Splunk rules: 1y

id: '30702.54839'
title: ADExplorer Snapshot Creation
description: Active Directory Explorer (AD Explorer) is a tool from the Sysinternals
  suite that allows users to view, search, and analyze objects within Active Directory,
  and it includes the capability to take snapshots of the AD database for offline
  analysis. A threat actor might leverage AD Explorer to gain detailed insights into
  the AD environment and use its snapshot capability to discreetly export and study
  the structure, user accounts, and security settings, potentially identifying vectors
  for privilege escalation or lateral movement within a network. This use case detects
  executions of ADExplorer with the snapshot command.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("ADExplorer64" OR "ADExplorer" OR "AdExp") "snapshot" | regex process_name="(?i)ADExplorer(64)?|AdExp\.exe"|
  regex process="(?i)snapshot\s" | table _time, host, user, parent_process_name, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
- T1003.003
data_category:
- Windows Sysmon
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
- https://trustedsec.com/blog/adexplorer-on-engagements
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml
- https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html

id: '6076.18328'
title: ATBroker.exe Execution
description: Helper binary for Assistive Technology (AT), Executes code defined in
  registry for a new AT. Modifications must be made to the system registry to either
  register or modify an existing Assistive Technology (AT) service entry. Living Off
  the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  "ATBroker.exe" TERM(/start) | table _time, host, user, signature_id, process, process_*,
  parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- Windows Sysmon
references:
- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
- https://oddvar.moe/2018/07/23/another-way-to-get-to-a-system-shell/

id: '5976.18226'
title: Attrib.exe Metasploit File Dropper
description: 'Using attrib.exe, an adversary may display or change file attributes
  in order to bypass UAC restrictions. Metasploits file_dropper.rb, which is include
  in some payloads uses this to assist in removing artifacts. -- Software Association:
  TargetCompany'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  TERM(attrib) AND TERM(dll) | regex process="attrib.+?\.dll" | table _time, host,
  user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:hide artifacts
technique_id: 
- T1564
data_category:
- Windows Sysmon
references:
- https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/file_dropper.rb

id: '5691.5953'
title: Data Staged to File
description: 'Adversaries may stage collected data in a central location or directory
  on the local system prior to Exfiltration. Data may be kept in separate files or
  combined into one file through techniques such as Archive Collected Data. This use
  case looks for common output commands followed by a potential file extension. --
  Threat Actor Association: Actinium/Gamaredon/Primitive Bear, APT29/Nobelium, APT37,
  Arid Viper/APT C-23, Gorgon Group, Kimsuky, Memento Team, Wizard Spider, WIRTE --
  Software Association: Bazar, Conti, Remcos - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<")| regex Process_Command_Line="(?i)\s(\>(\>)?|Out\-File)\s.{1,}\.\w{2,5}"
  | table _time, host, user signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
technique_id:
- T1074.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

name: GetLocalUser with PowerShell
id: 85fae8fa-0427-11ec-8b78-acde48001122
version: 9
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `powershell.exe` with the `Get-LocalUser` commandlet, which is used to query local user accounts. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Monitoring this activity is significant because adversaries and Red Teams may use it to enumerate local users for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to identify potential targets for further exploitation or privilege escalation within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="powershell.exe"
        )
        (Processes.process=*Get-LocalUser*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getlocaluser_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1087/001/
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1087.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GetWmiObject User Account with PowerShell
id: b44f6ac6-0429-11ec-87e9-acde48001122
version: 10
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet and the `Win32_UserAccount` parameter to query local user accounts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt by adversaries to enumerate user accounts for situational awareness or Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="powershell.exe"
        )
        (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getwmiobject_user_account_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1087/001/
analytic_story:
    - Winter Vivern
    - Active Directory Discovery
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1087.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GitHub Enterprise Modify Audit Log Event Stream
id: 99abf2e1-863c-4ec6-82f8-714391590a4c
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when a user modifies or disables audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that affect the audit log streaming functionality, which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent their malicious activities from being logged and detected by tampering with the audit trail. For a SOC, identifying modifications to audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected. The impact could be severe as organizations lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection. This creates a significant blind spot in security monitoring and incident response capabilities.
data_source:
    - GitHub Enterprise Audit Logs
search: |-
    `github_enterprise` action=audit_log_streaming.update
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_ip,
           actor_is_bot, actor_location.country_code, business,
           business_id, user_agent, action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_enterprise_modify_audit_log_event_stream_filter`
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
    - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Audit log event streaming is modified by $user$
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1685.002
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Impacket Lateral Movement Commandline Parameters
id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
version: 14
creation_date: '2021-11-19'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies the use of suspicious command-line parameters associated with Impacket tools, such as `wmiexec.py`, `smbexec.py`, `dcomexec.py`, and `atexec.py`, which are used for lateral movement and remote code execution. It detects these activities by analyzing process execution logs from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns. This activity is significant because Impacket tools are commonly used by adversaries and Red Teams to move laterally within a network. If confirmed malicious, this could allow attackers to execute commands remotely, potentially leading to further compromise and data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process = "*/Q /c * \\\\127.0.0.1\\*$*" AND Processes.process IN ("*2>&1*","*2>&1*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.
references:
    - https://attack.mitre.org/techniques/T1021/002/
    - https://attack.mitre.org/techniques/T1021/003/
    - https://attack.mitre.org/techniques/T1047/
    - https://attack.mitre.org/techniques/T1053/
    - https://attack.mitre.org/techniques/T1053/005/
    - https://github.com/SecureAuthCorp/impacket
    - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
finding:
    title: Suspicious command line parameters on $dest$ may represent a lateral movement attack with Impackets tools
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - WhisperGate
    - Gozi Malware
    - Active Directory Lateral Movement
    - Volt Typhoon
    - Prestige Ransomware
    - Industroyer2
    - Data Destruction
    - Graceful Wipe Out Attack
    - Compromised Windows Host
    - CISA AA22-277A
    - Storm-0501 Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1021.002
    - T1021.003
    - T1047
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kerberos Service Ticket Request Using RC4 Encryption
id: 7d90f334-a482-11ec-908c-acde48001122
version: 13
creation_date: '2022-03-15'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: 'The following analytic detects Kerberos service ticket requests using RC4 encryption, leveraging Kerberos Event 4769. This method identifies potential Golden Ticket attacks, where adversaries forge Kerberos Granting Tickets (TGT) using the Krbtgt account NTLM password hash to gain unrestricted access to an Active Directory environment. Monitoring for RC4 encryption usage is significant as it is rare in modern networks, indicating possible malicious activity. If confirmed malicious, attackers could move laterally and execute code on remote systems, compromising the entire network. Note: This detection may be bypassed if attackers use the AES key instead of the NTLM hash.'
data_source:
    - Windows Event Log Security 4769
search: |-
    `wineventlog_security` EventCode=4769 ServiceName="*$" (TicketOptions=0x40810000 OR TicketOptions=0x40800000 OR TicketOptions=0x40810010) TicketEncryptionType=0x17
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, service, service_id,
           TicketEncryptionType, TicketOptions
      | `security_content_ctime(lastTime)`
      | `security_content_ctime(firstTime)`
      | `kerberos_service_ticket_request_using_rc4_encryption_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for Kerberos Service Ticket requests. Specifically, systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
references:
    - https://attack.mitre.org/techniques/T1558/001/
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769
    - https://adsecurity.org/?p=1515
    - https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a
    - https://en.hackndo.com/kerberos-silver-golden-tickets/
finding:
    title: A Kerberos Service TTicket request with RC4 encryption was requested from $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Kerberos Attacks
    - Active Directory Privilege Escalation
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1558.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Possible Setuid Execve Privesc
id: e958e6ee-7c73-4eff-a4d9-43232d719b26
version: 1
creation_date: '2026-07-06'
modification_date: '2026-07-06'
author: Raven Tait, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following detects privilege escalation via execve (syscall 59) where a process transitions from a non-root uid to euid=0 without a corresponding successful PAM authentication event (USER_AUTH, USER_ACCT, or CRED_ACQ) in the same audit session. Legitimate privilege elevation mechanisms such as sudo, su, and pkexec authenticate through PAM and generate these audit records tied to the session ID before granting elevated privileges. The absence of a matching successful PAM event alongside an effective UID change to root is anomalous and may indicate exploitation of a setuid binary, a kernel vulnerability, or another mechanism used to escalate privileges outside the normal authentication flow.
data_source:
    - Linux Auditd Execve
search: >-
    `linux_auditd` (
    (type=SYSCALL syscall="59" uid!="0" euid="0")
    OR
    (type IN ("USER_AUTH","USER_ACCT","CRED_ACQ") res="success")
    )
    | eval is_suspicious_exec=if(type="SYSCALL" AND syscall="59" AND uid!="0" AND euid="0", 1, 0)
    | eval is_successful_auth=if(type IN ("USER_AUTH","USER_ACCT","CRED_ACQ") AND res="success", 1, 0)
    | stats
        count(eval(is_suspicious_exec=1)) as exec_count
        max(eval(if(is_suspicious_exec=1, _time, null()))) as lastTime
        max(is_successful_auth) as has_successful_auth
        min(eval(if(is_suspicious_exec=1, _time, null()))) as firstTime
        values(eval(if(is_suspicious_exec=1, comm, null()))) as process_name
        values(eval(if(is_suspicious_exec=1, euid, null()))) as euid
        values(eval(if(is_suspicious_exec=1, exe, null()))) as process_path
        values(eval(if(is_suspicious_exec=1, pid, null()))) as pid
        values(eval(if(is_suspicious_exec=1, ppid, null()))) as ppid
        values(eval(if(is_suspicious_exec=1, uid, null()))) as uid
        by host ses
    | where exec_count > 0 AND has_successful_auth != 1
    | rename host as dest, ses as session_id
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_auditd_possible_setuid_execve_privesc_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: Processes with an unset audit session, such as cron jobs, that legitimately drop and reacquire root privileges outside of PAM, may trigger this detection and require filtering.
references:
    - https://github.com/sgkdev/packet_edit_meme
    - https://tuxcare.com/blog/pedit-cow-cve/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $process_name$ was launched with euid 0 on [$dest$] without PAM auth.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2026-46331
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20685.36863'
title: ngrok Execution - Windows
description: 'Ngrok is a legitimate reverse proxy tool that can create a secure tunnel
  to servers located behind firewalls or on local machines that do not have a public
  IP. Ngrok has been leveraged by threat actors in several campaigns including use
  for lateral movement and data exfiltration. This use case detects process creation
  events for ngrok.exe or command patterns likely to be unique to ngrok in the event
  of a renamed executable. -- Threat Actor Association: Scattered Spider (aka. Muddled
  Libra, Scatter Swine, Starfraud, UNC3944)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(ngrok) OR (TERM(start) "--all" "--config"
  ".yml") OR (TERM(tcp) ("139" OR "445" OR "3389" OR "5985" OR "5986")) | where match(process,
  "(?i)(tcp\s+(139|445|3389|5985|5986))|(\.exe\s+|(authtoken\s|start\s+--all))|(start\s.*\s--all\s.*\s--config\s.+\.yml)")
  OR match(process_path, "(?i)ngrok\.exe") | table _time, host, user, signature_id,
  process, process_*, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:protocol tunneling
technique_id: 
- T1572
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.logpoint.com/en/blog/a-deep-look-at-the-darkside-ransomware-operators-and-their-affiliates/

name: O365 Cross-Tenant Access Change
id: 7c0fa490-12b0-4d0b-b9f5-e101d1e0e06f
version: 9
creation_date: '2024-04-13'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when cross-tenant access/synchronization policies are changed in an Azure tenant. Adversaries have been observed altering victim cross-tenant policies as a method of lateral movement or maintaining persistent access to compromised environments. These policies should be considered sensitive and monitored for changes and/or loose configuration.
data_source:
    - Office 365 Universal Audit Log
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add a partner to cross-tenant access setting.\",\"Delete partner specific cross-tenant access setting.\") | eval user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_cross_tenant_access_change_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Business approved changes by known administrators.
references:
    - https://attack.mitre.org/techniques/T1484/002/
    - https://thehackernews.com/2023/08/emerging-attacker-exploit-microsoft.html
    - https://cyberaffairs.com/news/emerging-attacker-exploit-microsoft-cross-tenant-synchronization/
    - https://www.crowdstrike.com/blog/crowdstrike-defends-against-azure-cross-tenant-synchronization-attacks/
finding:
    title: The user [$user$] changed the Azure cross-tenant access settings
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: O365 Tenant
mitre_attack_id:
    - T1484.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '22594.40756'
title: Potential Sysinternals Tool Execution
description: 'Sysinternals is a widely-used set of utilities for endpoint management,
  troubleshooting, and monitoring and is available for free from Microsoft. While
  not installed by default, it can be considered a LOLBAS due to its ubiquity in enterprise
  environments. Threat actors can abuse these utilities in a variety of ways including
  information gathering, remote command execution, memory dumping, and many more.
  This use case detects command line executions including the accepteula flag. The
  names of individual SysInternal tools have not been included to account for instances
  where the process has been renamed. Allowlisting by process path for known benign
  executables using -accepteula or /accepteula combined with usernames expected to
  use Sysinternals is recommended to reduce false positives. -- Threat Actor Association:
  Cluster Alpha (STAC1248) - Software Association: Fog -- LOLBINS/LOLBAS'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "-accepteula" OR "/accepteula" | regex process="(?i)\s(-|\/)accepteula"
  | table _time, host, user host, process, parent_process_path | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://learn.microsoft.com/en-us/sysinternals/

name: Remote Desktop Process Running On System
id: f5939373-8054-40ad-8c64-cec478a22a4a
version: 14
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: Hunting
description: The following analytic detects the execution of the remote desktop process (mstsc.exe) on systems where it is not typically run. This detection leverages data from Endpoint Detection and Response (EDR) agents, filtering out systems categorized as common RDP sources. This activity is significant because unauthorized use of mstsc.exe can indicate lateral movement or unauthorized remote access attempts. If confirmed malicious, this could allow an attacker to gain remote control of a system, potentially leading to data exfiltration, privilege escalation, or further network compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process=*mstsc.exe
        AND
        Processes.dest_category!=common_rdp_source
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name(Processes)`
    | `remote_desktop_process_running_on_system_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Remote Desktop may be used legitimately by users on the network.
references: []
analytic_story:
    - Hidden Cobra Malware
    - Active Directory Lateral Movement
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1021.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Rundll32 Create Remote Thread To A Process
id: 2dbeee3a-f067-11eb-96c0-acde48001122
version: 11
creation_date: '2021-07-29'
modification_date: '2026-06-29'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: |-
    The following analytic detects the creation of a remote thread by rundll32.exe into another process. It leverages Sysmon EventCode 8 logs, specifically monitoring SourceImage and TargetImage fields.
    This activity is significant as it is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft.
    If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host.
data_source:
    - Sysmon EventID 8
search: |-
    `sysmon`
    EventCode=8
    SourceImage="*\\rundll32.exe"
    TargetImage = "*.exe"
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(NewThreadId) as "NewThreadId"
                  values(StartAddress) as "StartAddress"
      by dest signature_id signature
         SourceProcessGuid SourceProcessId SourceImage
         TargetProcessGuid TargetProcessId TargetImage
         StartModule StartFunction vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `rundll32_create_remote_thread_to_a_process_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.joesandbox.com/analysis/380662/0/html
finding:
    title: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: SourceImage
      type: process
analytic_story:
    - IcedID
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '22357.39390'
title: Service Created containing Command Shell
description: 'This use case detects when a service has been created (event 7045) containing
  PowerShell or cmd commands. -- Software Association: BlueSky'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=7045) OR
  "<EventID>7045<") "powershell.exe" OR "pwsh.exe" OR "cmd.exe" | table _time, host,
  user signature_id, member_nt_domain, user, dest_host | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:system services:service execution
technique_id:
- T1569.002
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/

id: '16900.27387'
title: System Information Discovery - Windows
description: 'An adversary may attempt to get detailed information about the operating
  system and hardware, including version, patches, hotfixes, service packs, and architecture.
  Adversaries may use the information from System Information Discovery during automated
  discovery to shape follow-on behaviors, including whether or not the adversary fully
  infects the target and/or attempts specific actions. Atomics T1082 Test #1 Atomics
  T1082 Test #6 Atomics T1082 Test #8 Atomics T1082 Test #10'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(systeminfo) OR TERM(set) OR TERM(hostname) OR (TERM(reg) TERM(query) ("HKLM\SYSTEM\CurrentControlSet"
  OR "MachineGuid"))) | regex process ="(?i)(\s+|^)(systeminfo|reg\s+query|hostname|set)(\.exe)?(\s+|$)"
  | table _time, host, user, process, process_*, parent_process* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- discovery:system information discovery
technique_id: 
- T1082
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md

name: Windows AppX Deployment Unsigned Package Installation
id: 9b5e7c14-f8d2-4a3b-b1a7-e5c9f2a8d123
version: 5
creation_date: '2025-08-18'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter. This detection leverages Windows event logs from the AppXDeployment-Server, specifically focusing on EventID 603 which indicates the start of a deployment operation with specific deployment flags. The flag value 8388608 corresponds to the -AllowUnsigned option in PowerShell's Add-AppxPackage cmdlet. This activity is significant as adversaries have been observed leveraging unsigned MSIX packages to deliver malware, bypassing signature verification that would normally protect users from malicious packages. If confirmed malicious, this could allow attackers to execute arbitrary code, establish persistence, or deliver malware while evading traditional detection mechanisms.
data_source:
    - Windows Event Log AppXDeployment-Server 855
search: |-
    `wineventlog_appxdeploymentserver` EventCode=603 Flags="8388608"
      | stats count min(_time) as firstTime max(_time) as lastTime values(Path) as file_name values(CallingProcess) as CallingProcess
        BY dvc EventCode Flags
           user_id
      | rename dvc as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_appx_deployment_unsigned_package_installation_filter`
how_to_implement: To implement this search, you need to configure Windows event log collection for the Microsoft-Windows-AppXDeploymentServer/Operational channel. This can be done through Windows Event Forwarding, Splunk Universal Forwarders, or other log collection methods. Ensure that the log collection method preserves the full XML structure of the events. The sourcetype should be set to XmlWinEventLog or WinEventLog depending on your environment configuration. This detection specifically looks for EventID 603 with a Flags value of 8388608, which indicates the use of the -AllowUnsigned parameter when installing MSIX packages.
known_false_positives: Legitimate software development and testing activities may trigger this detection. Internal application development teams testing MSIX packages before signing or system administrators installing custom unsigned applications for business purposes may use the -AllowUnsigned parameter. Note that the -AllowUnsigned flag is only available on Windows 11 and later versions. Verify if the package installation is expected in your environment and if the calling process and user are authorized to install unsigned packages.
references:
    - https://learn.microsoft.com/en-us/powershell/module/appx/add-appxpackage
    - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
    - https://redcanary.com/blog/threat-intelligence/msix-installers/
    - https://attack.mitre.org/techniques/T1553/005/
finding:
    title: Unsigned MSIX/AppX package $file_name$ installation attempted on $dest$ by user $user_id$ using $CallingProcess$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - MSIX Package Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1553.005
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Dir Piped to Findstr Activity
id: 43cd7a59-3d52-4969-a01a-d677630b1426
version: 1
creation_date: '2026-07-30'
modification_date: '2026-07-30'
author: Raven Tait, Splunk
status: production
type: Hunting
description: |-
    The following analytic detects the execution of the `dir` command piped to `findstr` on Windows systems.
    This technique is commonly used by attackers during the reconnaissance phase to enumerate files, directories, or sensitive data by filtering directory listings for specific strings or patterns.
    While this command combination can have legitimate administrative uses, adversaries frequently leverage it to locate credentials, configuration files, or other high-value targets on a compromised system.
    If confirmed malicious, this activity could indicate an attacker is actively mapping the file system in preparation for data exfiltration, lateral movement, or further exploitation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process="*dir *|*findstr *"

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name
       Processes.parent_process Processes.parent_process_path Processes.parent_process_guid
       Processes.parent_process_id Processes.process_guid
       Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_dir_piped_to_findstr_activity_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate administrative tasks and scripts may use `dir` piped to `findstr` for routine file searches.
    Filter based on known user behavior and approved administrative activity.
analytic_story:
    - Suspicious Command-Line Executions
    - Windows Discovery Techniques
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1119
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Disable Restricted Admin
id: cee573a0-7587-48e6-ae99-10e8c657e89a
version: 13
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry entry "DisableRestrictedAdmin," which controls the Restricted Admin mode behavior. This detection leverages registry activity logs from endpoint data sources like Sysmon or Carbon Black. Monitoring this activity is crucial as changes to this setting can disable a security feature that limits credential exposure during remote connections. If confirmed malicious, an attacker could weaken security controls, increasing the risk of credential theft and unauthorized access to sensitive systems.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin" Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_restricted_admin_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
known_false_positives: Administrator may change this registry setting. Filter as needed.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
finding:
    title: Windows Modify Registry Disable Restricted Admin on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Windows Modify Registry Disable Restricted Admin on $dest$ by $user$.
analytic_story:
    - GhostRedirector IIS Module and Rungan Backdoor
    - Medusa Ransomware
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Office Product Spawned Child Process For Download
id: f02b64b8-cbea-4f75-bf77-7a05111566b1
version: 10
creation_date: '2021-04-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies Office applications spawning child processes to download content via HTTP/HTTPS. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications like Word or Excel initiate network connections, excluding common browsers. This activity is significant as it often indicates the use of malicious documents to execute living-off-the-land binaries (LOLBins) for payload delivery. If confirmed malicious, this behavior could lead to unauthorized code execution, data exfiltration, or further malware deployment, posing a severe threat to the organization's security.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    `process_office_products_parent`
    Processes.process IN ("*http:*","*https:*")
    NOT (
      Processes.original_file_name IN ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")
      OR
      Processes.process_name IN ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")
    )
    by Processes.action Processes.dest
    Processes.original_file_name Processes.parent_process Processes.parent_process_exec
    Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
    Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
    Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
    Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_office_product_spawned_child_process_for_download_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Default browser not in the filter list.
references:
    - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
finding:
    title: Office document spawning suspicious child process on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Spearphishing Attachments
    - CVE-2023-36884 Office and Windows HTML RCE Vulnerability
    - PlugX
    - NjRAT
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Rundll32 WebDav With Network Connection
id: f03355e0-28b5-4e9b-815a-6adffc63b38c
version: 12
creation_date: '2023-09-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of rundll32.exe with command-line arguments loading davclnt.dll and the davsetcookie function to access a remote WebDav instance. It uses data from Endpoint Detection and Response (EDR) agents, correlating process execution and network traffic data. This activity is significant as it may indicate exploitation of CVE-2023-23397, a known vulnerability. If confirmed malicious, this could allow an attacker to establish unauthorized remote connections, potentially leading to data exfiltration or further network compromise.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
search: |
    | tstats `security_content_summariesonly` count
      min(_time) as firstTime
      max(_time) as lastTime
    FROM datamodel=Endpoint.Processes where
      Processes.parent_process_name=svchost.exe
      `process_rundll32`
      Processes.process IN (
        "*\\windows\\system32\\davclnt.dll,*davsetcookie*",
        "*\\windows\\syswow64\\davclnt.dll,*davsetcookie*")
    by host _time span=1h
      Processes.action Processes.dest Processes.original_file_name Processes.parent_process
      Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
      Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
      Processes.process_guid Processes.process_hash  Processes.process_id Processes.process_integrity_level
      Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | rename dest as src
    | join host process_id
    [
      | tstats `security_content_summariesonly` count
        latest(All_Traffic.dest) as dest
        latest(All_Traffic.dest_ip) as dest_ip
        latest(All_Traffic.dest_port) as dest_port
      FROM datamodel=Network_Traffic.All_Traffic where
        All_Traffic.dest_port!=0
        NOT (All_Traffic.dest_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16))
      by host All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
              All_Traffic.dest  All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
              All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
              All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
              All_Traffic.process_id
      | `drop_dm_object_name(All_Traffic)`
    ]
    | `windows_rundll32_webdav_with_network_connection_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    False positives will be present based on legitimate software, filtering may need to occur.
references:
    - https://strontic.github.io/xcyclopedia/library/davclnt.dll-0EA3050E7CC710526E330C413C165DA0.html
    - https://twitter.com/ACEResponder/status/1636116096506818562?s=20
    - https://twitter.com/domchell/status/1635999068282408962?s=20
    - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
    - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - CVE-2023-23397 Outlook Elevation of Privilege
asset_type: Endpoint
cve:
    - CVE-2023-23397
mitre_attack_id:
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint