Splunk rules: 1w

name: AWS Detect Users with KMS keys performing encryption S3
id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
version: 11
creation_date: '2020-10-27'
modification_date: '2026-05-13'
author: Rod Soto, Patrick Bareiss Splunk
status: production
type: Anomaly
description: The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. It leverages AWS CloudTrail logs to detect the `CopyObject` event where server-side encryption with AWS KMS is specified. This activity is significant as it may indicate unauthorized or suspicious encryption of data, potentially masking exfiltration or tampering efforts. If confirmed malicious, an attacker could be encrypting sensitive data to evade detection or preparing it for exfiltration, posing a significant risk to data integrity and confidentiality.
data_source:
    - AWS CloudTrail
search: |-
    `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms"
      | rename requestParameters.bucketName AS bucketName, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product bucketName
           src_file dest_file
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_detect_users_with_kms_keys_performing_encryption_s3_filter`
how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
known_false_positives: There maybe buckets provisioned with S3 encryption
references:
    - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
    - https://github.com/d1vious/git-wild-hunt
    - https://www.youtube.com/watch?v=PgzNib37g0M
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$
analytic_story:
    - Ransomware Cloud
asset_type: S3 Bucket
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco NVM - Curl Execution With Insecure Flags
id: cc695238-3117-4e60-aa83-4beac2a42c69
version: 8
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy-insecure`, or `--doh-insecure`
    which disable TLS certificate validation.
    It leverages Cisco Network Visibility Module (NVM) flow data and process arguments
    to identify outbound connections initiated by curl where TLS checks were explicitly disabled.
    This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints,
    a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    process_name = "curl.exe"
    NOT dest IN (
            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
            )
    | regex process_arguments="(?i)(?<!\w)-(?:[a-z]*k[a-z]*|-(insecure|proxy-insecure|doh-insecure))"
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___curl_execution_with_insecure_flags_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Usage of these flags to reach public IPs or uncommon destinations should be reviewed.
    Tuning may be required for domains with known certificate issues.
references:
    - https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The host $src$ executed curl with insecure flags and communicated with $dest$ / $dest_hostname$ over port $dest_port$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
    - PromptLock
    - Microsoft WSUS CVE-2025-59287
asset_type: Endpoint
mitre_attack_id:
    - T1197
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco Secure Firewall - Static Tundra Smart Install Abuse
id: 7e9a5a2c-2f1a-4b6a-9a4b-9e7d9c8f5a21
version: 7
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: TTP
description: |
    This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart Install (SMI) protocol
    using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to
    identify occurrences of Smart Install exploitation and protocol abuse, including denial-of-service and buffer overflow
    attempts. The detection triggers when multiple Cisco Smart Install-related Snort signatures are observed in a short period from the
    same source, which is indicative of active exploitation or reconnaissance against Cisco devices that expose SMI.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (46468, 46096, 41722, 41723, 41724, 41725)
    | bin _time span=15m
    | fillnull
    | stats dc(signature_id) as unique_signature_count
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(dest) as dest
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
            by src
    | where unique_signature_count >= 2
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___static_tundra_smart_install_abuse_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense logs with IntrusionEvent data. It uses the `cisco_secure_firewall`
    input macro; configure it to match your environment (index, source, sourcetype). Ensure your intrusion policies include the
    relevant Smart Install signatures and that events are collected via the Splunk Add-on for Cisco Security Cloud
    (https://splunkbase.splunk.com/app/7404). The post-filter macro helps reduce known noise.
known_false_positives: |
    Network scanning or testing tools that probe Cisco Smart Install endpoints may trigger similar signatures.
    Validate against maintenance windows or approved security assessments.
references:
    - https://blog.talosintelligence.com/static-tundra/
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
finding:
    title: Smart Install exploitation or protocol abuse targeting $dest$ originating from $src$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Cisco Smart Install Remote Code Execution CVE-2018-0171
asset_type: Network
mitre_attack_id:
    - T1190
    - T1210
    - T1499
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Confluence Data Center and Server Privilege Escalation
id: 115bebac-0976-4f7d-a3ec-d1fb45a39a11
version: 11
creation_date: '2023-10-04'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, specifically targeting the /setup/*.action* URL pattern. It leverages web logs within the Splunk 'Web' Data Model, filtering for successful accesses (HTTP status 200) to these endpoints. This activity is significant as it suggests attackers might be exploiting a privilege escalation flaw in Confluence. If confirmed malicious, it could result in unauthorized access or account creation with escalated privileges, leading to potential data breaches or further exploitation within the environment.
data_source:
    - Nginx Access
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url IN ("*/setup/setupadministrator.action*", "*/setup/finishsetup.action*", "*/json/setup-restore-local.action*", "*/json/setup-restore-progress.action*", "*/json/setup-restore.action*", "*/bootstrap/selectsetupstep.action*") Web.status=200
      BY Web.http_user_agent, Web.status Web.http_method,
         Web.url, Web.url_length, Web.src,
         Web.dest, sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `confluence_data_center_and_server_privilege_escalation_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to confluence servers.
references:
    - https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html
    - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
    - https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/
    - https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis
finding:
    title: Potential exploitation attempts on a known vulnerability in Atlassian Confluence detected. The source IP is $src$ and the destination hostname is $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
    - Confluence Data Center and Confluence Server Vulnerabilities
asset_type: Web Server
cve:
    - CVE-2023-22518
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Detect Outbound SMB Traffic
id: 1bed7774-304a-4e8f-9d72-d80e45ff492b
version: 17
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Stuart Hopkins, Patrick Bareiss
status: production
type: TTP
description: The following analytic detects outbound SMB (Server Message Block) connections from internal hosts to external servers. It identifies this activity by monitoring network traffic for SMB requests directed towards the Internet, which are unusual for standard operations. This detection is significant for a SOC as it can indicate an attacker's attempt to retrieve credential hashes through compromised servers, a key step in lateral movement and privilege escalation. If confirmed malicious, this activity could lead to unauthorized access to sensitive data and potential full system compromise.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
    - Cisco Secure Access Firewall
search: |
    | tstats `security_content_summariesonly`
    earliest(_time) as start_time
    latest(_time) as end_time
    values(All_Traffic.action) as action
    values(All_Traffic.app) as app
    values(sourcetype) as sourcetype count
    from datamodel=Network_Traffic where
      All_Traffic.action IN ("allowed", "allow")
    AND (All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb")
    AND (All_Traffic.src_ip IN `non_public_ip_blocks` OR All_Traffic.src IN `non_public_ip_blocks`)
    AND NOT (All_Traffic.dest_ip IN `non_public_ip_blocks` OR All_Traffic.dest IN `non_public_ip_blocks`)
    by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
    All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
    All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
    All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.rule
    | `drop_dm_object_name("All_Traffic")`
    | `security_content_ctime(start_time)`
    | `security_content_ctime(end_time)`
    | rename dest as dest_ip
    | rename src as src_ip
    | iplocation dest_ip
    | `detect_outbound_smb_traffic_filter`
how_to_implement: This search requires you to be ingesting your network traffic and populating the Network_Traffic data model.
known_false_positives: It is likely that the outbound Server Message Block (SMB) traffic is legitimate, if the company's internal networks are not well-defined in the Assets and Identity Framework. Categorize the internal CIDR blocks as `internal` in the lookup file to avoid creating findings for traffic destined to those CIDR blocks. Any other network connection that is going out to the Internet should be investigated and blocked. Best practices suggest preventing external communications of all SMB versions and related protocols at the network boundary.
references: []
finding:
    title: An outbound SMB connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$
    entity:
        field: src_ip
        type: system
        score: 50
threat_objects:
    - field: dest_ip
      type: ip_address
analytic_story:
    - Hidden Cobra Malware
    - DHS Report TA18-074A
    - NOBELIUM Group
    - Cisco Secure Firewall Threat Defense Analytics
    - Cisco Secure Access Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1071.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '27059.49382'
title: DLL Called with Uncommon Function
description: DLLs can invoke a variety of functions when executed. While these functions
  are part of legitimate Windows operations, their execution from a DLL file, especially
  in an unusual context, can be indicative of malicious behavior. Threat actors including
  Qbot have been observed abusing this technique when calling DLLs with rundll32.exe.
  This use case detects calls of uncommon functions from DLL files, accounting for
  instances where rundll32.exe has been renamed. While these function calls may be
  legitimate, unexpected executions should be investigated. Living Off the Land Binary
  and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ".dll" ("RS32" OR "VirtualAllocEx" OR "NtUnmapViewOfSection" OR
  "CreateRemoteThread" OR "RtlCreateUserThread" OR "DeviceIoControl" OR "WriteProcessMemory"
  OR "CryptEncrypt" OR "CryptDecrypt" OR "RegSetValueEx" OR "SetWindowsHookEx" OR
  "DLLRegisterServer") | rex field=process "\.dll,(?<called_function>[^\s]+)"| where
  match(process, "(?i)\.dll\,(RS32|VirtualAllocEx|NtUnmapViewOfSection|CreateRemoteThread|RtlCreateUserThread|DeviceIoControl|WriteProcessMemory|CryptEncrypt|CryptDecrypt|RegSetValueEx|SetWindowsHookEx|DLLRegisterServer)")
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  called_function | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- PowerShell logs
references:
- https://redcanary.com/blog/lolbins-abuse/

id: '27166.49581'
title: DLLRegisterServer Called from Command Line
description: Threat actors including SocGhoulish may use explicit calls to DLLRegisterServer
  in the command line as a technique to register malicious DLLs, often bypassing standard
  registration methods like regsvr32. This use case detects instances where any process,
  including those masquerading as legitimate system utilities, explicitly invokes
  DLLRegisterServer in the command line. While such executions could be part of legitimate
  software installations or development activities, unexpected executions should be
  investigated.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ".dll" "DLLRegisterServer" | where match(process,
  "(?i)\.dll\"?,DLLRegisterServer") | table _time, host, user, process, process_*,
  parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://redcanary.com/blog/lolbins-abuse/

name: Linux Kworker Process In Writable Process Path
id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed
version: 11
creation_date: '2022-04-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of a kworker process with a command line in writable directories such as /home/, /var/log, and /tmp on a Linux machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process paths. This activity is significant as kworker processes are typically kernel threads, and their presence in writable directories is unusual and indicative of potential malware, such as CyclopsBlink. If confirmed malicious, this could allow attackers to blend malicious processes with legitimate ones, leading to persistent access and further system compromise.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_kworker_process_in_writable_process_path_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
    - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
analytic_story:
    - Sandworm Tools
    - Cyclops Blink
asset_type: Endpoint
mitre_attack_id:
    - T1036.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Monitor Registry Keys for Print Monitors
id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
version: 15
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel
status: production
type: TTP
description: The following analytic detects modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. It leverages data from the Endpoint.Registry data model, focusing on events where the registry path is modified. This activity is significant because attackers can exploit this registry key to load arbitrary .dll files, which will execute with elevated SYSTEM permissions and persist after a reboot. If confirmed malicious, this could allow attackers to maintain persistence, execute code with high privileges, and potentially compromise the entire system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: You will encounter noise from legitimate print-monitor registry entries.
references: []
finding:
    title: New print monitor added on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Suspicious Windows Registry Activities
    - Windows Persistence Techniques
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1547.010
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5697.8028'
title: Multiple Host logons
description: 'Use case looks for users who have logged into multiple hosts. -- Threat
  Actor Association: CL-STA-0043'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` type IN(user_auth, user_login)
  op IN(success, login) NOT TERM(failed) | eval user=coalesce(acct, user, id), src_ip=coalesce(addr,
  hostname) | table _time, host, user, process, process_*, parent_*, src_ip, addr,
  hostname, acct, id, res | bin span=86400s | stats values(*) as * by _time, user
  | eventstats dc(host) as dc_host by user, _time | where dc_host > 1 '
techniques:
- defense-evasion:valid accounts
technique_id: 
- T1078
data_category:
- Linux audit logs
references:
- https://www.cadosecurity.com/post/responding-to-solarigate

name: O365 Mailbox Folder Read Permission Assigned
id: 1435475e-2128-4417-a34f-59770733b0d5
version: 11
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where read permissions are assigned to mailbox folders within an Office 365 environment. It leverages the `o365_management_activity` data source, specifically monitoring the `ModifyFolderPermissions` and `AddFolderPermissions` operations, while excluding Calendar, Contacts, and PersonMetadata objects. This activity is significant as unauthorized read permissions can lead to data exposure and potential information leakage. If confirmed malicious, an attacker could gain unauthorized access to sensitive emails, leading to data breaches and compromising the confidentiality of organizational communications.
data_source:
    - O365 ModifyFolderPermissions
search: "`o365_management_activity` Workload=Exchange (Operation=ModifyFolderPermissions OR Operation=AddFolderPermissions) Workload=Exchange object!=Calendar object!=Contacts object!=PersonMetadata | eval isReadRole=if(match('Item.ParentFolder.MemberRights',\"(ReadAny)\"), \"true\", \"false\") | rename UserId as user | stats count earliest(_time) as firstTime latest(_time) as lastTime by signature user object dest Item.ParentFolder.MemberUpn Item.ParentFolder.MemberRights src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_folder_read_permission_assigned_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Mailbox folder permissions may be configured for legitimate purposes, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/002/
    - https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxodlgt/5610c6e6-3268-44e3-adff-8804f5315946
    - https://learn.microsoft.com/en-us/purview/audit-mailboxes
finding:
    title: A folder was granted read permission by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

id: '29624.53380'
title: QEMU Network Tunneling - Windows
description: 'QEMU is an open-source machine emulator that allows for running multiple
  operating systems as separate processes. The use of QEMU executions with specific
  networking commands may indicate attempts at network tunneling or bypassing security
  controls, which was observed in intrusion reported on SecureList. This use case
  detects QEMU executions with command-line arguments that could be used to tunnel
  traffic. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "qemu-system-" ("-net " OR "-netdev" OR "-redir"
  OR "socket" OR "listen" OR "-device" OR "hostfwd=") | table _time, host, user, process,
  process_*, parent_process_name, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id: 
- T1572
- T1095
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://securelist.com/network-tunneling-with-qemu/111803/

name: Windows AppCertDLL Modification Via Registry
id: 547d98dd-6d6e-4aa4-be91-a1a119f48df3
version: 1
creation_date: '2026-07-27'
modification_date: '2026-07-27'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |-
    This analytic detects attempts to modify AppCertDLL registry entries.
    Values under this registry entry are used to specify DLLs loaded by the Windows Session Manager.
    Such modifications can be abused by attackers to load malicious code early in the system startup process, enabling persistent malware execution with high privileges.
    If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls.
data_source:
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Registry WHERE

    Registry.action = "modified"
    Registry.registry_path= "*\\Control\\Session Manager\\AppCertDLLs\\*"
    Registry.registry_value_data = "*"

    by Registry.action Registry.dest Registry.process_guid Registry.process_id
       Registry.registry_hive Registry.registry_path Registry.registry_key_name
       Registry.registry_value_data Registry.registry_value_name
       Registry.registry_value_type Registry.status
       Registry.user Registry.vendor_product

    | `drop_dm_object_name(Registry)`
    | where isnotnull(registry_value_data)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_appcertdll_modification_via_registry_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: |-
    Modifications to AppCertDLL entries may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources.
references:
    - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential AppCertDLL modification with value [$registry_value_data$] activity observed on [$dest$]
threat_objects:
    - field: registry_value_data
      type: registry_value_text
analytic_story:
    - Windows Persistence Techniques
    - Windows Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1546.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AppLocker Execution from Uncommon Locations
id: d57ce957-151a-4aec-ada5-5fb1eb555b6b
version: 7
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of applications or scripts from uncommon or suspicious file paths, potentially indicating malware or unauthorized activity. It leverages Windows AppLocker event logs and uses statistical analysis to detect anomalies. By calculating the average and standard deviation of execution counts per file path, it flags paths with execution counts significantly higher than expected. This behavior is significant as it can uncover malicious activities or policy violations. If confirmed malicious, this activity could allow attackers to execute unauthorized code, leading to potential system compromise or data breaches.
data_source: []
search: |-
    `applocker`
      | spath input=UserData_Xml
      | rename RuleAndFileData.* as *, Computer as dest, TargetUser AS user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, PolicyName, RuleId,
           user, TargetProcessId, FilePath,
           FullFilePath
      | eventstats avg(count) as avg, stdev(count) as stdev
      | eval upperBound=(avg+stdev*2), anomaly=if(count > upperBound, "Yes", "No")
      | where anomaly="Yes"
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_applocker_execution_from_uncommon_locations_filter`
how_to_implement: The analytic is designed to be run against Windows AppLocker event logs collected from endpoints with AppLocker enabled. If using Microsoft Defender for Endpoint (MDE), modify the analytic to use EventTypes/ActionTypes that match the block events for AppLocker. The analytic requires the AppLocker event logs to be ingested into Splunk. Note that, an additional method to reduce any false positives would be to add the specific EventCodes - 8003 or 8004 and filter from there. Upon tuning, modify to Anomaly or TTP.
known_false_positives: False positives are possible if legitimate users are executing applications from file paths that are not permitted by AppLocker. It is recommended to investigate the context of the application execution to determine if it is malicious or not. Modify the threshold as needed to reduce false positives.
references:
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/querying-application-control-events-centrally-using-advanced-hunting
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
analytic_story:
    - Windows AppLocker
asset_type: Endpoint
mitre_attack_id:
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Audit Policy Cleared via Auditpol
id: f067f7cf-f41b-4a60-985e-c23e268a13cb
version: 9
creation_date: '2025-02-19'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of `auditpol.exe` with the "/clear" command-line argument used to clears the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_auditpol` Processes.process IN ("*/clear*", "*/remove*")
        AND
        NOT Processes.process IN ("*/resourceSACL*", "*/?*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_audit_policy_cleared_via_auditpol_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time. and understood.
references:
    - https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
    - https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
    - https://attack.mitre.org/techniques/T1562/002/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-clear
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-remove
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to clear logging on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to clear logging on endpoint $dest$ by user $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows Audit Policy Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Disable Lock Workstation Feature Through Registry
id: c82adbc6-9f00-11ec-a81f-acde48001122
version: 15
creation_date: '2022-03-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects a suspicious registry modification that disables the Lock Computer feature in Windows. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" with a value of "0x00000001". This activity is significant because it prevents users from locking their screens, a tactic often used by malware, including ransomware, to maintain control over compromised systems. If confirmed malicious, this could allow attackers to sustain their presence and execute further malicious actions without user interruption.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_lock_workstation_feature_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
    - https://heimdalsecurity.com/blog/fatalrat-targets-telegram/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Registry modification in "DisableLockWorkstation" on $dest$
analytic_story:
    - Ransomware
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Disable Win Defender App Guard
id: 8b700d7e-54ad-4d7d-81cc-1456c4703306
version: 11
creation_date: '2024-01-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that disable Windows Defender Application Guard auditing. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant because disabling auditing can hinder security monitoring and threat detection within the isolated environment, making it easier for malicious activities to go unnoticed. If confirmed malicious, this action could allow attackers to bypass Windows Defender protections, potentially leading to unauthorized access, data exfiltration, or further system compromise.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Policies\\Microsoft\\AppHVSI\\AuditApplicationGuard" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_app_guard_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender AuditApplicationGuard feature set to disable on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Registry Delete Task SD
id: ffeb7893-ff06-446f-815b-33ca73224e92
version: 13
creation_date: '2022-04-18'
modification_date: '2026-05-13'
author: Michael Haag, Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects a process attempting to delete a scheduled task's Security Descriptor (SD) from the registry path of that task.
    It leverages the Endpoint.Registry data model to identify registry actions performed by the SYSTEM user, specifically targeting deletions of the SD value.
    This activity is significant as it may indicate an attempt to remove evidence of a scheduled task for defense evasion.
    If confirmed malicious, it suggests an attacker with privileged access trying to hide their tracks, potentially compromising system integrity and security.
data_source:
    - Sysmon EventID 12
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Registry where

    Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*")
    Registry.user="SYSTEM"
    (
      Registry.registry_value_name="SD"
      OR
      Registry.registry_key_name="SD"
    )
    Registry.action=deleted

    by Registry.action Registry.dest Registry.process_guid
       Registry.process_id Registry.registry_hive
       Registry.registry_path Registry.registry_key_name
       Registry.registry_value_data Registry.registry_value_name
       Registry.registry_value_type Registry.status Registry.user
       Registry.vendor_product

    | `drop_dm_object_name(Registry)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_registry_delete_task_sd_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: |
    False positives should be limited as the activity is not common to delete ONLY the SD from the registry.
references:
    - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
    - https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728
    - https://gist.github.com/MHaggis/b246e2fae6213e762a6e694cabaf0c17
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A scheduled task security descriptor $registry_path$ was deleted from the registry on $dest$.
threat_objects:
    - field: registry_path
      type: registry_path
analytic_story:
    - Windows Registry Abuse
    - Windows Persistence Techniques
    - Scheduled Tasks
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Regsvr32 Renamed Binary
id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a
version: 13
creation_date: '2022-10-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies instances where the regsvr32.exe binary has been renamed and executed. This detection leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original filename metadata. Renaming regsvr32.exe is significant as it can be an evasion technique used by attackers to bypass security controls. If confirmed malicious, this activity could allow an attacker to execute arbitrary DLLs, potentially leading to code execution, privilege escalation, or persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name != regsvr32.exe
        AND
        Processes.original_file_name=regsvr32.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_regsvr32_renamed_binary_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
finding:
    title: regsvr32 was renamed as $process_name$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Qakbot
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1218.010
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint