Splunk rules: 1s

name: BCDEdit Failure Recovery Modification
id: 809b31d2-5462-11eb-ae93-0242ac130002
version: 15
creation_date: '2021-01-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because ransomware often disables recovery options to prevent system restoration, making it crucial for SOC analysts to investigate. If confirmed malicious, this could hinder recovery efforts, allowing ransomware to cause extensive damage and complicate remediation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `bcdedit_failure_recovery_modification_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may modify the boot configuration.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable the ability to recover the endpoint.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable the ability to recover the endpoint.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Ransomware
    - Compromised Windows Host
    - Ryuk Ransomware
    - Storm-2460 CLFS Zero Day Exploitation
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '44220.86861'
title: Browser Started with Remote Debugging - Windows
description: Threat actors may abuse browser remote debugging features to extract
  sensitive data, maintain access, or facilitate communication with C2 servers. This
  is typically done by launching the browser with specific remote debugging flags,
  allowing remote access to browser sessions and potentially bypassing traditional
  security controls. This use case detects instances where a browser is started in
  remote debugging mode.
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(Firefox) " -start-debugger-service") OR " --remote-debugging-" | where match(process,
  "(?i)\s+--remote-debugging-\S+") or (process="firefox.exe" and match(process, "(?i)\s+-start-debugger-service"))
  | table _time, host, user, process, parent_process_name, process_path | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:browser session hijacking
technique_id: 
- T1185
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf
- https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/
- https://github.com/defaultnamehere/cookie_crimes/
- https://github.com/wunderwuzzi23/firefox-cookiemonster
- https://www.trendmicro.com/en_us/research/25/c/ai-assisted-fake-github-repositories.html
- https://cyble.com/blog/fake-coding-challenges-steal-sensitive-data-via-fogdoor/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_browsers_remote_debugging/

name: Cisco Secure Firewall - Communication Over Suspicious Ports
id: d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
version: 8
creation_date: '2025-04-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    `cisco_secure_firewall` EventType=ConnectionEvent dest_port IN ("888", "999", "2200", "2222", "4000", "4444", "6789", "8531", "50501", "51820") | fillnull value="unknown" url
    | stats min(_time) as firstTime max(_time) as lastTime
          values(src_port) as src_port
          values(url) as url
          values(rule) as rule
          count by src, dest, dest_port, transport, action
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___communication_over_suspicious_ports_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The access policy must also enable logging.
    The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment
known_false_positives: |
    Some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication.
    Ephemeral ports in test environments may occasionally overlap with ports used in this detection.
    Additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Suspicious communication detected from $src$ to $dest$ over port $dest_port$.
threat_objects:
    - field: url
      type: url
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1021
    - T1055
    - T1059.001
    - T1105
    - T1219
    - T1571
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Cloud Instance Modified By Previously Unseen User
id: 7fb15084-b14e-405a-bd61-a6de15a40722
version: 12
creation_date: '2020-11-16'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: Anomaly
description: The following analytic identifies cloud instances being modified by users who have not previously modified them. It leverages data from the Change data model, focusing on successful modifications of EC2 instances. This activity is significant because it can indicate unauthorized or suspicious changes by potentially compromised or malicious users. If confirmed malicious, this could lead to unauthorized access, configuration changes, or potential disruption of cloud services, posing a significant risk to the organization's cloud infrastructure.
data_source:
    - AWS CloudTrail
search: |-
    | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command FROM datamodel=Change
      WHERE All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success
      BY All_Changes.user
    | `drop_dm_object_name("All_Changes")`
    | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
    | eventstats max(enough_data) as enough_data
    | where enough_data=1
    | eval firstTimeSeenUser=min(firstTimeSeen)
    | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
    | table firstTime user command object_id count
    | `security_content_ctime(firstTime)`
    | `cloud_instance_modified_by_previously_unseen_user_filter`
how_to_implement: This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.
known_false_positives: It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ is modifying an instance $object_id$ for the first time.
analytic_story:
    - Suspicious Cloud Instance Activities
asset_type: AWS Instance
mitre_attack_id:
    - T1078.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Cloud Instance Modifications By User - Update
    - Previously Seen Cloud Instance Modifications By User - Initial

name: Elevated Group Discovery With Wmic
id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6
version: 10
creation_date: '2021-08-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `wmic.exe` with command-line arguments querying specific elevated domain groups. It leverages Endpoint Detection and Response (EDR) telemetry to identify processes that access the LDAP namespace and search for groups like "Domain Admins" or "Enterprise Admins." This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privilege accounts within Active Directory. If confirmed malicious, this behavior could lead to privilege escalation, allowing attackers to gain elevated access and control over critical network resources.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap*) (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
    - https://adsecurity.org/?p=3658
finding:
    title: Elevated domain group discovery enumeration on $dest$ by $user$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Get DomainUser with PowerShell
id: 9a5a41d6-04e7-11ec-923c-acde48001122
version: 12
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `powershell.exe` with command-line arguments used to enumerate domain users via the `Get-DomainUser` command. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions mapped to the `Processes` node of the `Endpoint` data model. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams using PowerView for Active Directory discovery. If confirmed malicious, this could allow attackers to gain situational awareness and identify valuable targets within the domain, potentially leading to further exploitation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="cmd.exe"
            OR
            Processes.process_name="powershell*"
        )
        AND Processes.process = "*Get-DomainUser*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `get_domainuser_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
finding:
    title: an instance of process $process_name$ with commandline $process$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: an instance of process $process_name$ with commandline $process$ on $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Active Directory Discovery
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kerberoasting spn request with RC4 encryption
id: 5cc67381-44fa-4111-8a37-7a230943f027
version: 15
creation_date: '2020-06-11'
modification_date: '2026-05-13'
author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Dean Luxton, Splunk
status: production
type: TTP
description: The following analytic detects potential Kerberoasting attacks by identifying Kerberos service ticket requests with RC4 encryption through Event ID 4769. It leverages specific Ticket_Options values commonly used by Kerberoasting tools. This activity is significant as Kerberoasting allows attackers to request service tickets for domain accounts, typically service accounts, and crack them offline to gain privileged access. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the Active Directory environment.
data_source:
    - Windows Event Log Security 4769
search: |-
    `wineventlog_security` EventCode=4769 ServiceName!="*$" (TicketOptions=0x40810000 OR TicketOptions=0x40800000 OR TicketOptions=0x40810010) TicketEncryptionType=0x17
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY Computer, user, service_id,
           service, TicketEncryptionType, TicketOptions
      | rename Computer as dest
      | `security_content_ctime(lastTime)`
      | `security_content_ctime(firstTime)`
      | `kerberoasting_spn_request_with_rc4_encryption_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. Whithin environments where this type of communication is common, consider dropping the risk score and add throttling based on the user and service_id for 30 days. This will allow RBA to alert when there is an anomalous spike of these kerberoastable SPN requests within a short period of time.
known_false_positives: Older systems that support kerberos RC4 by default like NetApp may generate false positives. Filter as needed
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/4e3e9c8096dde00639a6b98845ec349135554ed5/atomics/T1208/T1208.md
    - https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-kerberoasting-activity
finding:
    title: User $user$ requested a service ticket for SPN $service_id$ with RC4 encryption
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Windows Privilege Escalation
    - Data Destruction
    - Active Directory Kerberos Attacks
    - Compromised Windows Host
    - Hermetic Wiper
asset_type: Endpoint
mitre_attack_id:
    - T1558.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux EFI Bootloader File Deletion
id: 818a63f8-f2e1-4d1b-ac95-3a4f2ec7f113
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects file deletions in the EFI boot directory. These files are responsible for initializing the Boot Manager during system startup. Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.action="deleted"
    Filesystem.file_path="/boot/efi/EFI/BOOT/*"
    Filesystem.file_name="*.efi*"

    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
       Filesystem.action Filesystem.process_guid Filesystem.process_id

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_efi_bootloader_file_deletion_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file deletion events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators or package managers may delete or replace EFI bootloader files during system updates or OS reinstallation. Filter for known maintenance windows and authorized administrative activity.
references:
    - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/
    - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/
finding:
    title: Linux EFI bootloader [$file_name$] deletion detected on [$dest$]
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Data Destruction
    - Linux Persistence Techniques
    - Ransomware
asset_type: Endpoint
cve:
    - CVE-2024-7344
mitre_attack_id:
    - T1542.001
    - T1542.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '15211.22728'
title: Member added to security-enabled global group
description: In Active Directory Users and Computers "Security Enabled" groups are
  simply referred to as Security groups. This use case looks for when a member has
  been added to a security enabled global group.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=632) OR "<EventID>632<"
  OR signature_id=632 OR TERM(EventCode=4728) OR "<EventID>4728<" OR signature_id=4728)
  | table _time, host, user dest_*, parent_*, process_*, process, signature_id, src_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:account manipulation
technique_id: 
- T1098
data_category:
- Windows event logs
references:
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4728

id: '20390.36175'
title: Possible Credential Dumping via Windows Network Providers
description: 'A Network Provider is a Windows component that facilitates the connection,
  communication, and resource sharing between a system and a network. Threat actors
  can create a rogue Network Provider to capture or "dump" credentials by intercepting
  and logging network authentication requests, such as NPPSpy. This use case detects
  modifications to registry values for Network Providers. Atomics T1003 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ((TERM(EventCode=1) OR "<EventID>1<"((TERM(reg)
  OR "reg.exe") TERM(add)) OR (TERM(EventCode=12) OR "<EventID>12<")) ("SYSTEM\\CurrentControlSet\\Services"
  "NetworkProvider") OR "SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order"
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- credential-access:os credential dumping
technique_id: 
- T1112
- T1003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.socinvestigation.com/credential-dumping-using-windows-network-providers-how-to-respond/
- https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/
- https://github.com/gtworek/PSBits/blob/master/PasswordStealing/NPPSpy/Get-NetworkProviders.ps1

id: '17539.28698'
title: Potential network connection with CVE-2023-21554
description: Exploitation of CVE-2023-21554 (aka. QueueJumper), allow unauthorized
  attackers to remotely execute arbitrary code in the context of the Windows service
  process mqsvc.exe by reaching the TCP port 1801.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR
  "EventID>5156" OR TERM(EventCode=5154) OR "EventID>5154") "1801" "MQSVC" | table
  _time, host, user, signature_id, process, process_*, parent_process_*, src_ip, dest_ip
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:exploitation of remote services
technique_id: 
- T1210
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1048.003/T1048.003.md
- https://socfortress.medium.com/data-exfiltration-using-icmp-and-how-to-detect-it-69a799cca234

id: '31298.56022'
title: PowerHuntShares Commands
description: Adversaries may look for folders and drives shared on remote systems
  as a means of identifying sources of information to gather as a precursor for Collection
  and to identify potential systems of interest for Lateral Movement. Networks often
  contain shared network drives and folders that enable users to access file directories
  on various systems across a network. Adversaries may attempt to get a listing of
  valid accounts, usernames, or email addresses on a system or within a compromised
  environment. This information can help adversaries determine which accounts exist,
  which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks,
  or account takeovers (e.g., Valid Accounts). Adversaries may attempt to get a listing
  of other systems by IP address, hostname, or other logical identifier on a network
  that may be used for Lateral Movement from the current system. This use case detects
  PowerHuntShares' commands used for network share/account/remote system discovery.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(Invoke-HuntSMBShares) OR TERM(Get-CardCreationTime) OR TERM(Get-CardLastAccess)
  OR TERM(Get-CardLastModified) OR TERM(Get-PercentDisplay) OR TERM(Get-ExPrivSumData)
  OR TERM(Get-GroupOwnerBar) OR TERM(Get-GroupNameBar) OR TERM(Get-GroupFileBar) OR
  TERM(Get-UserAceCounts) OR TERM(Convert-DataTableToHtmlTable) OR TERM(Convert-DataTableToHtmlReport)
  OR TERM(Get-FolderGroupMd5) OR TERM(Get-LdapQuery) OR TERM(Get-DomainSubnet) OR
  TERM(Invoke-Parallel) OR TERM(checkSubnet)) | table _time, host, user, process,
  parent_process, process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:network share discovery
- discovery:account discovery
- discovery:remote system discovery
technique_id: 
- T1135
- T1087
- T1018
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1135/
- https://attack.mitre.org/techniques/T1087/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/NetSPI/PowerHuntShares/tree/main
- https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations/

name: Powershell COM Hijacking InprocServer32 Modification
id: ea61e291-af05-4716-932a-67faddb6ae6f
version: 10
creation_date: '2022-09-26'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to modify or add a Component Object Model (COM) entry to the InProcServer32 path within the registry using PowerShell. It leverages PowerShell ScriptBlock Logging (EventCode 4104) to identify suspicious script blocks that target the InProcServer32 registry path. This activity is significant because modifying COM objects can be used for persistence or privilege escalation by attackers. If confirmed malicious, this could allow an attacker to execute arbitrary code or maintain persistent access to the compromised system, posing a severe security risk.
data_source:
    - Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*Software\\Classes\\CLSID\\*\\InProcServer32*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_com_hijacking_inprocserver32_modification_filter`'
how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the PowerShell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: False positives will be present if any scripts are adding to inprocserver32. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1546/015/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
    - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
finding:
    title: A PowerShell script has been identified with InProcServer32 within the script code on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Malicious PowerShell
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1546.015
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5743.6020'
title: PowerShell Script Keylogger
description: 'Detect PowerShell calls to GetKeyState or GetAsyncKeyState, or known
  API calls associated with Keylogging - Software Association: VawTrakAtomics T1056.001
  Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  TERM(EventCode=4104)) ("GetAsyncKeyState" OR "GetKeyState" OR "SetWindowsHookEx"
  OR "getkeyboardstate" OR "Get-Keystrokes") | rex field=Message (?<keyword>"(?i)GetAsyncKeyState|GetKeyState|SetWindowsHookEx|getkeyboardstate|Get-Keystrokes")|
  rex field=process (?<script>"(?i)[A-Za-z0-9-_]+\.ps1") | table _time, host, user
  process, process_*, signature_id, script | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- credential-access:input capture:keylogging
- collection:input capture:keylogging
technique_id:
- T1059.001
- T1056.001
data_category:
- PowerShell logs
references:
- https://github.com/samratashok/nishang/blob/master/Gather/Keylogger.ps1

name: Suspicious MSBuild Rename
id: 4006adac-5937-11eb-ae93-0242ac130002
version: 14
creation_date: '2021-01-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of renamed instances of msbuild.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because msbuild.exe is a legitimate tool often abused by attackers to execute malicious code while evading detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name!=msbuild.exe
        AND
        Processes.original_file_name=MSBuild.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_msbuild_rename_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may use a moved copy of msbuild, triggering a false positive.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
    - https://github.com/infosecn1nja/MaliciousMacroMSBuild/
analytic_story:
    - Trusted Developer Utilities Proxy Execution MSBuild
    - Masquerading - Rename System Utilities
    - Living Off The Land
    - Cobalt Strike
    - BlackByte Ransomware
    - Graceful Wipe Out Attack
    - Storm-2460 CLFS Zero Day Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1036.003
    - T1127.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '16171.24332'
title: Suspicious Parent Process for lsass.exe or services.exe
description: This use case detects when either the Windows local security authority
  subsystem (lsass.exe) or service control manager (services.exe) are executed as
  a child from an unexpected parent process. This can indicate process injection/hollowing,
  masquerading, or other suspicious activity. The expected parent process for these
  services is wininit.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("lsass.exe" OR "services.exe") | regex process_path="(?i)\x5csystem32\x5c(lsass|services)\.exe"|
  regex parent_process_name!="(?i)wininit\.exe"| where isnotnull(parent_process_name)
  and not match(parent_process_name, "^-$") | table _time, host, user process, process_*,
  parent_process_name, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:masquerading:masquerade task or service
- defense-evasion:process injection
technique_id:
- T1036.004
- T1055
data_category:
- Windows event logs
references:
- https://andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/

name: Windows ConHost with Headless Argument
id: d5039508-998d-4cfc-8b5e-9dcd679d9a62
version: 11
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the unusual invocation of the Windows Console Host process (conhost.exe) with the undocumented --headless parameter. This detection leverages Endpoint Detection and Response (EDR) telemetry, specifically monitoring for command-line executions where conhost.exe is executed with the --headless argument. This activity is significant for a SOC as it is not commonly used in legitimate operations and may indicate an attacker's attempt to execute commands stealthily. If confirmed malicious, this behavior could lead to persistence, lateral movement, or other malicious activities, potentially resulting in data exfiltration or system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=conhost.exe Processes.process="*--headless *"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_conhost_with_headless_argument_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present if the application is legitimately used, filter by user or endpoint as needed.
references:
    - https://x.com/embee_research/status/1559410767564181504?s=20
    - https://x.com/GroupIB_TI/status/1719675754886131959?s=20
finding:
    title: Windows ConHost with Headless Argument detected on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Windows ConHost with Headless Argument detected on $dest$ by $user$.
analytic_story:
    - Spearphishing Attachments
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1564.003
    - T1564.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows File Collection Via Copy Utilities
id: dbdd556d-9da8-4c42-9980-8a3ffe25a758
version: 6
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of Windows command-line copy utilities, such as xcopy, to systematically collect files from user directories and consolidate them into a centralized location on the system. This activity is often indicative of malicious behavior, as threat actors frequently use such commands to gather sensitive information, including documents with .doc, .docx, and .pdf extensions. The detection focuses on identifying recursive copy operations targeting user folders, such as Documents, Desktop, or other directories that commonly store personal or organizational files. Malware that performs this behavior typically attempts to evade detection by using legitimate Windows utilities, executing commands through cmd.exe or other scripting hosts, and writing the collected files to directories like C:\ProgramData or temporary storage locations. Once collected, the information may be staged for exfiltration, used for lateral movement, or leveraged for further compromise of the environment. By monitoring for these types of file collection patterns, security teams can identify suspicious activity early, differentiate between normal administrative tasks and potentially malicious scripts, and prevent sensitive data from being exfiltrated. This analytic is particularly relevant for environments where confidential documents are present and attackers may attempt to harvest them using built-in Windows tools.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    (
      Processes.process_name IN ("copy.exe", "xcopy.exe")
      OR
      Processes.original_file_name IN ("copy.exe", "xcopy.exe")
    )
    Processes.process IN (
      "*.7z*",
      "*.bmp*",
      "*.db*",
      "*.doc*",
      "*.gif*",
      "*.gz*",
      "*.jpg*",
      "*.log*",
      "*.pdf*",
      "*.png*",
      "*.ppt*",
      "*.rar*",
      "*.rtf*",
      "*.tar*",
      "*.txt*",
      "*.xls*",
      "*.zip*"
    )
    by Processes.action Processes.dest Processes.original_file_name
    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
    Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_file_collection_via_copy_utilities_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may execute this command for testing or auditing.
references:
    - https://cert.gov.ua/article/6284730
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to collect documents..
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to collect documents..
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - LAMEHUG
asset_type: Endpoint
mitre_attack_id:
    - T1119
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows LAPS Password Gathering Via PowerShell Script
id: 02b712b6-5996-4537-b72a-cad3cb1bb3b4
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects attempts to gather LAPS passwords via PowerShell and the ms-Mcs-AdmPwd property.
    Microsoft LAPS (Local Administrator Password Solution) is a Windows native tool used to manage local Administrator accounts within an AD domain.
    To keep things simple, instead of requiring an administrator to manually set, rotate, and store the local Administrator passwords, LAPS will do this automatically while providing an easy interface for authorized users to access passwords for recovery and/or other admin-related tasks.
    The benefits to an organization here are obvious: automate and protect a well-known critical security challenge and free up IT resources on your team.
    However, the fact that LAPS has so much information means that it provides a potential avenue of attack for malicious actors looking to further compromise an environment.
    If LAPS isn't properly locked down, an organization can inadvertently allow anybody to grab local Admin powers on a given machine.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventID="4104"
    ScriptBlockText="*Get-AdComputer*"
    ScriptBlockText="*ms-Mcs-AdmPwd*"
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
         Opcode Name Path ProcessID ScriptBlockId

    | rename Computer as dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_laps_password_gathering_via_powershell_script_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate administrative tasks and authorized tools use PowerShell to access LAPS passwords for maintenance and recovery. Filter alerts to exclude approved administrative activities.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential LAPS password gathering activity observed on $dest$ via script block $ScriptBlockId$.
analytic_story:
    - Credential Dumping
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1552
    - T1003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Mimikatz Crypto Export File Extensions
id: 3a9a6806-16a8-4cda-8d73-b49d10a05b16
version: 10
creation_date: '2023-02-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of files with extensions commonly associated with the Mimikatz Crypto module. It leverages the Endpoint.Filesystem data model to identify specific file names indicative of certificate export activities. This behavior is significant as it may indicate the use of Mimikatz to export cryptographic keys, which is a common tactic for credential theft. If confirmed malicious, this activity could allow an attacker to exfiltrate sensitive cryptographic material, potentially leading to unauthorized access and further compromise of the environment.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_name IN ("*.keyx.rsa.pvk","*sign.rsa.pvk","*sign.dsa.pvk","*dsa.ec.p8k","*dh.ec.p8k", "*.pfx", "*.der")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `drop_dm_object_name(Filesystem)`
    | `windows_mimikatz_crypto_export_file_extensions_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives may be present and may need to be reviewed before this can be turned into a TTP. In addition, remove .pfx (standalone) if it's too much volume.
references:
    - https://github.com/gentilkiwi/mimikatz/blob/master/mimikatz/modules/kuhl_m_crypto.c#L628-L645
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Certificate file extensions realted to Mimikatz were identified on disk on $dest$.
analytic_story:
    - Sandworm Tools
    - CISA AA23-347A
    - Windows Certificate Services
asset_type: Endpoint
mitre_attack_id:
    - T1649
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Disable Windows Security Center Notif
id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b
version: 11
creation_date: '2022-06-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows registry aimed at disabling Windows Security Center notifications. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the registry path "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" with a value of "0x00000000". This activity is significant as it can indicate an attempt by adversaries or malware, such as Azorult, to evade defenses by suppressing critical update notifications. If confirmed malicious, this could allow attackers to persist undetected, potentially leading to further exploitation and compromise of the host system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windows_security_center_notif_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: administrators may enable or disable this feature that may cause some false positive.
references:
    - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
    - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: the registry for security center notification settings was modified to disable mode on $dest$
analytic_story:
    - Azorult
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Non Discord App Access Discord LevelDB
id: 1166360c-d495-45ac-87a6-8948aac1fa07
version: 11
creation_date: '2024-02-22'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects non-Discord applications accessing the Discord LevelDB database. It leverages Windows Security Event logs, specifically event code 4663, to identify file access attempts to the LevelDB directory by processes other than Discord. This activity is significant as it may indicate attempts to steal Discord credentials or access sensitive user data. If confirmed malicious, this could lead to unauthorized access to user profiles, messages, and other critical information, potentially compromising the security and privacy of the affected users.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\discord\\Local Storage\\leveldb*") AND process_name != *\\discord.exe AND NOT (process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_non_discord_app_access_discord_leveldb_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: No false positives have been identified at this time.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A non-discord process $process_name$ accessing discord "leveldb" file on $dest$
analytic_story:
    - StealC Stealer
    - Snake Keylogger
    - PXA Stealer
    - BlankGrabber Stealer
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Process Injection Wermgr Child Process
id: 360ae6b0-38b5-4328-9e2b-bc9436cddb17
version: 12
creation_date: '2022-10-27'
modification_date: '2026-08-18'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies a suspicious instance of wermgr.exe spawning a child process unrelated to error or fault handling. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process relationships and command-line executions. This activity is significant as it can indicate Qakbot malware, which injects malicious code into wermgr.exe to evade detection and execute malicious actions. If confirmed malicious, this behavior could allow an attacker to conduct reconnaissance, execute arbitrary code, and persist within the network, posing a severe security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name = "wermgr.exe"
        AND
        NOT (Processes.process_name IN ("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe"))
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_process_injection_wermgr_child_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: wermgr parent process has a child process $process_name$ on $dest$
analytic_story:
    - Qakbot
    - Windows Error Reporting Service Elevation of Privilege Vulnerability
    - RoguePlanet
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint