Splunk rules: 1x

name: AWS Bedrock Claude Unusually Large Prompts
id: 95fbdd4e-1202-4971-b85a-513b2005086e
version: 2
creation_date: '2026-07-06'
modification_date: '2026-07-08'
author: Rod Soto
status: production
type: Anomaly
description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service.
data_source:
    - AWS Bedrock Claude
search: |-
    `aws_bedrock_claude`
    | rename "input.inputTokenCount" AS input_tokens
    | rename "identity.arn" AS user_arn
    | rename "accountId" AS account_id
    | rex field=user_arn "assumed-role/[^/]+/(?<user>[^\"]+)$"
    | eval input_tokens=tonumber(input_tokens)
    | where input_tokens>0
    | eventstats avg(input_tokens) AS avg_tokens stdev(input_tokens) AS stdev
    | where input_tokens > avg_tokens + (1*stdev)
    | where input_tokens > 1000
    | table _time, modelId, user, user_arn, account_id, input_tokens, avg_tokens, host
    | sort - input_tokens
    | `aws_bedrock_claude_unusually_large_prompts_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land.
known_false_positives: Possible false positives may arise from legitimate user interactions with the AI model that require large input prompts, such as complex queries or multi-turn conversations. It is important to review the context of the detected prompts to determine if they represent actual prompt injection attempts or benign usage.
references:
    - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/
    - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock
    - https://research.splunk.com/stories/aws_bedrock_security/
    - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Unusually large prompt detected on $host$ with $input_tokens$ input tokens, exceeding the statistical baseline of $avg_tokens$ average tokens.
analytic_story:
    - Suspicious AWS Bedrock Claude Activities
asset_type: Web Application
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Detect RClone Command-Line Usage
id: 32e0baea-b3f1-11eb-a2ce-acde48001122
version: 19
creation_date: '2021-05-13'
modification_date: '2026-07-14'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the usage of `rclone.exe` with specific command-line arguments indicative of file transfer activities. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as `rclone.exe` is often used by adversaries for data exfiltration, especially during ransomware attacks. If confirmed malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and potential loss of sensitive information. Immediate isolation of the affected endpoint and further investigation are recommended.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (Processes.original_file_name="rclone.exe" OR Processes.process_name="rclone.exe")
    Processes.process IN (
            "*copy*", "*mega*", "*pcloud*", "*ftp*",
            "*--config*", "*--progress*", "*--no-check-certificate*",
            "*--ignore-existing*", "*--auto-confirm*", "*--transfers*",
            "*--multi-thread-streams*"
            )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    |  `security_content_ctime(lastTime)`
    | `detect_rclone_command_line_usage_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed.
references:
    - https://redcanary.com/blog/rclone-mega-extortion/
    - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
    - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Storm-0501 Ransomware
    - Hellcat Ransomware
    - DarkSide Ransomware
    - Ransomware
    - Black Basta Ransomware
    - Cactus Ransomware
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1020
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi System Clock Manipulation
id: 910df401-b215-4675-88c5-2ad7b06d82a5
version: 4
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies a significant change to the system clock on an ESXi host, which may indicate an attempt to manipulate timestamps and evade detection or forensic analysis
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*NTPClock*" AND Message="*system clock stepped*" | rex field=_raw "stepped to (?<epoch_time>\d+\.\d+),.+delta\s(?<delta>\d+)\s" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | eval epoch_time=tonumber(epoch_time) | eval delta=tonumber(delta) | eval event_time=round(_time, 0) | eval direction=if(epoch_time < event_time, "backward", "forward") | eval original_time=if(direction=="backward", epoch_time + delta, epoch_time - delta) | eval stepped_to_str=strftime(epoch_time, "%Y-%m-%d %H:%M:%S") | eval original_time_str=strftime(original_time, "%Y-%m-%d %H:%M:%S") | stats min(_time) as firstTime max(_time) as lastTime count by dest direction original_time_str stepped_to_str epoch_time delta | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_system_clock_manipulation_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed
finding:
    title: Large time change on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1070.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '35367.62204'
title: Expand.exe Execution
description: expand.exe is a legitimate Windows utility used to extract files from
  compressed .cab archives. Threat actors have been observed abusing expand.exe to
  unpack malicious payloads hidden within .cab files on compromised systems. This
  use case detects expand.exe executions with .cab file extensions or references to
  suspicious path locations. Allowlisting expected processes with full file paths
  and command lines where possible is recommended for best fidelity. Living Off the
  Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<") OR Type=Process) "expand.exe" (".cab" OR "/F:" OR "-F:" OR "\\ProgramData"
  OR "\\Public" OR "\\AppData\\Local\\Temp\\" OR "\\AppData\\Roaming\\Temp\\") | where
  match(process_name, "(?i)expand\.exe") and match(process, "(?i)\.cab|(-|\/)F:|\x5cAppData\x5c|(Local|Roaming)\x5cTemp\x5c")
  and not (match(parent_process_path, "(?i):\x5cProgram\sFiles\s\(x86\)\x5cDell\x5cUpdateService\x5cServiceShell\.exe")
  and match(process, "(?i):\x5cProgramData\x5cDell\x5cUpdateService\x5cTemp\x5c"))
  | table _time, host, user, process, process_name, parent_process_path, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:hide artifacts:ntfs file attributes
technique_id:
- T1105
- T1564.004
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Expand/
- https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml
- https://www.threatdown.com/blog/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
- https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/

name: Hiding Files And Directories With Attrib exe
id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1
version: 18
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the use of the Windows binary attrib.exe to hide files or directories by marking them with specific flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments that include the "+h" flag. This activity is significant because hiding files can be a tactic used by attackers to conceal malicious files or tools from users and security software. If confirmed malicious, this behavior could allow an attacker to persist in the environment undetected, potentially leading to further compromise or data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=attrib.exe (Processes.process=*+h*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `hiding_files_and_directories_with_attrib_exe_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some applications and users may legitimately use attrib.exe to interact with the files.
references: []
finding:
    title: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
analytic_story:
    - Windows Persistence Techniques
    - Malicious Inno Setup Loader
    - Azorult
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
    - Crypto Stealer
    - VIP Keylogger
asset_type: Endpoint
mitre_attack_id:
    - T1222.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5398.5498'
title: Impacket PSexec
description: 'Impackets psexec.py enables users to execute commands or gain an interactive
  shell on a remote host. -- Threat Actor Association: APT28 (aka.Fancy Bear, Fighting
  Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), Cadet Blizzard, UNC5221, UTA0178
  - Software Association: LockBit, Vice Society -- Atomics T1021.002 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR TERM(EventCode=5145) OR "<EventID>5145<")| regex _raw="(?i)(\w{8}\.exe)|(psexec)"
  | eval file_name=Relative_Target_Name| where match(parent_process_name, "(?i)(\w{8}\.exe)|(psexec)")
  or match(file_name, "(?i)(\w{8}\.exe)|(psexec)") | table _time, host, user signature_id,
  user, dest_host, process_id, process_name, process_path, process, parent_process_id,
  parent_process_name, parent_process_path, file_name | bin span=10s | stats values(*)
  as * by _time, host | where match(signature_id, "4688") and match(signature_id,
  "5145") '
techniques:
- execution:system services:service execution
- lateral-movement:remote services
technique_id:
- T1569.002
- T1021
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py

name: Linux Auditd Possible Access To Sudoers File
id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834
version: 14
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects potential access or modification of the /etc/sudoers file on a Linux system.
    It leverages data from Linux Auditd, focusing on events of type PATH or CWD.
    This activity could be significant because the sudoers file controls user permissions for executing commands with elevated privileges.
    Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
    If confirmed malicious, an attacker could gain persistence or escalate privileges, compromising the security of the targeted host.
data_source:
    - Linux Auditd Path
    - Linux Auditd Cwd
search: |
    `linux_auditd`
    (type=PATH OR type=CWD)
    | rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"

    | stats
      values(type) as types
      values(name) as names
      values(nametype) as nametype
      values(cwd) as cwd_list
      values(_time) as event_times
      by audit_id, host

    | eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
    | eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
    | eval matched_paths = mvfilter(match(candidate_paths, "/etc/sudoers.*"))
    | eval match_count = mvcount(matched_paths)
    | eval reconstructed_path = mvindex(matched_paths, 0)
    | eval e_time = mvindex(event_times, 0)
    | where match_count > 0
    | rename host as dest

    | stats count min(e_time) as firstTime max(e_time) as lastTime
      values(nametype) as nametype
      by current_working_directory
         reconstructed_path
         match_count
         dest
         audit_id

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_auditd_possible_access_to_sudoers_file_filter`
how_to_implement: |
    To implement this detection, the process begins by ingesting auditd
    data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
    executions and process details on Unix/Linux systems. These logs should be ingested
    and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
    which is essential for correctly parsing and categorizing the data. The next step
    involves normalizing the field names  to match the field names set by the Splunk
    Common Information Model (CIM) to ensure consistency across different data sources
    and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
    Administrator or network operator can execute this command.
    Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1548/003/
    - https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $reconstructed_path$ has been accessed for potential modification or deletion on host - [$dest$]
analytic_story:
    - Linux Persistence Techniques
    - Compromised Linux Host
    - China-Nexus Threat Activity
    - Salt Typhoon
    - Linux Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux MOTD Script Added
id: 6dd14256-559b-4364-99d8-0968407b8074
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation of a file within the /etc/update-motd.d directory.
    This is used to add scripts that run with Message of the Day (MOTD) when a user logs in.
    This can be used by attackers for persistence if it contains malicious code.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.file_path="/etc/update-motd.d/*"
    Filesystem.action IN ("created", "modified")

    by Filesystem.file_path Filesystem.file_name
       Filesystem.user Filesystem.dest
       Filesystem.action Filesystem.process_guid
       Filesystem.process_id

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_motd_script_added_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators may add or modify MOTD scripts for valid operational purposes such as displaying system information or login banners. Filter based on known administrative activity and authorized users.
references:
    - https://github.com/Aegrah/PANIX
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential MOTD Script [$file_name$] added by [$user$] on [$dest$].
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Linux Persistence Techniques
    - Linux Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1547
    - T1037
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS Hidden Files and Directories
id: 51c43b7b-e406-45d2-9bad-5c67f07e6528
version: 3
creation_date: '2026-04-14'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data.
    Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information.
    By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where

    (
        Processes.process="*chflags *"
        Processes.process="* hidden*"
    )
    OR
    (
        Processes.process="*xattr *"
        Processes.process="* -wx *"
        Processes.process="*com.apple.FinderInfo*"
    )

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_hidden_files_and_directories_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Power users or developers utilizing build tools or CI/CD tools could trigger this activity.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://ss64.com/mac/chflags.html
    - https://ss64.com/mac/xattr.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Attempt to hide files on $dest$ by $user$ via $process$
        - field: dest
          type: system
          score: 20
          message: Attempt to hide files on $dest$ by $user$ via $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1564.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '9019.12103'
title: Network Connection with Suspicious Folder
description: 'Detects potential downloads to suspicious file locations like temp,
  appdata, and downloads. - Threat Actor Association: Alloy Taurus/Gallium, Lazarus,
  NewsPenguin, OilRig, TA413 - Software Association: LOWZERO, Vidar Stealer'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=5156 OR "Event>ID<5156")
  ("Temporary Internet Files" OR TERM("TEMP") OR TERM("Downloads") OR TERM("Appdata"))
  | regex process_path="(?i)Temp|Downloads|Appdata" | table _time, host, user dest,
  direction, event_id, eventtype, parent_*, process, process_*, user, user_id, src_*,
  dest_* | bin span=1s | stats values(*) as * by _time, host, process_path '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows event logs
references: null

name: Network Share Discovery Via Dir Command
id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa
version: 7
creation_date: '2023-05-23'
modification_date: '2026-08-05'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: |-
    The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity.
    This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution.
    If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
data_source:
    - Windows Event Log Security 5140
search: |-
    `wineventlog_security`
    EventCode=5140
    ShareName IN (
        "\\\\*\\Admin$",
        "\\\\*\\C$",
        "\\\\*\\IPC$"
    )


    ```
    We select only read-related operations:
        0x1 = ReadData (or ListDirectory)
    ```

    | eval AccessMask_ = tonumber(AccessMask, 16)
    | where (bit_and(AccessMask_, 1) != 0)

    | stats min(_time) as firstTime
            max(_time) as lastTime
            count

    by ShareName IpAddress ObjectType SubjectUserName
       SubjectDomainName IpPort AccessMask Computer

    | rename Computer as dest

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `network_share_discovery_via_dir_command_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
known_false_positives: |-
    System Administrators may use tools like "net.exe", "net1.exe", or "dir" for troubleshooting or administrations tasks.
    However, this will typically come only from certain users and certain systems that can be added to an allow list.
references:
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140#table-of-file-access-codes
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140
analytic_story:
    - IcedID
asset_type: Endpoint
atomic_guid:
    - 13daa2cf-195a-43df-a8bd-7dd5ffb607b5
mitre_attack_id:
    - T1135
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6127.6609'
title: NMAP Execution
description: 'Adversaries may attempt to get a listing of other systems by IP address,
  hostname, or other logical identifier on a network that may be used for Lateral
  Movement from the current system. This use case looks for executions of nmap that
  have been passed an IPv4 Address. -- Threat Actor Association: Alloy Taurus/Gallium'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (TERM(nmap) type IN("proctitle",
  "execve", "USER_CMD")) | regex process="(?i)nmap\s.+?(\d{1,3}\.){3}\d{1,3}" | table
  _time, host, user, process, process_*, type | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- discovery:remote system discovery
technique_id: 
- T1018
data_category:
- Process command-line parameters
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

name: O365 Email Suspicious Search Behavior
id: 3b6e1d36-6916-4eec-a7d5-bc98953ba595
version: 6
creation_date: '2025-01-08'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a mailbox within a limited timeframe. This behavior may indicate that a malicious actor has gained control of a mailbox and is conducting discovery or enumeration activities.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Operation=SearchQueryInitiatedExchange
    | eval command = case(Operation=="SearchQueryPerformed",SearchQueryText,true(),QueryText), UserId = lower(UserId), signature_id = CorrelationId, signature=Operation, src = ClientIP, user = lower(UserId), object_name=case(Operation=="SearchQueryPerformed",'EventData',true(),QuerySource), -time = _time, suspect_terms = case(match(command, `o365_suspect_search_terms_regex`),command,true(),null())
    | where command != "*" AND command != "(*)"
    | bin _time span=1hr
    | stats values(ScenarioName) as app, values(object_name) as object_name values(command) as command, values(suspect_terms) as suspect_terms, values(src) as src, dc(suspect_terms) as suspect_terms_count, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time
    | where count > 20 OR suspect_terms_count >= 2
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_email_suspicious_search_behavior_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must also enable SearchQueryInitiated category as part of your organizations mailbox audit logging policy. The thresholds and match terms set within the analytic are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
known_false_positives: Users searching excessively or possible false positives related to matching conditions.
references:
    - https://learn.microsoft.com/en-us/purview/audit-get-started#step-3-enable-searchqueryinitiated-events
    - https://www.cisa.gov/sites/default/files/2025-01/microsoft-expanded-cloud-logs-implementation-playbook-508c.pdf
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
    - https://attack.mitre.org/techniques/T1114/002/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ searched email suspiciously, $count$ unique terms and $suspect_terms_count$ suspect terms were searched within a limited timeframe.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
    - Office 365 Collection Techniques
    - Compromised User Account
    - CISA AA22-320A
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.002
    - T1552
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 External Identity Policy Changed
id: 29af1725-7a72-4d2d-8a18-e697e79a62d3
version: 9
creation_date: '2024-04-13'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when changes are made to the external guest policies within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. This detection also attempts to highlight what may have changed. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`.
data_source:
    - Office 365 Universal Audit Log
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update policy.\" Target{}.ID=\"B2BManagementPolicy\" | eval object_attrs = mvindex('ModifiedProperties{}.NewValue',0), object_attrs_old = mvindex('ModifiedProperties{}.OldValue',0), object_name = mvindex('Target{}.ID',3), signature=Operation, user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"), mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | spath input=object_attrs_old output=B2BOld path={} | spath input=B2BOld | rename B2BManagementPolicy.* as B2BManagementPolicyOld.* | spath input=object_attrs output=B2BNew path={} | spath input=B2BNew | eval object_attrs = 'B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' , object_attrs_old = 'B2BManagementPolicyOld.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' | eval diff_add=mvmap(object_attrs,if(isnull(mvfind(object_attrs_old,object_attrs)),object_attrs,null)) | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs,object_attrs_old)),object_attrs_old,null)) | eval result = case(isnotnull(diff_add),\"Added \".mvjoin(diff_add,\",\"),isnotnull(diff_remove),\"Removed \".mvjoin(diff_remove,\",\")), action = case(isnotnull(diff_add),\"created\",isnotnull(diff_remove),\"deleted\") | stats values(object_attrs) as object_attrs, values(action) as action, values(result) as result, values(B2BManagementPolicy*) as B2BManagementPolicy*, count, min(_time) as firstTime, max(_time) as lastTime by user signature object_name dest vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_external_identity_policy_changed_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Business approved changes by known administrators.
references:
    - https://medium.com/tenable-techblog/roles-allowing-to-abuse-entra-id-federation-for-persistence-and-privilege-escalation-df9ca6e58360
    - https://learn.microsoft.com/en-us/entra/external-id/external-identities-overview
finding:
    title: User $user$ changed the external identity [$object_name$] policy
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: O365 Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '45003.90177'
title: PowerShell CreateDecryptor
description: Threat actors may abuse the CreateDecryptor() method within PowerShell
  scripts to dynamically decrypt embedded payloads, configuration files, or sensitive
  data at runtime. CreateDecryptor() is part of legitimate .NET cryptographic operations,
  but its presence in PowerShell ScriptBlock or CommandLine activity — especially
  outside normal application behavior — often signals malware unpacking, fileless
  attacks, or ransomware staging. This use case detects references to CreateDecryptor
  in PowerShell activity, potentially indicating obfuscated payload execution or preparation
  for in-memory attacks.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "EventID>4103<" OR TERM(EventCode=4104) OR "EventID>4104<") "CreateDecryptor" |
  regex process="(?i)CreateDecryptor" | table _time, host, user process, process_*,
  signature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- defense-evasion:obfuscated files or information
technique_id:
- T1059.001
- T1027
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.cybereason.com/blog/threat-analysis-lummastealer-2.0
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.createdecryptor?view=net-9.0
- https://www.virustotal.com/gui/file/034694376c291c82789e7dc2c8771a4dff47c1c447f2ea7427edb968f480fa71

name: PowerShell Domain Enumeration
id: e1866ce2-ca22-11eb-8e44-acde48001122
version: 16
creation_date: '2021-06-15'
modification_date: '2026-06-28'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`.
    It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell.
    This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups.
    If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText IN (
        *get-netdomaintrust*,
        *get-netforesttrust*,
        *get-addomain*,
        *get-adgroupmember*,
        *get-domainuser*
    )
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_domain_enumeration_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Legitimate use can be common or expected in certain environments. Filter as needed.
references:
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] contains domain enumeration commands executed on host $dest$
analytic_story:
    - Hermetic Wiper
    - Malicious PowerShell
    - CISA AA23-347A
    - Data Destruction
    - Interlock Ransomware
    - Microsoft WSUS CVE-2025-59287
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '35864.62857'
title: Process Connection to Mega - Windows
description: Mega is a cloud storage service used by many threat actors due to its
  use of end-to-end encryption and semi-anonymous payment options. The client application
  MEGAsync.exe and command-line interface utility MegaCMD allow threat actors to exfiltrate
  large amounts of data. This use case detects network connections involving MEGASync.exe
  or MegaCMD or network connections to mega.co.nz or mega.nz (Sysmon only).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR
  "<EventID>5156<") "Megasync.exe" OR "megacmd" | where match(process_name, "(?i)mega(sync|cmd)")
  | table _time, host, user, process, process_*, parent_process_*, dest_host | bin
  span=300s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over web service
technique_id: 
- T1567
data_category:
- Windows event logs
- Process use of network
references:
- https://redcanary.com/blog/threat-detection/rclone-mega-extortion/

id: '1106.1173'
title: RDP Enabled
description: 'Detects if RDP service has been enabled on Windows host -- Threat Actor
  Association: APT35/Phosphorus/Magic Hound, DarkSide, BlackMatter, FIN7, TA551, Wizard
  Spider, Yanluowang -- Software Association: BianLian, Black Basta, Conti, Hive,
  IcedID, Insekt, Lockbit, Nefilim, Ryuk Ransomware, Sodinokibi/REvil'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ( ("reg.exe" AND
  TERM(add) AND TERM(fDenyTSConnections) AND TERM(REG_DWORD) AND TERM(/d) AND TERM(0)
  AND TERM(Terminal) AND TERM(Server) ) OR ("netsh.exe" AND TERM(remote) AND TERM(desktop)
  AND TERM(enable=yes)) ) | table _time, host, user process, process_*, parent_process,
  parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- lateral-movement:remote services:remote desktop protocol
technique_id:
- T1112
- T1021.001
data_category:
- Windows Sysmon
references:
- https://pureinfotech.com/enable-remote-desktop-command-prompt-windows-10/

name: Recon AVProduct Through Pwh or WMI
id: 28077620-c9f6-11eb-8785-acde48001122
version: 16
creation_date: '2021-06-14'
modification_date: '2026-07-20'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious PowerShell script execution via EventCode 4104, specifically targeting checks for installed anti-virus products using WMI or PowerShell commands. This detection leverages PowerShell Script Block Logging to identify scripts containing keywords like "SELECT," "WMIC," "AntiVirusProduct," or "AntiSpywareProduct." This activity is significant as it is commonly used by malware and APT actors to map running security applications or services, potentially aiding in evasion techniques. If confirmed malicious, this could allow attackers to disable or bypass security measures, leading to further compromise of the endpoint.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*") AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `recon_avproduct_through_pwh_or_wmi_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: network administrator may used this command for checking purposes
references:
    - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
finding:
    title: A suspicious powershell script contains AV recon command on host $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious powershell script contains AV recon command on host $dest$
analytic_story:
    - XWorm
    - Ransomware
    - Hermetic Wiper
    - Prestige Ransomware
    - Quasar RAT
    - Malicious PowerShell
    - Data Destruction
    - MoonPeak
    - Qakbot
    - Windows Post-Exploitation
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1592
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint