Splunk rules: 1u

id: '13728.20153'
title: AnyDesk Silent Install
description: 'An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. BlackByte ransomware group has been observed performing silent installs
  of AnyDesk after establishing a foothold. This use case detects silent installation
  of AnyDesk. - Threat Actor Association: Alloy Taurus/Gallium, Gamaredon (aka. Armageddon,
  UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944), Scatter Swine,
  UNC2659 - Software Association: Akira, ALPHV/BlackCat, AvosLocker, BianLian, BlackByte,
  BumbleBee, Clop, Conti, Diavol, Royal'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(AnyDesk) "--silent" | regex process="(?i)(anydesk.exe).*(--silent)" | table
  _time, host, user, process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html

name: Cisco ASA - User Privilege Level Change
id: 5f7d8c3e-9a2b-4d6f-8e1c-3b5a9d7f2c4e
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects privilege level changes for user accounts on Cisco ASA devices via CLI or ASDM.
    Adversaries may escalate account privileges to gain elevated access to network infrastructure, enable additional command execution capabilities, or establish higher-level persistent access. Privilege levels on Cisco ASA range from 0 (lowest) to 15 (full administrative access), with level 15 providing complete device control.
    The detection monitors for ASA message ID 502103, which is generated whenever a user account's privilege level is modified, capturing both the old and new privilege levels along with the username and administrator who made the change.
    Investigate unexpected privilege changes, especially escalations to level 15, substantial privilege increases (e.g., from level 1 to 15), changes performed outside business hours, changes by non-administrative users, or changes without corresponding change management tickets.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (502103)
    | fillnull
    | stats earliest(_time) as firstTime
            latest(_time) as lastTime
            values(action) as action
            values(message_id) as message_id
            values(old_privilege_level) as old_privilege_level
            values(new_privilege_level) as new_privilege_level
      by host user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___user_privilege_level_change_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 502103.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 502103.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Legitimate changes occur during role changes, temporary escalation for maintenance, or security policy adjustments. Verify against change management. Filter known admin accounts during maintenance windows.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773975
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: User account $user$ privilege level changed from $old_privilege_level$ to $new_privilege_level$ on Cisco ASA host $host$.
        - field: user
          type: user
          score: 20
          message: User account $user$ privilege level changed from $old_privilege_level$ to $new_privilege_level$ on Cisco ASA host $host$.
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
    - ArcaneDoor
asset_type: Network
mitre_attack_id:
    - T1078.003
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco IOS XE Remote Access Probe Burst
id: efb20922-17bc-4fb0-880c-be50cfc100dd
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-20'
author: Nasreddine Bencherchali
status: production
type: Anomaly
description: |
    This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. The Salt Typhoon notes describe repeated SSH, Telnet-to-port-22, and ping activity across multiple IP addresses in a short time window.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility IN ("AAA", "HA_EM")
    mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG")
    message_text IN ("*ssh *", "*telnet *", "*ping *")
    | rex field=message_text "^\w+:(?<aaa_src>[^:@]+)(?:@[^:]*)?:(?<aaa_user>[^:]*):(?<aaa_command>.*?)(?:\s+\((?<aaa_result>SUCCESS|FAILURE)\))?$"
    | rex field=message_text "^(?:[^:]+:\s+)?(?:catchall:\s+)?(?<eem_command>.+?)\s*$"
    | eval command=lower(trim(coalesce(aaa_command, eem_command, "")))
    | where match(command, "^(ssh|telnet|ping)\s+")
    | rex field=command "(?i)^(?:ssh(?:\s+-l\s+\S+)?|telnet|ping)\s+(?<target_ip>\d{1,3}(?:\.\d{1,3}){3})"
    | eval command_type=case(match(command, "^ssh\s+"), "ssh", match(command, "^telnet\s+"), "telnet", match(command, "^ping\s+"), "ping")
    | eval user=coalesce(aaa_user, user, "unknown")
    | eval src_ip=coalesce(aaa_src, src_ip, "unknown")
    | eval dest=coalesce(host, dvc, dest, "unknown")
    | bin _time span=10m
    | stats count as command_count
            min(_time) as firstTime
            max(_time) as lastTime
            dc(target_ip) as distinct_targets
            values(target_ip) as target_ips
            values(command_type) as command_types
            values(command) as commands
      by _time dest user src_ip
    | where command_count >= 8 OR distinct_targets >= 5
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_remote_access_probe_burst_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
    Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.
known_false_positives: |
    Network reachability testing, migration validation, and troubleshooting can generate repeated ping, SSH, or Telnet commands.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: User $user$ issued $command_count$ ping, SSH, or Telnet commands from Cisco device $dest$ across $distinct_targets$ targets.
threat_objects:
    - field: target_ips
      type: ip_address
    - field: commands
      type: command
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1018
    - T1021.004
    - T1046
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco Secure Firewall - Lumma Stealer Download Attempt
id: 66f22f52-fbae-4be7-a263-561dacb63613
version: 7
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk, Talos NTDR
status: production
type: Anomaly
description: |
    This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events.
    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64810, 64811)
    | fillnull
    | stats min(_time) as firstTime max(_time) as lastTime
            by src dest dest_port transport signature_id signature class_desc MitreAttackGroups rule InlineResult InlineResultReason app
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___lumma_stealer_download_attempt_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: False positives should be unlikely.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Lumma Stealer Download Attempt detected on host $dest$ origniating from $src$
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Lumma Stealer
asset_type: Network
mitre_attack_id:
    - T1041
    - T1573.002
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Detect Remote Access Software Usage Process
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
version: 17
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Steven Dick, Sebastian Wurl, Splunk Community
status: production
type: Anomaly
description: The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process
      from datamodel=Endpoint.Processes
      where
      [| inputlookup remote_access_software where isutility=TRUE
      | rename remote_utility AS Processes.process_name
      | fields Processes.process_name]
      AND Processes.dest!="unknown"
      AND Processes.user!="unknown"
      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name(Processes)`
    | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category
    | search isutility = TRUE
    | `remote_access_software_usage_exceptions`
    | `detect_remote_access_software_usage_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A process for a known remote access software $process_name$ was identified on $dest$.
        - field: user
          type: user
          score: 20
          message: A process for a known remote access software $process_name$ was identified on $dest$.
threat_objects:
    - field: process_name
      type: process_name
    - field: signature
      type: signature
analytic_story:
    - Insider Threat
    - Command And Control
    - Ransomware
    - Gozi Malware
    - CISA AA24-241A
    - Remote Monitoring and Management Software
    - Cactus Ransomware
    - Seashell Blizzard
    - Scattered Spider
    - Interlock Ransomware
    - GhostRedirector IIS Module and Rungan Backdoor
    - Scattered Lapsus$ Hunters
    - Storm-0501 Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Executables Or Script Creation In Suspicious Path
id: a7e3f0f0-ae42-11eb-b245-acde48001122
version: 31
creation_date: '2021-05-07'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Filesystem where
    Filesystem.file_name IN (
        "*.bat",
        "*.cmd",
        "*.com",
        "*.dll",
        "*.exe",
        "*.js",
        "*.msc",
        "*.pif",
        "*.ps1",
        "*.sys",
        "*.vbe",
        "*.vbs"
    )
    Filesystem.file_path IN (
        "*:\\PerfLogs\\*",
        "*:\\Users\\Administrator\\Music\\*",
        "*:\\Users\\Default\\*",
        "*:\\Users\\Public\\*",
        "*:\\Windows\\debug\\*",
        "*:\\Windows\\fonts\\*",
        "*:\\Windows\\Media\\*",
        "*:\\Windows\\repair\\*",
        "*:\\Windows\\servicing\\*",
        "*\\inetpub\\*",
        "*\\Microsoft\\Windows\\Libraries\\*",
        "*Recycle.bin*"
    )
    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash
       Filesystem.file_modify_time Filesystem.file_name
       Filesystem.file_path Filesystem.file_acl Filesystem.file_size
       Filesystem.process_guid Filesystem.process_id Filesystem.user
       Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `executables_or_script_creation_in_suspicious_path_filter`
how_to_implement: To successfully implement this search you need to be ingestinginformation on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: Some false positives may arise from paths like Recycle.bin and \Users\Public. Other than that executable creation and certain script extensions in these suspicious paths should be less common.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://twitter.com/pr0xylife/status/1590394227758104576
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$
threat_objects:
    - field: file_name
      type: file_name
    - field: file_path
      type: file_path
analytic_story:
    - PlugX
    - Warzone RAT
    - Swift Slicer
    - Data Destruction
    - AgentTesla
    - LockBit Ransomware
    - Volt Typhoon
    - Brute Ratel C4
    - Industroyer2
    - WhisperGate
    - DarkGate Malware
    - Chaos Ransomware
    - ValleyRAT
    - XMRig
    - Hermetic Wiper
    - Remcos
    - Quasar RAT
    - Rhysida Ransomware
    - DarkCrystal RAT
    - Qakbot
    - Snake Keylogger
    - China-Nexus Threat Activity
    - IcedID
    - CISA AA23-347A
    - Azorult
    - Handala Wiper
    - Crypto Stealer
    - Salt Typhoon
    - Earth Alux
    - Double Zero Destructor
    - Trickbot
    - Cactus Ransomware
    - BlackByte Ransomware
    - SystemBC
    - AcidPour
    - NjRAT
    - Graceful Wipe Out Attack
    - Amadey
    - Derusbi
    - AsyncRAT
    - RedLine Stealer
    - SnappyBee
    - Meduza Stealer
    - WinDealer RAT
    - MoonPeak
    - Interlock Ransomware
    - Interlock Rat
    - NailaoLocker Ransomware
    - PromptLock
    - GhostRedirector IIS Module and Rungan Backdoor
    - Lokibot
    - Castle RAT
    - SesameOp
    - DynoWiper
    - XML Runner Loader
    - Void Manticore
    - Axios Supply Chain Post Compromise
    - VIP Keylogger
    - Phantom Stealer
    - Starland RAT Campaign
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1036
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Juniper Networks Remote Code Execution Exploit Detection
id: 6cc4cc3d-b10a-4fac-be1e-55d384fc690e
version: 9
creation_date: '2023-08-29'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit a remote code execution vulnerability in Juniper Networks devices. It identifies requests to /webauth_operation.php?PHPRC=*, which are indicative of uploading and executing malicious PHP files. This detection leverages the Web data model, focusing on specific URL patterns and HTTP status codes. This activity is significant because it signals an attempt to gain unauthorized access and execute arbitrary code on the device. If confirmed malicious, the attacker could gain control over the device, leading to data theft, network compromise, or other severe consequences.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url IN ("*/webauth_operation.php?PHPRC=*") Web.status=200
      BY Web.http_user_agent, Web.status Web.http_method,
         Web.url, Web.url_length, Web.src,
         Web.dest, sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `juniper_networks_remote_code_execution_exploit_detection_filter`
how_to_implement: To implement this search, ensure that the Web data model is populated. The search is activated when the Web data model is accelerated. Network products, such as Suricata or Palo Alto, need to be mapped to the Web data model. Adjust the mapping as necessary to suit your specific products.
known_false_positives: Be aware of potential false positives - legitimate uses of the /webauth_operation.php endpoint may cause benign activities to be flagged.The URL in the analytic is specific to a successful attempt to exploit the vulnerability. Review contents of the HTTP body to determine if the request is malicious. If the request is benign, add the URL to the whitelist or continue to monitor.
references:
    - https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US
    - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36844.yaml
    - https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html
    - https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844
    - https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/
    - https://vulncheck.com/blog/juniper-cve-2023-36845
finding:
    title: This analytic has identified a potential exploitation of a remote code execution vulnerability in Juniper Networks devices on $dest$ on the URL $url$ used for the exploit.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: url
      type: url
analytic_story:
    - Juniper JunOS Remote Code Execution
asset_type: Web Server
cve:
    - CVE-2023-36844
    - CVE-2023-36845
    - CVE-2023-36846
    - CVE-2023-36847
mitre_attack_id:
    - T1190
    - T1105
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Auditd Copy Fail Privilege Escalation
id: dd16294f-44d2-40b4-a869-542c0b85113a
version: 2
creation_date: '2026-05-04'
modification_date: '2026-05-13'
author: Raven Tait, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |-
    Detects the exploitation pattern associated with Copy Fail.
    Copy Fail (CVE-2026-31431) is a logic bug in the Linux kernel's authentication cryptographic template.
    It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system.
    A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017.
    This search relies on the auditd configuration linked in the references section. If you are using a custom configuration, make sure the Key names are the same or adapt the search accordingly.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd`
    type=SYSCALL
    key IN (
        "af_alg",
        "process_creation",
        "splice_user"
    )
    | eval setuid_binary = case(
        name IN (
            "/usr/bin/chfn",
            "/usr/bin/chsh",
            "/usr/bin/fusermount3",
            "/usr/bin/gpasswd",
            "/usr/bin/mount",
            "/usr/bin/newgrp",
            "/usr/bin/passwd",
            "/usr/bin/su",
            "/usr/bin/sudo",
            "/usr/bin/umount",
            "/usr/lib/dbus-1.0/dbus-daemon-launch-helper",
            "/usr/lib/landscape/apt-update",
            "/usr/lib/openssh/ssh-keysign",
            "/usr/lib/polkit-1/polkit-agent-helper-1"
        ), name,
        exe IN (
            "/usr/bin/chfn",
            "/usr/bin/chsh",
            "/usr/bin/fusermount3",
            "/usr/bin/gpasswd",
            "/usr/bin/mount",
            "/usr/bin/newgrp",
            "/usr/bin/passwd",
            "/usr/bin/su",
            "/usr/bin/sudo",
            "/usr/bin/umount",
            "/usr/lib/dbus-1.0/dbus-daemon-launch-helper",
            "/usr/lib/landscape/apt-update",
            "/usr/lib/openssh/ssh-keysign",
            "/usr/lib/polkit-1/polkit-agent-helper-1"
        ), exe,
        true(), null()
    )
    | eval indicator = case(
        key="af_alg",        "AF_ALG socket",
        key="splice_user",   "splice syscall",
        isnotnull(setuid_binary), "setuid_exec:" . setuid_binary,
        true(),              null()
    )
    | where isnotnull(indicator)
    | stats
        dc(indicator) as unique_signals
        max(_time) as lastTime
        min(_time) as firstTime
        values(comm) as comm
        values(exe) as exe
        values(name) as name
        values(host) as dest
        values(indicator) as signals
        values(setuid_binary) as setuid_binaries
        values(pid) as pid
        values(ppid) as ppid
        values(uid) as uid
        by auid
    | where unique_signals >= 3
    | eval risk_score_factor = unique_signals * 25
    | sort - risk_score_factor
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_auditd_copy_fail_privilege_escalation_filter`
how_to_implement: |-
    To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. Ensure specifically that AF_ALG socket creation and splice syscall is being monitored. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: No false positives have been identified at this time.
references:
    - https://xint.io/blog/copy-fail-linux-distributions
    - https://github.com/theori-io/copy-fail-CVE-2026-31431
    - https://github.com/Neo23x0/auditd/blob/master/audit.rules
finding:
    title: Privilege escalation attempt leveraging the Copy Fail vulnerability was observed on $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: exe
      type: process
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2026-31431
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: PowerShell Environment Variable Execution
id: 02c1d8e9-044c-401f-906c-cc95445af8bd
version: 3
creation_date: '2026-04-29'
modification_date: '2026-06-29'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of PowerShell scripts that combine environment variable access (`$env:` or `[Environment]::SetEnvironmentVariable`) with `Invoke-Expression` or its alias `iex` to dynamically construct and run code at runtime.
    This technique is commonly used by adversaries to stage and execute payloads by embedding commands or encoded content inside environment variables, then evaluating them on the fly — effectively hiding the true execution intent from static inspection.
    Detection is based on PowerShell Script Block Logging (Event ID 4104), which captures the de-obfuscated script block before it executes.
    Triggering this analytic indicates a potential attempt to execute environment-variable-stored code, a behavior observed in malware loaders and stagers, including those associated with the VIP Keylogger campaign.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText="*$env:*"
    ScriptBlockText IN (
        "*.Invoke()*",
        "*[scriptblock]::Create*",
        "*iex *",
        "*Invoke-Expression*"
    )
    ScriptBlockText="*[Environment]::SetEnvironmentVariable*"
    | regex ScriptBlockText="(?i)((invoke-expression|iex\s+|\biex\b).*\$env:|\[scriptblock\]::create\s*\(\s*\$env:[^)]+\)\s*(?:\.\s*invoke\s*\(\s*\))?)"
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest signature signature_id user_id
         vendor_product EventID Guid
         Opcode Name Path ProcessID
         ScriptBlockId ScriptBlockText
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_environment_variable_execution_filter`
how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: No false positives have been identified at this time.
references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] executed an environment variable on host $dest$
analytic_story:
    - VIP Keylogger
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Remote System Discovery with Wmic
id: d82eced3-b1dc-42ab-859e-a2fc98827359
version: 9
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `wmic.exe` with specific command-line arguments used to discover remote systems within a domain. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to map out network resources and Active Directory structures. If confirmed malicious, this behavior could allow attackers to gain situational awareness, identify critical systems, and plan further attacks, potentially leading to unauthorized access and data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_computer* AND Processes.process="*GET ds_samaccountname*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_wmic_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic
finding:
    title: Remote system discovery enumeration on $dest$ by $user$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Curl Download to Suspicious Path
id: c32f091e-30db-11ec-8738-acde48001122
version: 22
creation_date: '2021-10-19'
modification_date: '2026-07-20'
author: Michael Haag, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    The following analytic detects the use of Windows Curl.exe to download
    a file to a suspicious location, such as AppData, ProgramData, or Public directories.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on
    command-line executions that include the -O or --output options. This activity is
    significant because downloading files to these locations can indicate an attempt
    to bypass security controls or establish persistence. If confirmed malicious, this
    behavior could lead to unauthorized code execution, data exfiltration, or further
    compromise of the system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (
      Processes.process_name=curl.exe
      OR
      Processes.original_file_name=Curl.exe
    )
    Processes.process IN ("*-O *","*--output*", "*--output-dir*")
    Processes.process IN (
          "*:\\PerfLogs\\*",
          "*:\\Windows\\Temp\\*",
          "*\\AppData\\*",
          "*\\ProgramData\\*",
          "*\\Users\\Public\\*",
          "*%AppData%*",
          "*%Public%*",
          "*%Temp%*",
          "*%tmp%*"
          )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_curl_download_to_suspicious_path_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://attack.mitre.org/techniques/T1105/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - Black Basta Ransomware
    - China-Nexus Threat Activity
    - Cisco Network Visibility Module Analytics
    - Compromised Windows Host
    - Forest Blizzard
    - GhostRedirector IIS Module and Rungan Backdoor
    - IcedID
    - Ingress Tool Transfer
    - NPM Supply Chain Compromise
    - Salt Typhoon
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DisableAntiSpyware Registry
id: 23150a40-9301-4195-b802-5bb4f43067fb
version: 13
creation_date: '2020-11-06'
modification_date: '2026-05-13'
author: Rod Soto, Jose Hernandez, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the modification of the Windows Registry key "DisableAntiSpyware" being set to disable. This detection leverages data from the Endpoint.Registry datamodel, specifically looking for the registry value name "DisableAntiSpyware" with a value of "0x00000001". This activity is significant as it is commonly associated with Ryuk ransomware infections, indicating potential malicious intent to disable Windows Defender. If confirmed malicious, this action could allow attackers to disable critical security defenses, facilitating further malicious activities such as data encryption, exfiltration, or additional system compromise.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
finding:
    title: Windows DisableAntiSpyware registry key set to 'disabled' on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - Azorult
    - Ryuk Ransomware
    - Windows Registry Abuse
    - RedLine Stealer
    - CISA AA22-264A
    - Windows Defense Evasion Tactics
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Disable Win Defender Scan On Update
id: 0418e72f-e710-4867-b656-0688e1523e09
version: 11
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that disable the Windows Defender Scan On Update feature. It leverages data from the Endpoint.Registry datamodel, specifically looking for changes to the "DisableScanOnUpdate" registry setting with a value of "0x00000001". This activity is significant because disabling automatic scans can leave systems vulnerable to malware and other threats. If confirmed malicious, this action could allow attackers to bypass Windows Defender, facilitating further compromise and persistence within the environment.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\DisableScanOnUpdate" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_scan_on_update_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender DisableScanOnUpdate feature set to enable on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Rundll32 Apply User Settings Changes
id: b9fb8d97-dbc9-4a09-804c-ff0e3862bb2d
version: 13
creation_date: '2021-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the execution of rundll32 with a call to the user32 DLL, specifically the UpdatePerUserSystemParameters function.
    This function is responsible for updating system parameters, such as desktop backgrounds, display settings, and visual themes.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions.
    This activity can be significant as it is an uncommon way to apply settings. It was also observed as part of Rhysida Ransomware activity.
    If confirmed malicious, this could allow an attacker to disguise activities or make unauthorized system changes, potentially leading to persistent unauthorized access.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    `process_rundll32`
    Processes.process = "*user32.dll*"
    Processes.process = "*UpdatePerUserSystemParameters*"

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_rundll32_apply_user_settings_changes_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
    - https://www.cisa.gov/sites/default/files/publications/aa22-264a-iranian-cyber-actors-conduct-cyber-operations-against-the-government-of-albania.pdf
    - https://cdn.pathfactory.com/assets/10555/contents/400686/13f4424c-05b4-46db-bb9c-6bf9b5436ec4.pdf
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Process $process_name$ with cmdline $process$ in host $dest$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Rhysida Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Suspect Process With Authentication Traffic
id: 953322db-128a-4ce9-8e89-56e039e33d98
version: 11
creation_date: '2023-07-28'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects executables running from public or temporary locations that are communicating over Windows domain authentication ports/protocols such as LDAP (389), LDAPS (636), and Kerberos (88). It leverages network traffic data to identify processes originating from user-controlled directories. This activity is significant because legitimate applications rarely run from these locations and attempt domain authentication, making it a potential indicator of compromise. If confirmed malicious, attackers could leverage this to access domain resources, potentially leading to further exploitation and lateral movement within the network.
data_source:
    - Sysmon EventID 3
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id  from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("88","389","636")  AND All_Traffic.app IN ("*\\users\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") by All_Traffic.action All_Traffic.app All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)`  | rex field=app ".*\\\(?<process_name>.*)$" | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)` | `windows_suspect_process_with_authentication_traffic_filter`'
how_to_implement: To implement this analytic, Sysmon should be installed in the environment and generating network events for  userland and/or known public writable locations.
known_false_positives: Known applications running from these locations for legitimate purposes. Targeting only kerberos (port 88) may significantly reduce noise.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://book.hacktricks.xyz/network-services-pentesting/pentesting-kerberos-88
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The process $process_name$ on $src$ has been communicating with $dest$ on $dest_port$.
        - field: dest
          type: system
          score: 20
          message: The process $process_name$ on $src$ has been communicating with $dest$ on $dest_port$.
        - field: user
          type: user
          score: 20
          message: The process $process_name$ on $src$ has been communicating with $dest$ on $dest_port$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint