Splunk rules: 1v

name: ASL AWS ECR Container Upload Outside Business Hours
id: 739ed682-27e9-4ba0-80e5-a91b97698213
version: 12
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects the upload of new containers to AWS Elastic Container Service (ECR) outside of standard business hours through AWS CloudTrail events. It identifies this behavior by monitoring for `PutImage` events occurring before 8 AM or after 8 PM, as well as any uploads on weekends. This activity is significant for a SOC to investigate as it may indicate unauthorized access or malicious deployments, potentially leading to compromised services or data breaches. Identifying and addressing such uploads promptly can mitigate the risk of security incidents and their associated impacts.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=PutImage
      | eval hour=strftime(time/pow(10,3), "%H"), weekday=strftime(time/pow(10,3), "%A")
      | where hour >= 20 OR hour < 8 OR weekday=Saturday OR weekday=Sunday
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region api.request.data
           bucketName
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_ecr_container_upload_outside_business_hours_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: When your development is spreaded in different time zones, applying this rule can be difficult.
references:
    - https://attack.mitre.org/techniques/T1204/003/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Container uploaded outside business hours from $user$
analytic_story:
    - Dev Sec Ops
asset_type: AWS Account
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Cisco ASA - Reconnaissance Command Activity
id: 6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe.
    Adversaries who gain initial access to network infrastructure devices typically perform systematic reconnaissance to understand the device configuration, network topology, security policies, connected systems, and potential attack paths. This reconnaissance phase involves executing multiple "show" commands to enumerate device details, running configurations, active connections, routing information, and VPN sessions.
    The detection monitors for command execution events (message ID 111009) containing reconnaissance-oriented "show" commands (such as show running-config, show version, show interface, show crypto, show conn, etc.) and triggers when 7 or more distinct reconnaissance commands are executed within a 5-minute window by the same user.
    Investigate reconnaissance bursts from non-administrative accounts, unusual source IP addresses, activity during off-hours, methodical command sequences suggesting automated enumeration, or reconnaissance activity correlated with other suspicious behaviors.
    We recommend adapting the detection filters to exclude known legitimate administrative activities.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111009)
    command IN (
        "show access-list*",
        "show capture*",
        "show conn*",
        "show cpu*",
        "show crypto*",
        "show eigrp*",
        "show failover*",
        "show flow*",
        "show interface*",
        "show inventory*",
        "show ip*",
        "show license*",
        "show memory*",
        "show nat*",
        "show ospf*",
        "show process*",
        "show running-config*",
        "show startup-config*",
        "show version*",
        "show vpn-sessiondb*",
        "show xlate*"
    )
    | fillnull

    ```
    Normalize command variations to base command types to count distinct reconnaissance categories.
    For example, "show running-config", "show running-config | include username", and "show running-config interface" all count as one command type.
    This prevents adversaries from evading detection by adding arguments or using multiple variations of the same command.
    ```

    | eval command_type=case(
        match(command, "^show access-list"), "show access-list",
        match(command, "^show conn"), "show conn",
        match(command, "^show cpu"), "show cpu",
        match(command, "^show crypto"), "show crypto",
        match(command, "^show eigrp"), "show eigrp",
        match(command, "^show failover"), "show failover",
        match(command, "^show flow"), "show flow",
        match(command, "^show interface"), "show interface",
        match(command, "^show inventory"), "show inventory",
        match(command, "^show ip"), "show ip",
        match(command, "^show license"), "show license",
        match(command, "^show memory"), "show memory",
        match(command, "^show nat"), "show nat",
        match(command, "^show ospf"), "show ospf",
        match(command, "^show process"), "show process",
        match(command, "^show running-config"), "show running-config",
        match(command, "^show startup-config"), "show startup-config",
        match(command, "^show version"), "show version",
        match(command, "^show vpn-sessiondb"), "show vpn-sessiondb",
        match(command, "^show xlate"), "show xlate",
        true(), command)

    | bin _time span=5m

    | stats count
            earliest(_time) as firstTime
            latest(_time) as lastTime
            dc(command_type) as unique_recon_commands
            values(command_type) as command_types
            values(command) as commands
            values(src_ip) as src_ip
            values(message_id) as message_id
            values(action) as action
      by _time host user

    | where unique_recon_commands >= 7
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___reconnaissance_command_activity_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111009.
    If your logging level is set to 'Debugging', these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 111009.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Legitimate sequences occur during troubleshooting, health checks, upgrades, audits, or automation scripts. Verify against change management.
    Filter known admin accounts, trusted management stations, or adjust threshold based on baseline.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/S/asa-command-ref-S/sa-shov-commands.html
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: User $user$ executed $unique_recon_commands$ distinct reconnaissance commands of type $command_types$ within a 5-minute window on Cisco ASA host $host$, indicating potential reconnaissance activity.
        - field: user
          type: user
          score: 20
          message: User $user$ executed $unique_recon_commands$ distinct reconnaissance commands of type $command_types$ within a 5-minute window on Cisco ASA host $host$, indicating potential reconnaissance activity.
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
asset_type: Network
mitre_attack_id:
    - T1082
    - T1590.001
    - T1590.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco IOS XE WebUI Programmatic Configuration
id: f9686576-a23d-4c4d-bfad-a45499dc448a
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-19'
author: Nasreddine Bencherchali
status: production
type: Anomaly
description: |
    This analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility="SYS"
    mnemonic="CONFIG_P"
    message_text="*Configured programmatically by process SEP_webui_wsma_http*"
    | rex field=_raw "process\s(?<process>\S+)\sfrom.*as\s(?<user>\S+)\son\s(?<vty>\S+)"
    | eval dest=coalesce(host, dvc, dest, "unknown")
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(process) as process
                  values(vty) as vty
      by dest user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_webui_programmatic_configuration_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
    Enable WebUI activity logging by IOS-XE.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ performed Cisco IOS-XE WebUI programmatic configuration on $dest$.
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1190
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '21030.37459'
title: Command Line Spawned by Archive Utility - Windows
description: 'This use case detects command line utility executions with an archive
  utility as a parent process. CVE-2023-38831 -- Threat Actor Association: APT28,
  APT40, Sandworm Team, UAC-0057 (GhostWriter)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("winrar.exe" OR "rar.exe" OR "7z*.exe" OR "peazip.exe"
  OR "powerarc.exe" OR "bandizip.exe" OR "zipware.exe" OR "winzip.exe" OR "powershell.exe"
  OR "cmd.exe" OR "wscript.exe" OR "cscript.exe" OR "regsvr32.exe" OR "rundll32.exe"
  OR "wmic.exe" OR "control.exe") | where match(parent_process_path, "(?i)(winrar|rar|7z.*|peazip|powerarc|bandizip|zipware|winzip*)\.exe")
  and match(process_name, "(?i)(powershell(_ise?)|pwsh|cmd|wscript|cscript|regsvr32|rundll32|wmic|control)\.exe")
  | table _time, host, user parent_*, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter
- execution:user execution:malicious file
technique_id:
- T1059
- T1204.002
data_category:
- Windows event logs
references:
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/

name: Creation of Shadow Copy
id: eb120f5f-b879-4a63-97c1-93352b5df844
version: 13
creation_date: '2019-12-11'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the creation of shadow copies using Vssadmin or Wmic. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because creating shadow copies can be a precursor to ransomware attacks or data exfiltration, allowing attackers to bypass file locks and access sensitive data. If confirmed malicious, this behavior could enable attackers to maintain persistence, recover deleted files, or prepare for further malicious activities, posing a significant risk to the integrity and confidentiality of the system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*
        )
        OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `creation_of_shadow_copy_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create false positives.
references:
    - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
    - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Volt Typhoon
    - Compromised Windows Host
    - Credential Dumping
asset_type: Endpoint
mitre_attack_id:
    - T1003.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1116.1229'
title: Executable Create Script Process
description: 'A BAT file is a DOS batch file used to execute commands with the Windows
  Command Prompt (cmd.exe), this usecase will detect common scripting type like bat,
  sh, and ps1 with an executable parent. -- Threat Actor Association: APT28 (aka.Fancy
  Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, APT31, APT35/Phosphorus/Magic Hound, APT41, APT43, Blind Eagle/APT-C-36, FIN8,
  Gamaredon Group/Shuckworm, GoldenJackal, Karakurt, Mustang Panda (aka. Stately Taurus//Earth
  Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA413, UAC-0057 (GhostWriter), Vice
  Society, Volt Typhoon, Winter Vivern, Witchetty, Wizard Spider -- Software Association:
  ALPHV/BlackCat, AvosLocker, Bazarloader, BianLian, Black Basta, Blackbyte, Clop,
  Conti, Dharma, Emotet, Hive, LV, Prestige, PYSA/Mespinoza, Quantum, Rhysida, Royal,
  Snatch, Vice Society, TargetCompany, Trigona, XingLocker, Zloader - Atomics T1547.001
  Test#6 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<") OR Type=Process) AND (".exe") AND (".bat" OR ".ps1" OR ".sh")
  | regex parent_process_name="(?i)\w+\.(exe)"| regex process="(?i)\w+\.(bat|ps1|sh)"
  | table _time, host, user, signature_id, process, process_name, parent_process_path,
  parent_process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- exfiltration:automated exfiltration
- execution:command and scripting interpreter:windows command shell
- collection:automated collection
technique_id:
- T1059
- T1020
- T1059.003
- T1119
data_category:
- Windows event logs
references:
- https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html

name: GCP Detect gcploit framework
id: a1c5a85e-a162-410c-a5d9-99ff639e5a52
version: 8
creation_date: '2020-10-08'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: experimental
type: TTP
description: The following analytic identifies the use of the GCPloit exploitation framework within Google Cloud Platform (GCP). It detects specific GCP Pub/Sub messages with a function timeout of 539 seconds, which is indicative of GCPloit activity. This detection is significant as GCPloit can be used to escalate privileges and facilitate lateral movement from compromised high-privilege accounts. If confirmed malicious, this activity could allow attackers to gain unauthorized access, escalate their privileges, and move laterally within the GCP environment, potentially compromising sensitive data and critical resources.
data_source: []
search: |-
    `google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s
      | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent
      | `gcp_detect_gcploit_framework_filter`
how_to_implement: You must install splunk GCP add-on. This search works with gcp:pubsub:message logs
known_false_positives: Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects
references:
    - https://github.com/dxa4481/gcploit
    - https://www.youtube.com/watch?v=Ml09R38jpok
finding:
    title: Possible use of gcploit framework from $src$ by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - GCP Cross Account Activity
asset_type: GCP Account
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Kubernetes Falco Shell Spawned
id: d2feef92-d54a-4a19-8306-b47c6ceba5b2
version: 10
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects instances where a shell is spawned within a Kubernetes container. Leveraging Falco, a cloud-native runtime security tool, this analytic monitors system calls within the Kubernetes environment and flags when a shell is spawned. This activity is significant for a SOC as it may indicate unauthorized access, allowing an attacker to execute arbitrary commands, manipulate container processes, or escalate privileges. If confirmed malicious, this could lead to data breaches, service disruptions, or unauthorized access to sensitive information, severely impacting the Kubernetes infrastructure's integrity and security.
data_source:
    - Kubernetes Falco
search: |-
    `kube_container_falco` "A shell was spawned in a container"
    |  fillnull
    | stats count by container_image container_image_tag container_name parent proc_exepath process user
    | `kubernetes_falco_shell_spawned_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A shell is spawned in the container $container_name$ by user $user$.
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: LOLBAS Rare Network Connection
id: d09b66cc-269b-4675-81b5-a3dabe4f5ac2
version: 1
creation_date: '2026-08-24'
modification_date: '2026-08-24'
author: Steven Dick, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access.
    It leverages the Network Traffic data model and focuses on native Windows binaries where any public destination should be investigated and explicitly approved.
    This activity may indicate proxy execution, process injection, payload download, command-and-control, or other abuse of trusted binaries to evade security controls.
    Keep in mind that some of these binaries, such as Netsh.exe, Gpscript.exe, Wmic.exe, etc., will occasionally communicate with public network resources to perform their intended function.
    Exclude said processes from the detection if they are too noisy for your environment.
    Join this detection with the Process Execution events to provide context and avoid false positives.
data_source:
    - Sysmon EventID 3
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Network_Traffic.All_Traffic where

    All_Traffic.app IN (
        "*\\at.exe",
        "*\\atbroker.exe",
        "*\\certoc.exe",
        "*\\diskshadow.exe",
        "*\\dnscmd.exe",
        "*\\extexport.exe",
        "*\\forfiles.exe",
        "*\\gpscript.exe",
        "*\\infdefaultinstall.exe",
        "*\\installutil.exe",
        "*\\makecab.exe",
        "*\\mavinject.exe",
        "*\\microsoft.workflow.compiler.exe",
        "*\\msconfig.exe",
        "*\\netsh.exe",
        "*\\notepad.exe",
        "*\\odbcconf.exe",
        "*\\offlinescannershell.exe",
        "*\\pcalua.exe",
        "*\\pcwrun.exe",
        "*\\pnputil.exe",
        "*\\rasautou.exe",
        "*\\regasm.exe",
        "*\\register-cimprovider.exe",
        "*\\regsvcs.exe",
        "*\\regsvr32.exe",
        "*\\runonce.exe",
        "*\\runscripthelper.exe",
        "*\\schtasks.exe",
        "*\\scriptrunner.exe",
        "*\\stordiag.exe",
        "*\\ttdinject.exe",
        "*\\tttracer.exe",
        "*\\verclsid.exe",
        "*\\wab.exe",
        "*\\wmic.exe",
        "*\\xwizard.exe"
        )

    NOT All_Traffic.dest_ip IN (
            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
            "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
            "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32",
            "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
            "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
            "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24",
            "203.0.113.0/24", "240.0.0.0/4"
        )

    by All_Traffic.action All_Traffic.app All_Traffic.dest
       All_Traffic.dest_ip All_Traffic.dest_port
       All_Traffic.direction All_Traffic.dvc All_Traffic.protocol
       All_Traffic.protocol_version All_Traffic.src
       All_Traffic.src_ip All_Traffic.src_port
       All_Traffic.transport All_Traffic.user
       All_Traffic.vendor_product

    | `drop_dm_object_name(All_Traffic)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `lolbas_rare_network_connection_filter`
how_to_implement: |-
    To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model.
known_false_positives: |-
    Limited legitimate administrative automation and scripts may cause false positives.
    Any recurring use of these binaries for public network access should be reviewed, approved, and filtered with the analytic filter macro.
    Notepad.exe can now communicate with Microsoft's service "apsaiservices.microsoft.com" over port 443 to provide AI services. Apply filtering if this behavior is known in your environment.
    PowerShell, PowerShell ISE, PowerShell 7 (pwsh.exe), and cmd.exe are intentionally excluded from this analytic because they are too noisy.
references:
    - https://lolbas-project.github.io/#
    - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A rare public network connection from LOLBAS process [$app$] was observed on [$src$] to [$dest_ip$] over port [$dest_port$].
threat_objects:
    - field: app
      type: process_name
    - field: dest_ip
      type: ip_address
analytic_story:
    - Fake CAPTCHA Campaigns
    - Living Off The Land
    - Malicious Inno Setup Loader
    - Water Gamayun
    - APT37 Rustonotto and FadeStealer
    - GhostRedirector IIS Module and Rungan Backdoor
    - Hellcat Ransomware
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1105
    - T1567
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: network

id: '8200.10098'
title: Modify Group Policy
description: 'Adversaries may modify Group Policy Objects (GPOs) to subvert the intended
  discretionary access controls for a domain, usually with the intention of escalating
  privileges on the domain. Group policy allows for centralized management of user
  and computer settings in Active Directory (AD). This use case looks for event codes
  associated with modifications to policy objects. -- Software Association: Black
  Basta, CaddyWiper, Conti, HermeticWiper, Hive, LV, Play, Prestige, Royal'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5136) OR
  TERM(EventCode=5137) OR TERM(EventCode=5138) OR TERM(EventCode=5139) OR TERM(EventCode=5141)
  OR "<EventID>5136<" OR "<EventID>5137<" OR "<EventID>5138<" OR "<EventID>5139<"
  OR "<EventID>5141<") | table _time, host, user signature | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:domain policy modification:group policy modification
- privilege-escalation:domain policy modification:group policy modification
technique_id:
- T1484.001
data_category:
- Windows event logs
references:
- https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/

name: MS Scripting Process Loading WMI Module
id: 2eba3d36-14a6-11ec-a682-acde48001122
version: 10
creation_date: '2021-09-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the loading of WMI modules by Microsoft scripting processes like wscript.exe or cscript.exe. It leverages Sysmon EventCode 7 to identify instances where these scripting engines load specific WMI-related DLLs. This activity is significant because it can indicate the presence of malware, such as the FIN7 implant, which uses JavaScript to execute WMI queries for gathering host information to send to a C2 server. If confirmed malicious, this behavior could allow attackers to collect sensitive system information and maintain persistence within the environment.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: automation scripting language may used by network operator to do ldap query.
references:
    - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
    - https://attack.mitre.org/groups/G0046/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $process_name$ loading wmi modules $ImageLoaded$ on $dest$
analytic_story:
    - FIN7
asset_type: Endpoint
mitre_attack_id:
    - T1059.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5982.29666'
title: MSHTA.exe execution
description: 'Detect use of MSHTA. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT37, APT43, FIN7, Kimsuky, MuddyWater, TA551, TA576, UAC-0057 (GhostWriter),
  Wizard Spider -- Software Association: Bazar, Conti, PYSA/Mespinoza, Trickbot, XingLocker,
  Zloader Atomics T1218.005 Test#1 Atomics T1218.005 Test#2 Atomics T1218.005 Test#3
  Atomics T1218.005 Test#4 Atomics T1218.005 Test#5 Atomics T1218.005 Test#6 Atomics
  T1218.005 Test#7 Atomics T1218.005 Test#8 Atomics T1218.005 Test#9 Atomics T1218.005
  Test#10 Atomics T1059.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<") (TERM(mshta.exe) OR TERM(mshta)) | table _time, host, user process,
  process_*, parent_*, signature_id, src_*, dest_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process_name, "(?i)mshta") OR match(process, "(?i)mshta")
  OR (match(parent_process_name, "(?i)mshta") and match(process_name, "(?i)cmd|powershell")) '
techniques:
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1218.005
data_category:
- PowerShell logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- ired.team/offensive-security/code-execution/t1170-mshta-code-execution
- https://attackiq.com/2020/04/20/fingerprinting-fin7/

name: O365 New Email Forwarding Rule Enabled
id: ac7c4d0a-06a3-4278-aa59-88a5e537f981
version: 10
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of new email forwarding rules in an Office 365 environment via the UpdateInboxRules operation. It leverages Office 365 management activity events to detect rules that forward emails to external recipients by examining the OperationProperties for specific forwarding actions. This activity is significant as it may indicate unauthorized email redirection, potentially leading to data exfiltration. If confirmed malicious, attackers could intercept sensitive communications, leading to data breaches and information leakage.
data_source: []
search: "`o365_management_activity` Workload=Exchange Operation=UpdateInboxRules | eval match1=mvfind('OperationProperties{}.Value', \"ForwardToRecipientsAction\") | eval match2=mvfind('OperationProperties{}.Value', \"ForwardAsAttachmentToRecipientsAction\") | eval match3=mvfind('OperationProperties{}.Value', \"RedirectToRecipientsAction\") | eval index = mvfind('OperationProperties{}.Name', \"ServerRule\") | where match1>=0 OR match2>= 0 OR match3>= 0 | eval ServerRule = mvindex('OperationProperties{}.Value',index-1) | spath input=ServerRule path=Actions{}.Recipients{}.Values{}.Value output=valueExtracted | mvexpand valueExtracted | search valueExtracted=\"*@*.*\" | eval ForwardTo=if(match(valueExtracted,\"^[^@]+@[^@]+\\\\.[^@]+$\"), valueExtracted, null) | dedup ForwardTo | where isnotnull(ForwardTo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by signature dest user src vendor_account vendor_product ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_enabled_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Users may create email forwarding rules for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1114/003/
finding:
    title: A forwarding email inbox rule was created for $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: Okta User Logins from Multiple Cities
id: a3d1df37-c2a9-41d0-aa8f-59f82d6192a8
version: 9
creation_date: '2020-04-02'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances where the same Okta user logs in from different cities within a 24-hour period. This detection leverages Okta Identity Management logs, analyzing login events and their geographic locations. Such behavior is significant as it may indicate a compromised account, with an attacker attempting unauthorized access from multiple locations. If confirmed malicious, this activity could lead to account takeovers and data breaches, allowing attackers to access sensitive information and potentially escalate their privileges within the environment.
data_source:
    - Okta
search: |-
    | tstats  `security_content_summariesonly` values(Authentication.app) as app values(Authentication.action) as action values(Authentication.user) as user values(Authentication.reason) as reason values(Authentication.dest) as dest values(Authentication.signature) as signature  values(Authentication.method) as method FROM datamodel=Authentication
      WHERE Authentication.signature=user.session.start
      BY _time Authentication.src
    | `drop_dm_object_name("Authentication")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | iplocation src
    | stats count min(_time) as firstTime max(_time) as lastTime dc(src) as distinct_src dc(City) as distinct_city values(src) as src values(City) as City values(Country) as Country values(action) as action
      BY user
    | where distinct_city > 1
    | `okta_user_logins_from_multiple_cities_filter`
how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: It is uncommon for a user to log in from multiple cities simultaneously, which may indicate a false positive.
references:
    - https://attack.mitre.org/techniques/T1110/003/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A user [$user$] has logged in from multiple cities [$City$] from IP Address - [$src$]. Investigate further to determine if this was authorized.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Okta Account Takeover
asset_type: Okta Tenant
mitre_attack_id:
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Suspicious IcedID Rundll32 Cmdline
id: bed761f8-ee29-11eb-8bf3-acde48001122
version: 12
creation_date: '2021-07-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a suspicious `rundll32.exe` command line used to execute a DLL file, a technique associated with IcedID malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing the pattern `*/i:*`. This activity is significant as it indicates potential malware attempting to load an encrypted DLL payload, often named `license.dat`. If confirmed malicious, this could allow attackers to execute arbitrary code, leading to further system compromise and potential data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_rundll32` Processes.process=*/i:*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_icedid_rundll32_cmdline_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: limitted. this parameter is not commonly used by windows application but can be used by the network operator.
references:
    - https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
finding:
    title: rundll32 process $process_name$ with commandline $process$ in host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - IcedID
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '41487.76907'
title: Suspicious reCAPTCHA Command Line
description: This use case detects commonly abused LOLBAS utilities referencing reCAPTCHA
  in the command line.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("powershell.exe" OR "pwsh.exe" OR "cmd.exe" OR "services.exe" OR "dllhost.exe"
  OR "rundll32.exe" OR "cscript.exe" OR "wscript.exe" OR "mshta.exe" OR "regsvr32.exe")
  (TERM(reCAPTCHA) OR TERM(robot) OR TERM(human)) | regex process_path="(?i)(powershell|pwsh|cmd|services|dllhost|rundll32|mshta|regsvr32|cscript|wscript)\.exe"|
  where match(process, "(?i)\sreCAPTCHA\s|I\s+am\s+not\s+a\s+robot|Verify\s+you\s+are\s+human")
  or match(parent_process, "(?i)\sreCAPTCHA\s|I\s+am\s+not\s+a\s+robot|Verify\s+you\s+are\s+human")
  | table _time, host, user parent_*, process_*, process| search `apply_al(AVL_R76907`|
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- execution:command and scripting interpreter
technique_id: 
- T1218
- T1059
data_category:
- Windows Sysmon
references:
- https://www.reliaquest.com/blog/using-captcha-for-compromise/
- https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection

id: '7826.9433'
title: SyncAppvPublishingServer Execution
description: 'Microsoft binary used by App-v to get App-v server lists. This tool
  can be used to execute powershell commands without invoking powershell. Living Off
  the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Threat Actor Association: APT28
  (Fancy Bear, Tsar Team), TA576'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("SyncAppvPublishingServer.exe" OR "SyncAppvPublishingServer.vbs")
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
- https://www.ired.team/offensive-security/code-execution/powershell-without-powershell

name: Windows AD add Self to Group
id: 065f2701-b7ea-42f5-9ec4-fbc2261165f9
version: 11
creation_date: '2024-07-01'
modification_date: '2026-06-01'
author: Dean Luxton
status: production
type: TTP
description: This analytic detects instances where a user adds themselves to an Active Directory (AD) group. This activity is a common indicator of privilege escalation, where a user attempts to gain unauthorized access to higher privileges or sensitive resources. By monitoring AD logs, this detection identifies such suspicious behavior, which could be part of a larger attack strategy aimed at compromising critical systems and data.
data_source:
    - Windows Event Log Security 4728
search: |-
    `wineventlog_security` EventCode IN (4728)
      | where lower(user)=lower(src_user)
      | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc
        BY signature, Group_Name, src_user,
           dest
      | `windows_ad_add_self_to_group_filter`
how_to_implement: This analytic requires eventCode 4728 to be ingested.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: $user$ added themselves to AD Group $Group_Name$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Sneaky Active Directory Persistence Tricks
    - Medusa Ransomware
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: audit

name: Windows Default Group Policy Object Modified
id: fe6a6cc4-9e0d-4d66-bcf4-2c7f44860876
version: 13
creation_date: '2023-03-28'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects modifications to default Group Policy Objects (GPOs) using Event ID 5136. It monitors changes to the `Default Domain Controllers Policy` and `Default Domain Policy`, which are critical for enforcing security settings across domain controllers and all users/computers, respectively. This activity is significant because unauthorized changes to these GPOs can indicate an adversary with privileged access attempting to deploy persistence mechanisms or execute malware across the network. If confirmed malicious, such modifications could lead to widespread compromise, allowing attackers to maintain control and execute arbitrary code on numerous hosts.
data_source:
    - Windows Event Log Security 5136
search: |-
    `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber (ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" OR ObjectDN="CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*")
      | stats min(_time) as firstTime max(_time) as lastTime
        BY ObjectDN SubjectUserSid AttributeValue
           Computer DSName dest
      | rename AttributeValue as versionNumber
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_default_group_policy_object_modified_filter`
how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1484/
    - https://attack.mitre.org/techniques/T1484/001
    - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
    - https://adsecurity.org/?p=2716
finding:
    title: A default group policy object was modified on $Computer$ by $SubjectUserSid$
    entity:
        field: SubjectUserSid
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: Computer
          type: system
          score: 50
          message: A default group policy object was modified on $Computer$ by $SubjectUserSid$
analytic_story:
    - Active Directory Privilege Escalation
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1484.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint