fail-CVE-2026-31431
    - https://github.com/Neo23x0/auditd/blob/master/audit.rules
finding:
    title: AF_ALG instantiated after boot on $dest$ indicating possible privilege escalation.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2026-31431
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '9118.12339'
title: Potential Lateral Movement via SMB
description: 'Adversaries, typically, start moving laterally once they get initial
  foothold in the victim organization. Once they get initial access, they escalate
  their privileges and move laterally with the escalated privileges either to propagate
  their malware or to further reconnaissance & collect the targeted information. There
  are many techniques by which threat actors move laterally, this use case focuses
  solely on detecting potential anomalous SMB Traffic. - Threat Actor Association:
  Earth Estries, FIN8 (Syssphinx), Lancefly, Lazarus - Software Association: ALPHV/BlackCat,
  Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=3 OR "Event>ID>3<")
  (TERM(445) OR TERM(SMB)) | search dest_port="445" src_ip IN(10.0.0.0/8, 127.0.0.0/8,
  169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1",
  "FE80::/10", "FF00::/8") dest_ip IN(10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12,
  192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1", "FE80::/10", "FF00::/8") |
  table _time, host, user dest, direction, event_id, eventtype, parent_*, process,
  process_*, user, user_id, src_*, dest_* | bin span=1s | stats values(*) as * by
  _time, host | eventstats dc(dest_ip) as dc_dest by src_ip | eventstats dc(src_ip)
  as dc_src by dest_ip | eventstats dc(host) as dc_host by process_path| where (dc_dest
  < 5 AND dc_src < 5) OR dc_host < 3 OR match(process_path, "(?i)(powershell|cmd)") '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows Sysmon
- Process use of network
references:
- https://imphash.medium.com/detecting-lateral-movement-101-tracking-movement-smb-windows-admin-shares-through-windows-log-6005e3ba6980
- https://www.ired.team/offensive-security/lateral-movement/lateral-movement-via-smb-relaying-by-abusing-lack-of-smb-signing

name: PowerShell Get LocalGroup Discovery
id: b71adfcc-155b-11ec-9413-acde48001122
version: 9
creation_date: '2021-09-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies the use of the `get-localgroup` command executed via PowerShell or cmd.exe to enumerate local groups on an endpoint. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Monitoring this activity is significant as it may indicate an attacker attempting to gather information about local group memberships, which can be a precursor to privilege escalation. If confirmed malicious, this activity could allow an attacker to identify and target privileged accounts, potentially leading to unauthorized access and control over the system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=powershell.exe
            OR
            Processes.process_name=cmd.exe
        )
        (Processes.process="*get-localgroup*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_get_localgroup_discovery_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present. Tune as needed.
references:
    - https://attack.mitre.org/techniques/T1069/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '39125.70662'
title: PowerShell Hidden Window
description: 'Threat actors may attempt to conceal their activity involving PowerShell
  windows by setting the WindowStyle parameter to hidden. While legitimate administrative
  tasks may use hidden windows to perform maintainence tasks in the background, this
  technique can be used by threat actors to evade user suspicion and reduce the likelihood
  of detection. This use case detects PowerShell executions involving hidden window
  commands. PowerShell logging is recommended for detection; process creation logs
  will only detect this activity if the command is executed in a manner that creates
  a new process, such as powershell -c. Atomic Test T1564.003 - Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("-WindowStyle" OR "-w") "hidden" | regex process="(?i)-w(indowStyle)?\s+hidden"
  | table _time, host, user, process, parent_process_name | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:hide artifacts:hidden window
- execution:command and scripting interpreter
- defense-evasion:hide artifacts
technique_id:
- T1564.003
- T1059
- T1564
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.003/T1564.003.md#atomic-test-1---hidden-window
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

name: PTC Windchill Gateway Command Execution
id: d725b390-fe86-47df-b9a1-57497915403e
version: 1
creation_date: '2026-06-14'
modification_date: '2026-06-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation.
    PTC identifies `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=` request patterns as indicators to monitor during Windchill and FlexPLM exploitation response.
    Successful activity may allow an unauthenticated attacker to execute operating system commands or read files through a weaponized gateway or JSP component.
data_source:
    - Windchill Log4j
search: |-
    `windchill_log4j`
    ("WindchillGW/GW/run" OR "WindchillAuthGW/GW/run" OR "/GW/run?" OR "run?c=" OR "run?p=" OR ".jsp?c=" OR ".jsp?p=" OR "dpr_")
    | rex field=_raw "^(?:[^:\r\n]+:)?(?<log_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2},\d{3})\s+(?<log_level>\w+)\s+\[(?<thread>[^\]]+)\]\s+(?<logger>\S+)\s+-\s+(?<payload>.*)$"
    | search logger IN ("wt.servlet.ServletRequestMonitor.request", "wt.method.MethodContextMonitor.contexts.servletRequest")
    | rex field=payload "^(?<event_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d{3})\s+(?<event_tz>[+\-]\d{4}),\s+(?<rest>.*)$"
    | eval parts=split(rest,", ")
    | eval event_type=case(logger="wt.servlet.ServletRequestMonitor.request","servlet_request",logger="wt.method.MethodContextMonitor.contexts.servletRequest","method_context_servlet_request",true(),"other")
    | eval src_ip=case(event_type="servlet_request",mvindex(parts,2),event_type="method_context_servlet_request",mvindex(parts,5))
    | eval uri_path=case(event_type="servlet_request",mvindex(parts,3),event_type="method_context_servlet_request",mvindex(parts,8))
    | eval query_string=if(event_type="servlet_request",mvindex(parts,4),null())
    | eval http_method=if(event_type="servlet_request",mvindex(parts,5),null())
    | eval status=if(event_type="servlet_request",tonumber(mvindex(parts,6)),null())
    | rex field=uri_path "^(?<uri_only>[^\?]+)(?:\?(?<uri_query>.*))?$"
    | eval query_string=if(query_string="-",null(),query_string)
    | eval query_string=coalesce(query_string,uri_query)
    | rex field=query_string "(?i)(?:^|&)(?<query_param>[cp])=(?<query_value>[^&]*)"
    | eval query_param=lower(query_param), query_value=urldecode(replace(query_value,"\+","%20"))
    | where isnotnull(uri_only) AND isnotnull(query_param)
    | where (match(uri_only,"(?i)(^|/)GW/run$") OR match(uri_only,"(?i)/servlet/(WindchillGW|WindchillAuthGW)/GW/run$") OR match(uri_only,"(?i)(^|/)dpr_[0-9a-f]{8}\.jsp$")) AND (query_param="c" OR query_param="p")
    | where NOT (query_param="c" AND match(query_value,"(?i)^echo(\s|20)+GW_READY_OK$"))
    | eval activity=case(query_param="c","command_execution_parameter",query_param="p","file_read_parameter",true(),"unknown")
    | eval src=src_ip

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(log_level) as log_level
                  values(logger) as logger
                  values(http_method) as http_method
                  values(status) as status
                  values(uri_only) as uri_path
                  values(query_string) as query_string
      by src activity query_param query_value

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ptc_windchill_gateway_command_execution_filter`
how_to_implement: |
    To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`.
    Update the `windchill_log4j` macro to include the appropriate index constraints for your environment.
    The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers and parses embedded servlet URI, query parameter, source IP, HTTP method, and status fields.
known_false_positives: |
    Requests to `GW/run` or randomly named `dpr_<8 hex>.jsp` files with `c=` or `p=` parameters should not be expected during normal Windchill operation.
    Validate whether red-team testing, vulnerability scanning, or incident response replay generated the activity before closing as benign.
references:
    - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4681
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-03
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Potential PTC Windchill gateway command or file read activity detected from $src$.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - PTC Windchill Exploitation
asset_type: Web Application
cve:
    - CVE-2026-4681
mitre_attack_id:
    - T1190
    - T1059
    - T1005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '6178.6732'
title: Python Execution
description: 'Adversaries may abuse Python commands and scripts for execution. Python
  is a very popular scripting/programming language, with capabilities to perform many
  functions. - Threat Actor Association: APT28 (aka.Fancy Bear, Fighting Ursa, Forest
  Blizzard, Pawn Storm, TA422, STRONTIUM), APT36, MuddyWater, SaintBear (aka UAC-0056,
  UNC2589, TA471) - Software Association: ALPHV/BlackCat - Atomics T1046 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(python) OR "python.exe" OR ".py") | table
  _time, host, user, signature_id, process, process_*, parent_process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:python
technique_id:
- T1059.006
data_category:
- Windows event logs
references:
- https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf
- https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/

id: '12931.18578'
title: Rare Schedule Task Created
description: 'Schedule tasks are often a form of persistence utilized by threat actors.
  This use case looks for rare occurrences for when a task is created. -- Threat Actor
  Association: APT-K-47/Mysterious Elephant, CL-STA-0043, Redfly, Turla (akaSecret
  Blizzard, KRYPTON, and UAC-0003) -- Software Association: BianLian, Play'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4698) OR
  "<EventID>4698<") | eval task_name=coalesce(Task_Name, TaskName)| table _time, host,
  user process, process_*, signature_id, parent_*, task_name | bin span=1s | stats
  values(*) as * by _time, host | eventstats count by task_name| where count < 5 '
techniques:
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
- privilege-escalation:scheduled task/job:scheduled task
technique_id:
- T1053.005
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2022/04/25/quantum-ransomware/

name: Schtasks Run Task On Demand
id: bb37061e-af1f-11eb-a159-acde48001122
version: 11
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of a Windows Scheduled Task on demand via the shell or command line. It leverages process-related data, including process name, parent process, and command-line executions, sourced from endpoint logs. The detection focuses on 'schtasks.exe' with an associated 'run' command. This activity is significant as adversaries often use it to force the execution of their created Scheduled Tasks for persistent access or lateral movement within a compromised machine. If confirmed malicious, this could allow attackers to maintain persistence or move laterally within the network, potentially leading to further compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "schtasks.exe" Processes.process = "*/run*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `schtasks_run_task_on_demand_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Bear in mind, administrators debugging Scheduled Task entries may trigger this analytic, necessitating fine-tuning and filtering to distinguish between legitimate and potentially malicious use of 'schtasks.exe'.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A "on demand" execution of schedule task process $process_name$  using commandline $process$ in host $dest$
        - field: user
          type: user
          score: 20
          message: A "on demand" execution of schedule task process $process_name$  using commandline $process$ in host $dest$
analytic_story:
    - Industroyer2
    - CISA AA22-257A
    - Data Destruction
    - Qakbot
    - XMRig
    - Medusa Ransomware
    - Scheduled Tasks
asset_type: Endpoint
mitre_attack_id:
    - T1053
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31925.57055'
title: Suspicious Execution of Accessibility Tool Debuggers
description: Threat actors may establish persistence or elevate privileges by executing
  malicious content through accessibility features. Windows accessibility features
  can be launched with a key combination before user login, such as from the Windows
  logon screen. Threat actors can modify the launch process of these programs to gain
  a command prompt or backdoor access without logging into the system. This use case
  detects the execution of accessibility tools by a debugger process, which can indicate
  an attempt to gain unauthorized access or persistence through malicious use of these
  tools.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("cmd.exe" OR "cscript.exe" OR "mshta.exe" OR
  "powershell.exe" OR "pwsh.exe" OR "regsvr32.exe" OR "rundll32.exe" OR "wscript.exe"
  OR "wt.exe") ("sethc.exe" OR "utilman.exe" OR "osk.exe" OR "Magnify.exe" OR "Narrator.exe"
  OR "DisplaySwitch.exe" OR "atbroker.exe" OR "HelpPane.exe") | where isnull(parent_process_name)|
  regex process_name="(?i)(cmd|cscript|mshta|powershell|pwsh|regsvr32|rundll32|wscript|wt)\.exe"|
  regex process="(?i)(sethc|utilman|osk|Magnify|Narrator|DisplaySwitch|atbroker|HelpPane)\.exe"
  | table _time, host, user, parent_process_name, process, process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution:accessibility features
technique_id:
- T1546.008
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml

name: Suspicious Image Creation In Appdata Folder
id: f6f904c4-1ac0-11ec-806b-acde48001122
version: 13
creation_date: '2021-09-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of image files in the AppData folder by processes that also have a file reference in the same folder. It leverages data from the Endpoint.Processes and Endpoint.Filesystem datamodels to identify this behavior. This activity is significant because it is commonly associated with malware, such as the Remcos RAT, which captures screenshots and stores them in the AppData folder before exfiltrating them to a command-and-control server. If confirmed malicious, this activity could indicate unauthorized data capture and exfiltration, compromising sensitive information and user privacy.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US
    - https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
finding:
    title: Process $process_name$ creating image file $file_path$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Remcos
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1113
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Unusually Long Command Line
id: c77162d3-f93c-45cc-80c8-22f6a4264e7f
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
description: The following analytic detects unusually long command lines, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the length of command lines executed on hosts. This behavior is significant because attackers often use obfuscated or complex command lines to evade detection and execute malicious payloads. If confirmed malicious, this activity could lead to data theft, ransomware deployment, or further system compromise. Analysts should investigate the source and content of the command line, inspect relevant artifacts, and review concurrent processes to identify potential threats.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | eval processlen=len(process)
    | eventstats stdev(processlen) as stdev, avg(processlen) as avg
      BY dest
    | stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost
      BY dest, user, process_name,
         process
    | eval threshold = 3
    | where maxlen > ((threshold*stdevperhost) + avgperhost)
    | `unusually_long_command_line_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate applications start with long command lines.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Unusually long command line $process_name$ on $dest$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Command-Line Executions
    - Unusual Processes
    - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
    - Ransomware
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint