Splunk rules: 1z

name: AWS Create Policy Version to allow all resources
id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
version: 14
creation_date: '2021-02-22'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that grants broad permissions. This behavior is significant because it violates the principle of least privilege, potentially exposing the environment to misuse or abuse. If confirmed malicious, an attacker could gain extensive access to AWS resources, leading to unauthorized actions, data exfiltration, or further compromise of the AWS environment.
data_source:
    - AWS CloudTrail CreatePolicyVersion
search: |-
    `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success
      | spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{}
      | mvexpand key_policy_statements
      | spath input=key_policy_statements output=key_policy_action_1 path=Action
      | where key_policy_action_1 = "*"
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_create_policy_version_to_allow_all_resources_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources and you must verify this activity.
references:
    - https://bishopfox.com/blog/privilege-escalation-in-aws
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
finding:
    title: User $user$ created a policy version that allows them to access any resource in their account.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1078.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Azure AD Privileged Graph API Permission Assigned
id: 5521f8c5-1aa3-473c-9eb7-853701924a06
version: 11
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of high-risk Graph API permissions in Azure AD, specifically Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. It uses azure_monitor_aad data to scan AuditLogs for 'Update application' operations, identifying when these permissions are assigned. This activity is significant as it grants broad control over Azure AD, including application and directory settings. If confirmed malicious, it could lead to unauthorized modifications and potential security breaches, compromising the integrity and security of the Azure AD environment. Immediate investigation is required.
data_source:
    - Azure Active Directory Update application
search: "`azure_monitor_aad` category=AuditLogs operationName=\"Update application\" | eval newvalue = mvindex('properties.targetResources{}.modifiedProperties{}.newValue',0) | spath input=newvalue | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\" 1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\" OR \"{}.RequiredAppPermissions{}.EntitlementId\" =\"06b708a9-e830-4db3-a914-8e69da51d44f\" OR \"{}.RequiredAppPermissions{}.EntitlementId\" =\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product Permissions signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_privileged_graph_api_permission_assigned_filter`"
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Privileged Graph API permissions may be assigned for legitimate purposes. Filter as needed.
references:
    - https://cloudbrothers.info/en/azure-attack-paths/
    - https://github.com/mandiant/Mandiant-Azure-AD-Investigator/blob/master/MandiantAzureADInvestigator.json
    - https://learn.microsoft.com/en-us/graph/permissions-reference
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
    - https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48
finding:
    title: User $user$ assigned privileged Graph API permissions to $Permissions$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
    - NOBELIUM Group
asset_type: Azure Active Directory
mitre_attack_id:
    - T1003.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '6149.15955'
title: BITSadmin Execution
description: 'BITSAdmin is a command line tool used to create and for managing background
  intelligent transfer. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat
  Actor Association: Andariel, APT31, APT41, BlackMatter, Darkside, FIN12, Flax Typhoon
  Software Association: ALPHV/BlackCat, Astaroth, Clop, MINEBRIDGE, Nefilim, Sodinokibi/REvil,
  Ransom Cartel Atomics T1105 Test#9 Atomics T1197 Test#1 Atomics T1197 Test#2 Atomics
  T1197 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("bitsadmin" OR "BITS") | table _time, host, user, signature_id, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:bits jobs
- defense-evasion:bits jobs
- lateral-movement:lateral tool transfer
- command-and-control:ingress tool transfer
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1197
- T1048.003
- T1570
- T1105
data_category:
- Windows Sysmon
references:
- https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
- https://www.trendmicro.com/en_us/research/18/c/tropic-trooper-new-strategy.html
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

name: Cisco IOS XE Guestshell Activation and Destroy
id: ff82a536-8fde-4963-a801-815826fcdf75
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-20'
author: Nasreddine Bencherchali
status: production
type: Anomaly
description: |
    This analytic detects Cisco IOS-XE guestshell enable activity followed by activation and destroy lifecycle logs.
    The detection focuses on HA_EM command logging for "guestshell enable" and "guestshell destroy", VMAN activation and destroy messages, and IM/IOX guestshell activation logs observed on some IOS-XE images.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility IN ("HA_EM", "VMAN", "IM", "AAA")
    mnemonic IN ("LOG", "ACTIVATION_STATE", "IOX_INST_INFO", "INSTALL_STATE", "AAA_ACCOUNTING_MESSAGE")
    message_text IN (
        "*guestshell enable*",
        "*guestshell destroy*",
        "*Successfully activated virtual service 'guestshell*",
        "*IOX SERVICE guestshell*",
        "*Destroying virtual service 'guestshell*",
        "*Successfully destroyed virtual service 'guestshell*"
    )
    | eval dest=coalesce(host, dvc, dest, "unknown")
    | eval event_type=case(
        like(message_text, "%guestshell enable%"), "guestshell_enable_command",
        like(message_text, "%guestshell destroy%"), "guestshell_destroy_command",
        like(message_text, "%Successfully activated virtual service 'guestshell%"), "vman_guestshell_activated",
        like(message_text, "%IOX SERVICE guestshell%"), "im_iox_guestshell_activated",
        like(message_text, "%Destroying virtual service 'guestshell%"), "vman_guestshell_destroying",
        like(message_text, "%Successfully destroyed virtual service 'guestshell%"), "vman_guestshell_destroyed",
        true(), "other"
    )
    | bin _time span=30m
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(event_type) as event_types
                  values(message_text) as message
    by _time dest
    | where
            (
                mvfind(event_types, "vman_guestshell_activated") >= 0
                OR
                mvfind(event_types, "im_iox_guestshell_activated") >= 0
                OR
                mvfind(event_types, "guestshell_enable_command") >= 0
            )
            AND
            (
                mvfind(event_types, "vman_guestshell_destroying") >= 0
                OR
                mvfind(event_types, "vman_guestshell_destroyed") >= 0
                OR
                mvfind(event_types, "guestshell_destroy_command") >= 0
            )
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_guestshell_activation_and_destroy_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
    Enable EEM catchall command logging to capture the "guestshell enable" and "guestshell destroy" commands as HA_EM/LOG events.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Cisco IOS-XE device $dest$ had guestshell enabled and destroyed within a short period.
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1059
    - T1611
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl
id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55
version: 6
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic identifies the use of `msxsl.exe` initiating a network connection to a non-private IP address.
    Although `msxsl.exe` is a legitimate Microsoft utility used to apply XSLT transformations, adversaries can abuse it
    to execute arbitrary code or load external resources in an evasive manner.
    This detection leverages Cisco NVM telemetry to identify potentially malicious use of `msxsl.exe` making network connections
    that may indicate command and control (C2) or data exfiltration activity.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    process_name = "msxsl.exe"
    NOT dest IN (
            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
            )
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___suspicious_network_connection_initiated_via_msxsl_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    False positives may occur in development or administrative environments where msxsl.exe is used
    for legitimate XML transformations. However, its use is uncommon in standard user activity
    and should be reviewed in most environments.
references:
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Host $src$ used msxsl.exe to initiate a suspicious network connection to $dest$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1220
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Confluence Unauthenticated Remote Code Execution CVE-2022-26134
id: fcf4bd3f-a79f-4b7a-83bf-2692d60b859c
version: 10
creation_date: '2022-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence. It leverages the Web datamodel to analyze network and CIM-compliant web logs, identifying suspicious URL patterns and parameters indicative of exploitation attempts. This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, and further lateral movement within the network. Immediate investigation and remediation are crucial to prevent extensive damage.
data_source:
    - Palo Alto Network Threat
search: |-
    | tstats `security_content_summariesonly`
             count min(_time) as firstTime
                   max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url IN (
        "*${*",
        "*%2F%7B*"
    )
    AND
    (
        (
            Web.url="*org.apache.commons.io.IOUtils*"
            Web.url="*java.lang.Runtime@getRuntime().exec*"
        )
        OR
        (
            Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*"
        )
        OR
        (
            Web.url="*getEngineByName*"
            Web.url="*nashorn*"
            Web.url="*ProcessBuilder*"
        )
    )
    BY Web.http_user_agent Web.http_method
       Web.url,Web.url_length
       Web.src, Web.dest sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter`
how_to_implement: |
    This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat.
known_false_positives: |
    Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query.
references:
    - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
    - https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html
    - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
    - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
finding:
    title: A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability,  on $dest$ by $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Atlassian Confluence Server and Data Center CVE-2022-26134
    - Confluence Data Center and Confluence Server Vulnerabilities
asset_type: Web Server
cve:
    - CVE-2022-26134
mitre_attack_id:
    - T1505
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '1071.1108'
title: Create_Modify Schtasks
description: 'Detects possible persistent backdoor access using schtasks -- Threat
  Group Association: Actinium/Gamaredon/Primitive Bear, Alloy Taurus/Gallium, APT29/Nobelium/Cozy
  Bear, APT31, APT33, APT34/OilRig, APT35/Phosphorus/Magic Hound, APT41, APT43, BlackByte,
  BlackCat, Blind Eagle/APT-C-36, Evilnum, FIN7, FIN12, Gamaredon Group/Shuckworm,
  GoldenJackal, Lazarus, Memento Team, MuddyWater, Redfly, TA428, Turla (akaSecret
  Blizzard, KRYPTON, and UAC-0003), Vice Society, WinterVivern/UAC-0114, WIRTE, Witchetty
  - Software Association: Blackbyte, Black Basta, BianLian, Cactus, Conti, GoMet,
  HermeticWiper/Trojan.Killdisk, Lockbit, Lorenz, LV, NanoCore, Play, Prestige, Prometheus/Spook,
  Rhysida, Trickbot, XingLocker - Atomics T1036.004 Test #1 Atomics T1053.005 Test#1
  Atomics T1053.005 Test#2 Atomics T1053.005 Test#3 Atomics T1053.005 Test#4 - #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 TERM("schtasks")
  (TERM("create") OR TERM("change")) | table _time, host, user process, process_*,
  parent_process, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host, process | where len(parent_process_name)>0 AND match(process,"(?i)\s+(\/create)|(\/change)") '
techniques:
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
technique_id:
- T1053.005
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1053/005/

id: '1028.1031'
title: CSVDE Export Active Directory
description: 'Detects the administration tool csvde.exe attempting to export Active
  Directory data in an APT scenario. -- Threat Actor Association: Volt Typhoon'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("csvde.exe" AND TERM(-f)) | table _time, host,
  user dest_ip, dest_port, direction, dvc, dvc_nt_host, event_id, host, index, parent_process,
  parent_process_id, parent_process_name, parent_process_path, process, process_id,
  process_name, process_path, signature_id, source, sourcetype, src_ip, src_port,
  tag, transport, user | bin span=30s | stats values(*) as * by _time, host '
techniques:
- discovery:account discovery:local account
- discovery:account discovery:domain account
technique_id:
- T1087.001
- T1087.002
data_category:
- Windows event logs
references: null

id: '5997.18212'
title: Execution from Startup Folder
description: 'Adversaries may achieve persistence by adding a program to a startup
  folder. This use case looks for executions of processes that reside in those folders.
  NOTE, this use case will not identify the creation or execution of shortcuts(lnks)
  saved in the startup folder. -- Threat Actor Association: APT29/Nobelium, Kimsuky,
  Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
  UNC2465 - Software Association: Play, SmokedHAM, YellowCockatoo --'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  TERM(Startup) | table _time, host, user process, process_*, signature_id, parent_*
  | bin span=1s | stats values(*) as * by _time, host | where match(parent_process_path,
  "(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E") OR match(process_path,
  "(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E") '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
technique_id:
- T1547.001
data_category:
- Windows Sysmon
references:
- https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html

name: Linux Auditd Add User Account
id: aae66dc0-74b4-4807-b480-b35f8027abb4
version: 10
creation_date: '2022-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd` proctitle IN ("*useradd*", "*adduser*")
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_add_user_account_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to add a user account.
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1136.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Indicator Removal Clear Cache
id: e0940505-0b73-4719-84e6-cb94c44a5245
version: 11
creation_date: '2023-02-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects processes that clear or free page cache on a Linux system. It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line executions involving the kernel system request `drop_caches`. This activity is significant as it may indicate an attempt to delete forensic evidence or the presence of wiper malware like Awfulshred. If confirmed malicious, this behavior could allow an attacker to cover their tracks, making it difficult to investigate other malicious activities or system compromises.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("dash", "sudo", "bash")
        AND
        Processes.process  IN("* echo 3 > *", "* echo 2 > *","* echo 1 > *")
        AND
        Processes.process = "*/proc/sys/vm/drop_caches"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `linux_indicator_removal_clear_cache_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
    - https://cert.gov.ua/article/3718487
finding:
    title: a $process_name$ clear cache using kernel drop cache system request in $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: a $process_name$ clear cache using kernel drop cache system request in $dest$
analytic_story:
    - AwfulShred
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1070
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1081.1130'
title: Locate Credentials
description: 'Adversaries may search local file systems and remote file shares for
  files containing passwords. These can be files created by users to store their own
  credentials, shared credential stores for a group of individuals, configuration
  files containing passwords for a system or service, or source code/binary files
  containing embedded passwords. -- Threat Actor Association: Alloy Taurus/Gallium,
  Antlion, APT15, APT29/Nobelium/Cozy Bear, DarkSide, BlackMatter, Lancyfly, Lapsus$,
  TeamTNT, Wizard Spider - Software Association: ALPHV/BlackCat, Conti, Ransom Cartel,
  Snake, TeamTNT -- Atomics 1003.002 Test #5 NOTE *Only for the Powershell version
  Atomics T1552.001 Test#1 Atomics T1552.001 Test#3 Atomics T1552.006 Test#1 Atomics
  T1552.004 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") AND (TERM(findstr) AND (TERM(password) OR TERM(txt) OR TERM(ini)
  OR TERM(xml) OR TERM(pass) OR TERM(cred) OR TERM(vnc) OR TERM(config) OR TERM(spin)
  )) OR (TERM(type) AND (TERM(sysprep) OR TERM(unattend) OR TERM(Unattended)) AND
  (TERM(inf) OR TERM(ini) OR TERM(xml))) OR (TERM(dir) AND (TERM(vnc) OR TERM(ultravnc))
  AND (TERM(inf) OR TERM(ini) OR TERM(xml))) OR ((TERM(cmd) AND TERM(/c) AND TERM(copy))
  AND ("ntds.dit" OR TERM(SAM) OR TERM(System) )) OR (TERM(vssadmin) AND TERM(create)
  AND TERM(SHADOW)) OR (TERM(ntdsutil)) OR ("Wmic" TERM(shadowcopy)) | table _time,
  host, user, process, process_*, parent_*, signature_id | bin span=300s | stats values(*)
  as * by _time, host | stats values(*) as * by _time, host| eventstats dc(host) as
  dc_host by process| eventstats count as c_process by process| where dc_host=1 and
  c_process<3 '
techniques:
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
data_category:
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1552/001/

id: '33428.59204'
title: Mock System Directory - Windows
description: A Windows User Account Control Bypass technique is capable of achieving
  privilege escalation without displaying a UAC prompt. This method involves creating
  a mock directory with a trailing whitespace and the same name as a legitmate trusted
  location (e.g. "C:\Windows \System32\") and copying required files to it. The mock
  directory can not be created via Windows Explorer, requiring the attacker to create
  it via scripting or command line. This use case detects process or parent process
  file paths (where available depending on log source) for trusted system directories
  (\Windows\system32 or Program Files) including a trailing space before \.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "Windows " OR ("Program " "Files ") OR ("Program " "Files" "\(x86\) ") | where match(process_path,
  "(?i)\s+\x5c") or match(parent_process_path, "(?i)\s+\x5c")| table _time, host,
  user, process, process_*, parent_process, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
- defense-evasion:abuse elevation control mechanism:bypass user account control
- defense-evasion:masquerading
technique_id:
- T1548.002
- T1036
data_category:
- Windows Sysmon
references:
- https://borncity.com/win/2023/03/11/windows-10-11-mock-folders-as-uac-bypass-security-disaster-leverage-applocker-and-srp/
- https://www.fortinet.com/blog/threat-research/fickle-stealer-distributed-via-multiple-attack-chain

id: '35366.62197'
title: ngen.exe File Download
description: ngen.exe (Native Image Generator) is a legitimate Windows binary that
  compiles .NET assemblies into native machine code to improve application performance.
  Threat actors can abuse ngen.exe to download files. This use case detects ngen.exe
  executions with commands to download a file from a remote location. Living Off the
  Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "ngen.exe" | regex process_name="(?i)ngen\.exe"| regex process="(?i)ngen(\.exe(\"|\'')?)?\s+(\"|\'')?[A-Za-z0-9]{2,6}:\/\/[^\s]+"|
  table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ngen/
- https://attack.mitre.org/techniques/T1105/
- https://learn.microsoft.com/en-us/dotnet/framework/tools/ngen-exe-native-image-generator

name: O365 SharePoint Allowed Domains Policy Changed
id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c
version: 11
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when the allowed domain settings for O365 SharePoint have been changed. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations may also need access to OneDrive/SharePoint resources. These changed should be monitored by security teams as they could potentially lead to unauthorized access.
data_source:
    - Office 365 Universal Audit Log
search: '`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name=''ModifiedProperties{}.Name'', object_attrs_new = split(replace(''ModifiedProperties{}.NewValue'',"\.\.\.",""),","), object_attrs_old = split(replace(''ModifiedProperties{}.OldValue'',"\.\.\.",""),",") | fillnull | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name,dest,action,vendor_account,vendor_product | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) | eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_sharepoint_allowed_domains_policy_changed_filter`'
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Business approved changes by known administrators.
references:
    - https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview
finding:
    title: The SharePoint Online domain allowlist was changed by $user$, $result$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: O365 Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Plain HTTP POST Exfiltrated Data
id: e2b36208-a364-11eb-8909-acde48001122
version: 13
creation_date: '2021-04-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects potential data exfiltration using plain HTTP POST requests. It leverages network traffic logs, specifically monitoring the `stream_http` data source for POST methods containing suspicious form data such as "wermgr.exe" or "svchost.exe". This activity is significant because it is commonly associated with malware like Trickbot, trojans, keyloggers, or APT adversaries, which use plain text HTTP POST requests to communicate with remote C2 servers. If confirmed malicious, this activity could lead to unauthorized data exfiltration, compromising sensitive information and potentially leading to further network infiltration.
data_source:
    - Splunk Stream HTTP
search: |-
    `stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*")
      | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count
        BY src_ip dest_ip http_method
           http_user_agent uri_path url
           bytes_in bytes_out
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `plain_http_post_exfiltrated_data_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled.
known_false_positives: No false positives have been identified at this time.
references:
    - https://blog.talosintelligence.com/2020/03/trickbot-primer.html
finding:
    title: A http post $http_method$ sending packet with plain text of information in uri path $uri_path$
    entity:
        field: src_ip
        type: system
        score: 50
analytic_story:
    - Data Exfiltration
    - Command And Control
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '8621.11046'
title: Potential CVE-2021-4034
description: 'The Qualys Research Team has discovered a memory corruption vulnerability
  in polkit’s pkexec, a SUID-root program that is installed by default on every major
  Linux distribution. This use case looks for correlation of events for the execution
  of PoCs for CVE-2021-4034. - Threat Actor Association: Lazarus'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type IN(path, syscall) "pkexec")
  OR type=bprm_fcaps | table _time, host, user src_ip, process_*, user, type, process
  `group_events(host, 2)` | where match(type, "(?i)path") and match(type, "(?i)syscall")
  and match(type, "(?i)bprm_fcaps") and match(process_path, "(?i)pkexec") '
techniques:
- privilege-escalation:abuse elevation control mechanism:setuid and setgid
- privilege-escalation:exploitation for privilege escalation
technique_id:
- T1548.001
- T1068
data_category:
- Linux audit logs
references:
- https://github.com/arthepsy/CVE-2021-4034
- https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
- https://github.com/berdav/CVE-2021-4034/blob/main/pwnkit.c
- https://threatpost.com/linux-bug-in-all-major-distros-an-attackers-dream-come-true/177996/

name: User Discovery With Env Vars PowerShell Script Block
id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20
version: 10
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the use of PowerShell environment variables to identify the current logged user by leveraging PowerShell Script Block Logging (EventCode=4104). This method monitors script blocks containing `$env:UserName` or `[System.Environment]::UserName`. Identifying this activity is significant as adversaries and Red Teams may use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this activity could allow attackers to gain insights into user context, aiding in further exploitation and lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*$env:UserName*" OR ScriptBlockText = "*[System.Environment]::UserName*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `user_discovery_with_env_vars_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1033/
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1033
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows BootLoader Inventory
id: 4f7e3913-4db3-4ccd-afe4-31198982305d
version: 8
creation_date: '2023-04-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: Hunting
description: The following analytic identifies the bootloader paths on Windows endpoints. It leverages a PowerShell Scripted input to capture this data, which is then processed and aggregated using Splunk. Monitoring bootloader paths is significant for a SOC as it helps detect unauthorized modifications that could indicate bootkits or other persistent threats. If confirmed malicious, such activity could allow attackers to maintain persistence, bypass security controls, and potentially control the boot process, leading to full system compromise.
data_source: []
search: |-
    `bootloader_inventory`
      | stats count min(_time) as firstTime max(_time) as lastTime values(_raw)
        BY host
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_bootloader_inventory_filter`
how_to_implement: To implement this analytic, a new stanza will need to be added to a inputs.conf and deployed to all or some Windows endpoints. https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707 provides the stanza. If modifying the sourcetype, be sure to update the Macro for this analytic. Recommend running it daily, or weekly, depending on threat model.
known_false_positives: No false positives here, only bootloaders. Filter as needed or create a lookup as a baseline.
references:
    - https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707
    - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
analytic_story:
    - BlackLotus Campaign
    - Windows BootKits
asset_type: Endpoint
mitre_attack_id:
    - T1542.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Hunting System Account Targeting Lsass
id: 1c6abb08-73d1-11ec-9ca0-acde48001122
version: 12
creation_date: '2022-01-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies processes attempting to access Lsass.exe, which may indicate credential dumping or applications needing credential access. It leverages Sysmon EventCode 10 to detect such activities by analyzing fields like TargetImage, GrantedAccess, and SourceImage. This behavior is significant as unauthorized access to Lsass.exe can lead to credential theft, posing a severe security risk. If confirmed malicious, attackers could gain access to sensitive credentials, potentially leading to privilege escalation and further compromise of the environment.
data_source:
    - Sysmon EventID 10
search: |-
    `sysmon` EventCode=10 TargetImage=*lsass.exe
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY CallTrace EventID GrantedAccess
           Guid Opcode ProcessID
           SecurityID SourceImage SourceProcessGUID
           SourceProcessId TargetImage TargetProcessGUID
           TargetProcessId UserID dest
           granted_access parent_process_exec parent_process_guid
           parent_process_id parent_process_name parent_process_path
           process_exec process_guid process_id
           process_name process_path signature
           signature_id user_id vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_hunting_system_account_targeting_lsass_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
known_false_positives: False positives will occur based on GrantedAccess and SourceUser, filter based on source image as needed. Utilize this hunting analytic to tune out false positives in TTP or anomaly analytics.
references:
    - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
    - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
    - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
    - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
    - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN
analytic_story:
    - CISA AA23-347A
    - Credential Dumping
    - Lokibot
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1003.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows InstallUtil URL in Command Line
id: 28e06670-43df-11ec-a569-acde48001122
version: 15
creation_date: '2021-11-12'
modification_date: '2026-07-14'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of Windows InstallUtil.exe with an HTTP or HTTPS URL in the command line. This is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions containing URLs. This activity is significant as it may indicate an attempt to download and execute malicious code, potentially bypassing application control mechanisms. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, or persistent access within the environment. Analysts should review the parent process, network connections, file modifications, and related processes for further investigation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    `process_installutil`
    Processes.process IN ("*http://*","*https://*")
    by Processes.action Processes.dest Processes.original_file_name
    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
    Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_installutil_url_in_command_line_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
    - https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Living Off The Land
    - Compromised Windows Host
    - Signed Binary Proxy Execution InstallUtil
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1218.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint