Splunk rules: 1t

name: AWS Console Login Failed During MFA Challenge
id: 55349868-5583-466f-98ab-d3beb321961e
version: 11
creation_date: '2022-10-03'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies failed authentication attempts to the AWS Console during the Multi-Factor Authentication (MFA) challenge. It leverages AWS CloudTrail logs, specifically the `additionalEventData` field, to detect when MFA was used but the login attempt still failed. This activity is significant as it may indicate an adversary attempting to access an account with compromised credentials but being thwarted by MFA. If confirmed malicious, this could suggest an ongoing attempt to breach the account, potentially leading to unauthorized access and further attacks if MFA is bypassed.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName= ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed = "Yes"
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product additionalEventData.MFAUsed
           errorMessage
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_console_login_failed_during_mfa_challenge_filter`
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://aws.amazon.com/what-is/mfa/
finding:
    title: User $user$ failed to pass MFA challenge while logging into console from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
    - Compromised User Account
asset_type: AWS Account
mitre_attack_id:
    - T1586.003
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS IAM Delete Policy
id: ec3a9362-92fe-11eb-99d0-acde48001122
version: 8
creation_date: '2021-04-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the deletion of an IAM policy in AWS. It leverages AWS CloudTrail logs to identify `DeletePolicy` events, excluding those from AWS internal services. This activity is significant as unauthorized policy deletions can disrupt access controls and weaken security postures. If confirmed malicious, an attacker could remove critical security policies, potentially leading to privilege escalation, unauthorized access, or data exfiltration. Monitoring this behavior helps ensure that only authorized changes are made to IAM policies, maintaining the integrity and security of the AWS environment.
data_source:
    - AWS CloudTrail DeletePolicy
search: |-
    `cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com)
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_iam_delete_policy_filter`
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
references:
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
    - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

id: '44644.87460'
title: Command Line Homoglyphs - Windows
description: Threat actors may use homoglyph attacks by substituting characters in
  process names or commands with visually similar Unicode symbols to impersonate legitimate
  commands, or messages (e.g., using Cyrillic “а” instead of Latin “a”). This tactic
  is often used to evade string-based detection and confuse analysts during investigation.
  This use case detects Windows processes containing Unicode characters from commonly
  abused homoglyph ranges, including Cyrillic extended, Greek extended, and full-width
  Latin letters and digits.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) | regex process="[Ѐ-ӿͰ-Ͽａ-ｚＡ-Ｚ０-９]" | table _time,
  host, user, process, process_name, parent_process_name | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:command obfuscation
technique_id:
- T1027.010
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://app.any.run/tasks/c044f84a-fd44-47ab-b53f-976debf96e63
- https://www.zdnet.com/article/magecart-group-uses-homoglyph-attacks-to-fool-you-into-visiting-malicious-websites/
- https://www.meshsecurity.io/blog/homoglyph-attacks-understanding-and-mitigating-the-threat
- https://www.bitdefender.com/en-us/blog/businessinsights/homograph-phishing-attacks-when-user-awareness-is-not-enough

name: Detect Regsvcs with Network Connection
id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a
version: 15
creation_date: '2021-02-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies instances of Regsvcs.exe establishing a network connection to a public IP address, excluding private IP ranges. This detection leverages Sysmon EventID 3 logs to monitor network connections initiated by Regsvcs.exe. This activity is significant as Regsvcs.exe, a legitimate Microsoft-signed binary, can be exploited to bypass application control mechanisms and establish remote Command and Control (C2) channels. If confirmed malicious, this behavior could allow an attacker to escalate privileges, persist in the environment, and exfiltrate sensitive data. Immediate investigation and remediation are recommended.
data_source:
    - Sysmon EventID 3
search: |
    `sysmon`
    EventID=3
    NOT dest_ip IN (
      "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
      "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
      "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
      "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
      "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4"
    )
    process_name=regsvcs.exe
    | stats count min(_time) as firstTime max(_time) as lastTime
      by action app dest dest_ip dest_port direction dvc protocol protocol_version src
         src_ip src_port transport user vendor_product process_name process_exec process_guid
         process_id
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_regsvcs_with_network_connection_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
references:
    - https://attack.mitre.org/techniques/T1218/009/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
    - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
finding:
    title: An instance of $process_name$ contacting a remote destination was identified on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $process_name$ contacting a remote destination was identified on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Regsvcs Regasm Activity
    - Living Off The Land
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1218.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '45179.90467'
title: Exfiltration via curl.exe - Windows
description: Threat actors may abuse curl.exe on Windows systems to exfiltrate data
  or upload files to remote servers using command-line options like -d, -T, --form,
  or --upload-file. These flags are commonly used for HTTP POST requests, enabling
  attackers to transmit files or sensitive information during post-compromise activity.
  This use case detects process creation events where curl.exe is used with data or
  file upload arguments, potentially indicating data exfiltration, C2 communication,
  or malicious use of legitimate tools.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(curl) ("-d" OR "-T" OR "-F" OR " --form"
  OR "--upload-file " OR "--data " OR "--data-") | where match(process_path, "(?i)\x5ccurl\.exe")
  and (match(process, "\s-[dTF]\s") or match(process, "(?i)\s--(form|upload-file|data)\s|\s--data-"))
  | table _time, host, user, process, process_path, process_name, parent_process_name,
  user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over alternative protocol
technique_id: 
- T1048
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_fileupload.yml
- https://x.com/d1r4c/status/1279042657508081664
- https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
- https://curl.se/docs/manpage.html

name: GCP Multiple Users Failing To Authenticate From Ip
id: da20828e-d6fb-4ee5-afb7-d0ac200923d5
version: 11
creation_date: '2022-10-12'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects a single source IP address failing to authenticate into more than 20 unique Google Workspace user accounts within a 5-minute window. It leverages Google Workspace login failure events to identify potential password spraying attacks. This activity is significant as it may indicate an adversary attempting to gain unauthorized access or elevate privileges within the Google Cloud Platform. If confirmed malicious, this behavior could lead to unauthorized access to sensitive resources, data breaches, or further exploitation within the environment.
data_source:
    - Google Workspace
search: |-
    `gws_reports_login` event.type = login event.name = login_failure
      | bucket span=5m _time
      | stats count dc(user) AS unique_accounts values(user) as tried_accounts values(authentication_method) AS authentication_method earliest(_time) as firstTime latest(_time) as lastTime
        BY _time event.name src
           app id.applicationName
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | where unique_accounts > 20
      | `gcp_multiple_users_failing_to_authenticate_from_ip_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. We would also recommend tuning the detection by adjusting the window `span` and `unique_accounts` threshold values according to your environment. Specifically, this analytic leverages the User log events.
known_false_positives: No known false postives for this detection. Please review this alert.
references:
    - https://cloud.google.com/blog/products/identity-security/how-google-cloud-can-help-stop-credential-stuffing-attacks
    - https://www.slideshare.net/dafthack/ok-google-how-do-i-red-team-gsuite
    - https://attack.mitre.org/techniques/T1110/003/
    - https://www.blackhillsinfosec.com/wp-content/uploads/2020/05/Breaching-the-Cloud-Perimeter-Slides.pdf
intermediate_findings:
    entities:
        - field: tried_accounts
          type: user
          score: 20
          message: 'Multiple failed login attempts (Count: $unique_accounts$) against users seen from $src$'
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - GCP Account Takeover
asset_type: Google Cloud Platform tenant
mitre_attack_id:
    - T1110.003
    - T1110.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '1037.1050'
title: Invoke-Expression Command
description: 'Detects when PowerShell Invoke-Expression is executed. -- Threat Group
  Association: Actinium/Gamaredon/Primitive Bear, Andariel, APT29/Nobelium/Cozy Bear,
  APT31, FIN7, FIN8, Lazarus, TA505, TA551, Turla (akaSecret Blizzard, KRYPTON, and
  UAC-0003), WinterVivern/UAC-0114, Winter Vivern, WIRTE, Wizard Spider - Software
  Association: ALPHV/BlackCat, BadHatch, Bazar, Black Basta, Clop, Conti, Cring, IcedID,
  LV, Play, PowerShortShell, PurpleFox, PYSA/Mespinoza, Remcos, SamSam, SquirrelWaffle,
  Trickbot, XingLocker -- #TrendingThreat #Russia #Ukraine -- Atomics T1059.001 Test
  #1 Atomics T1059.001 Test #4 Atomics T1059.001 Test #5 Atomics T1059.001 Test #8
  Atomics T1059.001 Test #11 Atomics T1059.001 Test #13 Atomics T1135 Test #6 Atomics
  T1059.005 Test #2 Atomics T1059.005 Test #3 Atomics T1134.002 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM("invoke-expression") OR TERM("iex")) | table _time, host,
  user dvc, dvc_nt_host, event_id, parent_process_id, parent_process_path, process,
  process_id, process_name, process_path, signature_id, tag, transport `group_events("host,
  process", 1)` '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- Windows event logs
references:
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.1
- https://www.fortinet.com/blog/threat-research/offense-and-defense-a-tale-of-two-sides-powershell
- https://www.cyber.gov.au/acsc/view-all-content/publications/securing-powershell-enterprise
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ

name: Linux Ngrok Reverse Proxy Usage
id: bc84d574-708c-467d-b78a-4c1e20171f97
version: 12
creation_date: '2023-01-12'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of Ngrok on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments associated with Ngrok. This activity is significant because Ngrok can be used by adversaries to establish reverse proxies, potentially bypassing network defenses. If confirmed malicious, this could allow attackers to create persistent, unauthorized access channels, facilitating data exfiltration or further exploitation of the compromised system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=ngrok Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", "*tcp*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_ngrok_reverse_proxy_usage_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present if Ngrok is an authorized utility. Filter as needed.
references:
    - https://ngrok.com
    - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A reverse proxy was identified spawning from $parent_process_name$ -  $process_name$ on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: A reverse proxy was identified spawning from $parent_process_name$ -  $process_name$ on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Reverse Network Proxy
asset_type: Endpoint
mitre_attack_id:
    - T1572
    - T1090
    - T1102
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Sqlite3 Privilege Escalation
id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the sqlite3 command with elevated privileges, which can be exploited for privilege escalation. It leverages Endpoint Detection and Response (EDR) telemetry to identify instances where sqlite3 is used in conjunction with shell commands and sudo. This activity is significant because it indicates a potential attempt to gain root access, which could lead to full system compromise. If confirmed malicious, an attacker could execute arbitrary commands as root, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*sqlite3*"
        AND
        Processes.process="*.shell*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_sqlite3_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/sqlite3/
    - https://manpages.ubuntu.com/manpages/trusty/en/man1/sqlite3.1.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Mimikatz PassTheTicket CommandLine Parameters
id: 13bbd574-83ac-11ec-99d4-acde48001122
version: 13
creation_date: '2022-02-07'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of Mimikatz command line parameters associated with pass-the-ticket attacks. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns related to Kerberos ticket manipulation. This activity is significant because pass-the-ticket attacks allow adversaries to move laterally within an environment using stolen Kerberos tickets, bypassing normal access controls. If confirmed malicious, this could enable attackers to escalate privileges, access sensitive information, and maintain persistence within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process = "*sekurlsa::tickets /export*"
            OR
            Processes.process = "*kerberos::ptt*"
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `mimikatz_passtheticket_commandline_parameters_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
references:
    - https://github.com/gentilkiwi/mimikatz
    - https://attack.mitre.org/techniques/T1550/003/
finding:
    title: Mimikatz command line parameters for pass the ticket attacks were used on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Sandworm Tools
    - CISA AA23-347A
    - CISA AA22-320A
    - Active Directory Kerberos Attacks
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1550.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: PingID Multiple Failed MFA Requests For User
id: c1bc706a-0025-4814-ad30-288f38865036
version: 8
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within a PingID environment. It triggers when 10 or more MFA prompts fail within 10 minutes, using JSON logs from PingID. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests. If confirmed malicious, this could lead to unauthorized access, as the user might eventually accept the fraudulent request, compromising the security of the account and potentially the entire network.
data_source:
    - PingID
search: "`pingid` \"result.status\" IN (\"FAILURE,authFail\",\"UNSUCCESSFUL_ATTEMPT\") | eval time = _time, src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), object = 'resources{}.devicemodel', reason = 'result.message'| bucket span=10m _time | stats dc(_raw) AS mfa_prompts min(time) as firstTime, max(time) as lastTime values(src) as src by user, reason, _time | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | where mfa_prompts >= 10 | `pingid_multiple_failed_mfa_requests_for_user_filter`"
how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
known_false_positives: False positives may be generated by normal provisioning workflows for user device registration.
references:
    - https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/
    - https://attack.mitre.org/techniques/T1621/
    - https://attack.mitre.org/techniques/T1110/
    - https://attack.mitre.org/techniques/T1078/004/
    - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
finding:
    title: Multiple Failed MFA requests $mfa_prompts$ for user $user$ between $firstTime$ and $lastTime$.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Compromised User Account
asset_type: Identity
mitre_attack_id:
    - T1621
    - T1078
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '31190.55837'
title: PromptOnSecureDesktop Registry Value Modified
description: 'Adversaries may bypass UAC mechanisms to elevate process privileges
  on system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. The impact to the
  user ranges from denying the operation under high enforcement to allowing the user
  to perform the action if they are in the local administrators group and click through
  the prompt or allowing them to enter an administrator password to complete the action.
  This use case detects registry modification events or process executions with registry
  modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop.
  -- Software Association: 8Base'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (((TERM(EventCode=1) OR "<EventID>1<")
  "Set-ItemProperty" OR "sp " OR "ADD") OR (TERM(EventCode=13) OR "<EventID>13<"))
  "PromptOnSecureDesktop" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  | table _time, host, user, process, parent_process_name, signature_id, process_name,
  registry_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1548/002/
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md

id: '32821.58286'
title: Proxy Execution via Appcert
description: Threat actors may exploit legitimate developer utilities to execute malicious
  payloads by proxy. One such utility is appcert.exe, a command-line tool included
  in the Windows Application Certification Kit, which is typically used to verify
  the compliance of Windows applications with Microsoft's certification standards.
  This use case detects appcert executions with commands to proxy execution of another
  binary. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(appcert) OR
  "appcert.exe") TERM(test) | regex process!="(?i)\-setupcommandline"| regex process="(?i)\stest\s"|
  rex field=process "-setuppath\s+(?:\"|'')?(?<proxy_exec>[^\s\"'']+\.exe)(?:\"|'')?"
  | table _time, host, user, process, proxy_exec | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- defense-evasion:trusted developer utilities proxy execution
technique_id: 
- T1127
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1218/007/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appcert/

name: Recursive Delete of Directory In Batch CMD
id: ba570b3a-d356-11eb-8358-acde48001122
version: 14
creation_date: '2021-06-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a batch command designed to recursively delete files or directories, a technique often used by ransomware like Reddot to delete files in the recycle bin and prevent recovery. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific flags for recursive and quiet deletions. This activity is significant as it indicates potential ransomware behavior aimed at data destruction. If confirmed malicious, it could lead to significant data loss and hinder recovery efforts, severely impacting business operations.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_cmd` Processes.process=*/c*  Processes.process="* rd *" Processes.process="*/s*" Processes.process="*/q*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `recursive_delete_of_directory_in_batch_cmd_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network operator may use this batch command to delete recursively a directory or files within directory
references:
    - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
finding:
    title: Recursive Delete of Directory In Batch CMD by $user$ on $dest$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Ransomware
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5473.5639'
title: Rubeus Commands
description: 'Rubeus is a C# toolset for raw Kerberos interaction and abuses. -- Threat
  Actor Association: Wizard Spider - Software Association: Conti, Diavol, Quakbot/Qbot
  -- Atomics T1558.003 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(exe) (TERM(EventCode=4688)
  OR "<EventID>4688<") (TERM(harvest) OR TERM(ptt) OR TERM(s4u) OR TERM(asktgt) OR
  TERM(brute) OR TERM(createnetonly) OR TERM(changepw) OR TERM(hash) OR TERM(tgssub)
  OR TERM(asktgs) OR TERM(renew) OR TERM(describe) OR TERM(monitor) OR TERM(purge)
  OR TERM(klist) OR TERM(triage) OR TERM(dump) OR TERM(tgtdeleg) OR TERM(kerberoast)
  OR TERM(asreproast) OR TERM(currentluid)) |regex process="(?i)\.exe\"?\s+(((harvest|ptt|s4u|asktgt|brute|createnetonly|changepw|hash|tgssub|asktgs|renew|describe|monitor)(\s+)?\/\w+\:)|((purge|klist|triage|dump|tgtdeleg|kerberoast|asreproast|currentluid)((\s+)?\/\w+)?))"
  | table _time, host, user, signature_id, process, process_id, process_name, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge kerberos tickets
- credential-access:steal or forge kerberos tickets:golden ticket
- credential-access:steal or forge kerberos tickets:silver ticket
- credential-access:steal or forge kerberos tickets:kerberoasting
technique_id:
- T1558
- T1558.003
- T1558.002
- T1558.001
data_category:
- Windows event logs
references:
- https://github.com/GhostPack/Rubeus

id: '30491.54569'
title: Suspicious .sys Created - Windows
description: Adversaries may bring a signed vulnerable driver onto a compromised machine
  so that they can exploit the vulnerability to execute code in kernel mode. This
  process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Adversaries
  may include the vulnerable driver with files delivered during Initial Access or
  download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.
  This use case detects rare file creation events for .sys files.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=11) OR "<EventID>11<")
  ".sys" | regex file_name="(?i)\.sys$" | table _time, host, user, process_name, signature_id,
  file_name, file_path `group_events("host, process_name, file_name", 5)` | eventstats
  c(file_name) as c_file_name dc(host) as dc_host by file_name| where c_file_name
  < 3 AND dc_host=1 '
techniques:
- persistence:create or modify system process:windows service
- privilege-escalation:exploitation for privilege escalation
technique_id:
- T1543.003
- T1068
data_category:
- Windows Sysmon
references:
- https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/strategies-to-monitor-and-prevent-vulnerable-driver-attacks/ba-p/4103985
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1543/003/
- https://www.loldrivers.io/

name: Suspicious WAV file in Appdata Folder
id: 5be109e6-1ac5-11ec-b421-acde48001122
version: 12
creation_date: '2021-09-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of .wav files in the AppData folder, a behavior associated with Remcos RAT malware, which stores audio recordings in this location for data exfiltration. The detection leverages endpoint process and filesystem data to identify .wav file creation within the AppData\Roaming directory. This activity is significant as it indicates potential unauthorized data collection and exfiltration by malware. If confirmed malicious, this could lead to sensitive information being sent to an attacker's command and control server, compromising the affected system's confidentiality.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 11
    - Windows Event Log Security 4688 AND Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US
    - https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
finding:
    title: process $process_name$ creating image file $file_path$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1113
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows .Key File Creation in Root Directory
id: 90e71722-8c0f-43b4-937a-6222325976c2
version: 2
creation_date: '2021-09-02'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects the creation of a .key file in the root directory of the system drive.
    This activity was seen with various ransomware before performing encryption of files.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
    count min(_time) as firstTime
          max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.file_name="*.key"

    by Filesystem.dest Filesystem.file_create_time
       Filesystem.process_path Filesystem.process_guid
       Filesystem.process_id Filesystem.file_path
       Filesystem.action Filesystem.file_name
       Filesystem.user Filesystem.vendor_product

    | `drop_dm_object_name(Filesystem)`
    | where match(file_path, "^[A-Za-z]:\\\\[^\\\\]+\.key$")
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows__key_file_creation_in_root_directory_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may occur if legitimate software or administrative tools create key files in the root directory, although this is uncommon in normal operations. Filter alerts based on known approved applications.
references:
    - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: .key file created in the root of the system drive at $file_path$ on $dest$.
threat_objects:
    - field: file_path
      type: file_path
analytic_story:
    - Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5707.5979'
title: Windows Admin$ Share Access
description: 'Windows systems have hidden network shares that are accessible only
  to administrators and provide the ability for remote file copy and other administrative
  functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have
  had an object call. Adversaries may use this technique in conjunction with administrator-level
  Valid Accounts to remotely access a networked system. -- Threat Actor Association:
  APT35/PHOSPHORUS, BlackCat, Blackmatter, Carbanak, Darkside, FIN7, FIN8 (Syssphinx),
  Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
  TA551, Vice Society, Volt Typhoon (Bronze Silhouette, Vanguard Panda), Wizard Spider
  - Software Association: Bazar, Conti, DatopLoader, HermeticWiper/Trojan.Killdisk,
  Prestige, Prometheus / Spook, Sodinokibi/REvil, XingLocker -- Atomics T1021.002
  Test#1 Atomics T1021.002 Test#2 Atomics T1021.002 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5140) OR
  "<EventID>5140<" OR TERM(EventCode=5145) OR "<EventID>5145<") TERM(admin) | regex
  Share_Name="(?i)admin\$" | eval share_name=Share_Name, share_path=Share_Path, relative_target_name=Relative_Target_Name
  | table _time, host, user signature_id, share_*, src_ip, relative_target_name |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://support.malwarebytes.com/hc/en-us/articles/360038524714

name: Windows File and Directory Permissions Enable Inheritance
id: 0247f90a-aca4-47b2-a94d-e30f445d7b41
version: 7
creation_date: '2023-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the enabling of permission inheritance using ICACLS. This analytic identifies instances where ICACLS commands are used to enable permission inheritance on files or directories. The /inheritance:e flag, which restores inherited permissions from a parent directory, is monitored to detect changes that might reapply broader access control settings. Enabling inheritance can indicate legitimate administrative actions but may also signal attempts to override restrictive custom permissions, potentially exposing sensitive files to unauthorized access.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
        AND
        Processes.process = "*/inheritance:e*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_file_and_directory_permissions_enable_inheritance_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
references:
    - https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html
analytic_story:
    - Crypto Stealer
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1222.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Hide Notification Features Through Registry
id: cafa4bce-9f06-11ec-a7b2-acde48001122
version: 15
creation_date: '2022-03-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects suspicious registry modifications aimed at hiding common Windows notification features on a compromised host. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant as it is often used by ransomware to obscure visual indicators, increasing the impact of the attack. If confirmed malicious, this could prevent users from noticing critical system alerts, thereby aiding the attacker in maintaining persistence and furthering their malicious activities undetected.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hide_notification_features_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Registry modification to hide windows notification on $dest$
analytic_story:
    - Ransomware
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows PowerShell Invoke-RestMethod IP Information Collection
id: 8db47e12-9c3e-4f5a-b0d6-e42a1895cd4f
version: 7
creation_date: '2025-04-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. This behavior leverages PowerShell Script Block Logging to identify scripts that gather external IP information and potential geolocation data. This activity is significant as it may indicate reconnaissance efforts, where threat actors are attempting to determine the geographical location or network details of a compromised system. While some legitimate software may use these services, this pattern is commonly observed in malware and post-exploitation toolkits like those used by Water Gamayun threat actors.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText="*Invoke-RestMethod*" AND (ScriptBlockText="*ipinfo.io*" OR ScriptBlockText="*api.ipify.org*"))
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product Guid
           Opcode Name Path
           ProcessID ScriptBlockId ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_powershell_invoke_restmethod_ip_information_collection_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Some legitimate applications or administrative scripts may use these services for IP validation or geolocation. Filter as needed for approved administrative tools.
references:
    - https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/
    - https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A PowerShell script on $dest$ is collecting external IP or geolocation information using Invoke-RestMethod.
analytic_story:
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1082
    - T1016
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint